openclaw/scripts/gcp/README.md

GCP Deployment Scripts

Minimal container deployment for Clawdbot on Google Cloud Platform.

Quick Start

# 1. Create a NEW GCP project and enable APIs
./setup-project.sh clawdbot-$(date +%Y%m%d) us-east1

# 2. Store secrets (interactive)
./store-secrets.sh

# 3. Build and push production image
./build-push.sh local   # Build locally, push to GCR
./build-push.sh cloud   # Build on Cloud Build (no local Docker)

# 4. Deploy
./deploy-vm.sh          # Compute Engine (free tier: e2-micro)
./deploy-vm.sh e2-small # Compute Engine with more RAM
./deploy-cloudrun.sh    # Cloud Run (pay per request)

# 5. Connect
./connect.sh            # IAP tunnel to Gateway
./ssh.sh                # SSH into VM
./logs.sh --follow      # View container logs

Cost Comparison

Option	Monthly Cost	Notes
e2-micro VM	$0 (free tier)	1 vCPU shared, 1GB RAM, always on
e2-small VM	~$13/mo	2 vCPU shared, 2GB RAM
Cloud Run	~$0-5/mo	Pay per request, auto-scales to 0

Files

• setup-project.sh - Enable APIs, create service account, firewall rules
• store-secrets.sh - Store API keys in Secret Manager
• build-push.sh - Build production image and push to GCR
• deploy-vm.sh - Deploy to Compute Engine with container
• deploy-cloudrun.sh - Deploy to Cloud Run
• connect.sh - IAP tunnel to Gateway port
• ssh.sh - SSH into VM via IAP
• logs.sh - View container logs

Production Image

Uses Dockerfile.production (multi-stage build):

• Builder stage: Full Node.js + Bun for compilation
• Production stage: node:22-bookworm-slim (~150-200MB final)
• Runs as non-root user
• Health check endpoint

Security

• No public IP (access via IAP tunnel)
• Secrets stored in Secret Manager
• Dedicated service account with minimal permissions
• Shielded VM with Secure Boot