Environment

• OS: Windows 11 ARM64
• Docker: Docker Desktop (latest)
• OpenClaw: 2026.1.29
• Gateway Mode: Docker (docker compose up openclaw-gateway)

Problem

When running the OpenClaw gateway inside Docker Desktop on Windows, the browser dashboard cannot connect. Every WebSocket connection fails with:

disconnected (1008): pairing required

Root Cause Analysis

Looking at gateway logs, the issue is Docker's NAT networking:

[ws] closed before connect conn=8fabde36-... 
remote=172.18.0.1 fwd=n/a origin=http://127.0.0.1:18789
host=127.0.0.1:18789 code=1008 reason=pairing required

• Browser connects to 127.0.0.1:18789 → Docker NAT → Gateway sees 172.18.0.1
• Gateway treats 172.18.0.1 as an external connection (not localhost)
• External connections require node pairing, which the browser cannot complete

Config (verified correct)

{
  "gateway": {
    "mode": "local",
    "auth": {
      "mode": "token",
      "token": "<redacted>"
    },
    "bind": "lan"
  }
}

What I Tried (all failed)

1. ✅ Token in URL: /?token=... - Still "pairing required"
2. ✅ trustedProxies: ["172.18.0.0/16"] - Accepted but didn't fix
3. ❌ auth.mode: "none" - Invalid config
4. ❌ auth.allowInsecureAuth: true - Unknown key

Expected Behavior

Dashboard should connect when the token is correct, regardless of whether the connection arrives via Docker's internal NAT.

Suggested Fix

Add a config option like gateway.auth.skipPairingForTokenAuth: true or automatically trust connections when a valid token is provided in the WebSocket handshake.

Workaround

Run the gateway natively on Windows (not in Docker) to get real localhost connections.

Labels: bug, windows, docker