Netclaw has two components: a CLI (netclaw) and a daemon (netclawd). The CLI is a thin client — all inference, tool execution, and session state live in the daemon. Install both on the same machine to get started; for remote setups, see Pairing Remote Devices.
The image runs as the non-root netclaw user, so persist state in a named volume (a host bind mount has to be chowned to UID 1654 first). The container runs the daemon only, bound to loopback — drive it with docker exec netclaw netclaw <command>. To reach it from a host CLI or another machine (including pairing), configure a non-local exposure mode. See Docker Deployment for the full setup.
Pass provider credentials as environment variables:
The init wizard walks you through provider setup, security posture, channels, identity, and network exposure — then starts the daemon. See the Quickstart for the full walkthrough.
By default, the install script and daemon pull from the stable channel — release builds only.
If Netclaw is already installed, switch channels with the CLI:
Terminal window
netclawupdate--channelbeta
This installs the newest build on that channel right away and saves to your config, so later update checks and self-updates follow the beta feed. Pass --channel stable to switch back.
To choose a channel at first install instead, pass --channel to the install script:
Use the ghcr.io/netclaw-dev/netclaw:beta image tag instead of the default ghcr.io/netclaw-dev/netclaw (which resolves to the latest stable).
The install script only swaps which binaries it pulls. Also set Daemon.UpdateChannel: "beta" in your config so the daemon checks the beta feed for self-updates. (Switching with netclaw update --channel does this for you.)
Note: The install script is idempotent — running it on an existing install will update the binaries without breaking your configuration. If the daemon is running, stop it first: