Self-host an open-source OpenClaw alternative on your own Linux box

What a self-hosted Kortix puts inside your network

Kortix is the open-source AI Operating System, the leading open-source alternative to Claude Cowork and ChatGPT Work, and its code is public (Kortix on GitHub). Self-hosting it keeps the whole control plane for company agent work inside your own network: accounts, projects, repos, secrets, connectors, policy and audit.

The contrast with OpenClaw is why most teams look at it. OpenClaw is an open-source AI assistant that runs on your own computer and meets you in Discord, iMessage, Slack, Teams, Telegram, WhatsApp and more than 20 other channels, with one Gateway process as its local control plane (OpenClaw's repository). The same Gateway runs as a personal assistant on a laptop or as a shared team deployment, and OpenClaw's own documentation calls configuration the only difference between the two. Its tools run on the host for the main session unless you configure sandboxing, and state, memory and credentials stay on that machine.

Kortix keeps the company in a repo instead of a file. Agents and skills are markdown, memory accumulates as files, and kortix.yaml declares the machine image, the connectors and the triggers. Every session gets its own isolated machine on its own branch, and the work lands through a change request a person reads as a diff. Self-host is free: you pay only your own model and compute bills, and the Kortix blog explains the managed plans beside it.

What you need before the first command

A production self-host needs four things, and you can check each one before you install anything:

• A Linux box with Docker. The Kortix docs size the defaults around an 8 GiB host: the API runs with a 640 MiB memory limit by default, which the docs say to keep at that size. A VPS, a cloud VM or a machine on your own network all work.
• A domain you control, with an A or AAAA record for the domain and for api.<domain>, both pointing at the box's IP. Ports 80 and 443 must be reachable so the bundled Caddy proxy can get a TLS certificate.
• A sandbox provider key. Agent sessions run on separate compute, not on the box: Daytona by default, with E2B and Platinum also supported.
• An admin email for the init flow. The first account to sign up becomes platform admin and sets up Git and the model key in the dashboard.

The CLI runs on macOS and Linux, WSL on Windows. On a bare Linux box, the Kortix docs also describe a one-shot bootstrap script that installs Docker, installs the CLI and drives the same init and start flow.

Bring the stack up in five steps

Every command is copy-pasteable, and the Kortix self-hosting docs list the full command surface.

Step 1. Install the CLI

curl -fsSL https://kortix.com/install | bash

The installer downloads a prebuilt binary for macOS or Linux. Run kortix version to confirm it is on your path.

Step 2. Point DNS, then initialize

Create the records and open the ports from the prerequisites, then run:

kortix self-host init --domain kortix.example.com

init writes docker-compose.yml, .env, a Caddyfile and updater.sh into ~/.config/kortix/self-host/<instance>/. The guided flow asks for the admin email, the sandbox provider, optional Pipedream credentials for the connector catalog, and the update policy.

Step 3. Start the stack

kortix self-host start

This runs docker compose up for the whole stack: the frontend, the API, the LLM gateway and the Supabase distribution. While it comes up, kortix self-host status, kortix self-host logs and kortix self-host doctor report what is happening.

Step 4. Set the sandbox key, then finish in the dashboard

kortix self-host configure

configure is an interactive prompt for the sandbox provider key, and optionally a managed-git token. Open your domain in a browser and sign up with the admin email. Two settings make the instance usable: connect GitHub at Settings → Git, and connect your own model key in the model picker.

Step 5. Create the project and open the first change request

Create a project in the dashboard, point the CLI at your instance, and link a repo:

kortix hosts use selfhost
kortix projects ls
kortix projects link <project-id>

Link a repo that holds agents/, skills/, memory/ and kortix.yaml. Start a session and read what it proposes:

kortix sessions new --prompt "Summarize this week's commits and open a change request"
kortix cr ls

The session works on its own sandbox and its own branch. Its work reaches the default branch only when you read the change request and merge it.

What runs on the box, and what runs off it

One Docker Compose stack runs on your box; agent sessions run on sandbox compute off it. The boundary matters for capacity planning and for a security review.

On the box:

• Caddy, a reverse proxy with automatic TLS on ports 80 and 443.
• The frontend, the API and the LLM gateway, the three application images of the stack.
• The Supabase distribution: Postgres, auth, storage and realtime, pinned by digest.
• The updater, which checks daily, migrates and starts the new version before the old stops.

Off the box:

• Agent sandboxes, one isolated Linux machine per session, from Daytona, E2B or Platinum.
• The public image registry the updater pulls from, which needs no credentials.

Fully isolated topologies, where the sandbox compute also runs inside your network, are scoped with Kortix directly rather than self-served.

Models route through your own gateway

A self-hosted instance has no managed model lineup. You connect the providers you already pay for, and every model call routes through the LLM gateway on your own box. Any model provider with your own keys. Or the ChatGPT plan you already pay for. Or sign in with your OpenCode Console account for OpenCode Zen and Go.

kortix providers set anthropic sk-ant-...
kortix providers login chatgpt
kortix providers ls

Secrets are encrypted at rest with a key per project, and you can pick the model per agent, per session or per message.

Day-2 operations: updates, backups, secrets

The instance updates itself. The pieces you own are two directories and one file inside ~/.config/kortix/self-host/<instance>/.

• Watch the stack with kortix self-host status, kortix self-host logs and kortix self-host doctor.
• Pin a version with kortix self-host update --tag <version>, or turn updates off with --auto-update off.
• Back up the instance by copying volumes/db/data, volumes/storage and the instance .env.
• List or rotate secrets with kortix self-host env ls and kortix self-host env rotate.
• Raise the API memory limit with kortix self-host env set KORTIX_API_MEMORY_LIMIT=1024m on a 16 GiB host.

Those are the operations the Kortix docs list. For the wider field of self-hosted agent workspaces, the Kortix blog compares the options.