diff --git a/docker-compose.phala.yml b/docker-compose.phala.yml
new file mode 100644
index 000000000..ee0c8117d
--- /dev/null
+++ b/docker-compose.phala.yml
@@ -0,0 +1,42 @@
+# Clawdbot on Phala Cloud CVM
+# Deploy with: docker compose -f docker-compose.phala.yml up -d
+#
+# Access the web UI at http://<cvm-ip>:18789
+# Configure channels and API keys via /setup (password protected)
+#
+# If REDPILL_API_KEY is set, the container auto-configures Redpill
+# as the default provider on first boot.
+
+services:
+  clawdbot:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: hashwarlock/clawdbot:redpill
+    environment:
+      HOME: /home/node
+      TERM: xterm-256color
+      # Redpill API key - auto-configures provider on first boot
+      REDPILL_API_KEY: ${REDPILL_API_KEY:-}
+      # Channel tokens - auto-configures channels on first boot
+      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
+      DISCORD_BOT_TOKEN: ${DISCORD_BOT_TOKEN:-}
+      # Gateway configuration
+      GATEWAY_PORT: ${GATEWAY_PORT:-18789}
+      GATEWAY_AUTH: ${GATEWAY_AUTH:-off}
+      GATEWAY_TOKEN: ${GATEWAY_TOKEN:-}
+      GATEWAY_PASSWORD: ${GATEWAY_PASSWORD:-}
+      # Persistence paths inside container
+      CLAWDBOT_STATE_DIR: /data/.clawdbot
+      CLAWDBOT_WORKSPACE_DIR: /data/workspace
+    volumes:
+      # Persistent storage for credentials, agents, sessions
+      - clawdbot-data:/data
+    # Host network mode: container shares CVM's network stack
+    # Gateway binds to loopback, accessible via CVM's public IP
+    network_mode: host
+    restart: unless-stopped
+    entrypoint: ["/bin/bash", "/app/scripts/docker-entrypoint-phala.sh"]
+
+volumes:
+  clawdbot-data:
diff --git a/scripts/docker-entrypoint-phala.sh b/scripts/docker-entrypoint-phala.sh
new file mode 100755
index 000000000..5ae64f7bf
--- /dev/null
+++ b/scripts/docker-entrypoint-phala.sh
@@ -0,0 +1,57 @@
+#!/bin/bash
+# Phala Cloud CVM entrypoint - auto-configures Redpill provider on first boot
+
+set -e
+
+CONFIG_DIR="${CLAWDBOT_STATE_DIR:-/data/.clawdbot}"
+CONFIG_FILE="$CONFIG_DIR/clawdbot.json"
+
+# Create state directory if it doesn't exist
+mkdir -p "$CONFIG_DIR"
+
+# Build gateway auth arguments
+GATEWAY_AUTH_ARGS=""
+if [ "${GATEWAY_AUTH:-off}" = "token" ]; then
+  if [ -z "$GATEWAY_TOKEN" ]; then
+    # Generate a random token if not provided
+    GATEWAY_TOKEN=$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9' | head -c 32)
+    echo "Generated gateway token: $GATEWAY_TOKEN"
+  fi
+  GATEWAY_AUTH_ARGS="--gateway-auth token --gateway-token $GATEWAY_TOKEN"
+elif [ "${GATEWAY_AUTH:-off}" = "password" ]; then
+  if [ -z "$GATEWAY_PASSWORD" ]; then
+    echo "Error: GATEWAY_AUTH=password requires GATEWAY_PASSWORD to be set"
+    exit 1
+  fi
+  GATEWAY_AUTH_ARGS="--gateway-auth password --gateway-password $GATEWAY_PASSWORD"
+else
+  GATEWAY_AUTH_ARGS="--gateway-auth off"
+fi
+
+# Check if we need to run initial setup
+if [ ! -f "$CONFIG_FILE" ] && [ -n "$REDPILL_API_KEY" ]; then
+  echo "First boot detected with REDPILL_API_KEY - running auto-configuration..."
+
+  # shellcheck disable=SC2086
+  node dist/index.js onboard \
+    --non-interactive \
+    --accept-risk \
+    --mode local \
+    --auth-choice redpill-api-key \
+    --workspace "${CLAWDBOT_WORKSPACE_DIR:-/data/workspace}" \
+    --gateway-bind loopback \
+    $GATEWAY_AUTH_ARGS \
+    --skip-daemon \
+    --skip-channels \
+    --skip-skills \
+    --skip-health \
+    --skip-ui
+
+  echo "Auto-configuration complete. Starting gateway..."
+fi
+
+# Start the gateway
+exec node dist/index.js gateway \
+  --bind loopback \
+  --port "${GATEWAY_PORT:-18789}" \
+  --allow-unconfigured