This runbook is for operators who maintain availability, security posture, and incident response.
Last verified: February 18, 2026.
Use this document for day-2 operations:
- starting and supervising runtime
- health checks and diagnostics
- safe rollout and rollback
- incident triage and recovery
For first-time installation, start from one-click-bootstrap.md.
| Mode | Command | When to use |
|---|---|---|
| Foreground runtime | zeroclaw daemon |
local debugging, short-lived sessions |
| Foreground gateway only | zeroclaw gateway |
webhook endpoint testing |
| User service | zeroclaw service install && zeroclaw service start |
persistent operator-managed runtime |
| Docker / Podman | docker compose up -d |
containerized deployment |
If you installed via ./install.sh --docker, the container exits after onboarding. To run
ZeroClaw as a long-lived container, use the repository docker-compose.yml or start a
container manually against the persisted data directory.
# Start (detached, auto-restarts on reboot)
docker compose up -d
# Stop
docker compose down
# Restart
docker compose up -dReplace docker with podman if using Podman.
# Start a new container from the bootstrap image
docker run -d --name zeroclaw \
--restart unless-stopped \
-v "$PWD/.zeroclaw-docker/.zeroclaw:/zeroclaw-data/.zeroclaw" \
-v "$PWD/.zeroclaw-docker/workspace:/zeroclaw-data/workspace" \
-e HOME=/zeroclaw-data \
-e ZEROCLAW_WORKSPACE=/zeroclaw-data/workspace \
-p 42617:42617 \
zeroclaw-bootstrap:local \
gateway
# Stop (preserves config and workspace)
docker stop zeroclaw
# Restart a stopped container
docker start zeroclaw
# View logs
docker logs -f zeroclaw
# Health check
docker exec zeroclaw zeroclaw statusFor Podman, add --userns keep-id --user "$(id -u):$(id -g)" and append :Z to volume mounts.
Re-running install.sh --docker rebuilds the image and re-runs onboarding. To simply
restart, use docker start, docker compose up -d, or podman start.
For full setup instructions, see one-click-bootstrap.md.
- Validate configuration:
zeroclaw status- Verify diagnostics:
zeroclaw doctor
zeroclaw channel doctor- Start runtime:
zeroclaw daemon- For persistent user session service:
zeroclaw service install
zeroclaw service start
zeroclaw service status| Signal | Command / File | Expected |
|---|---|---|
| Config validity | zeroclaw doctor |
no critical errors |
| Channel connectivity | zeroclaw channel doctor |
configured channels healthy |
| Runtime summary | zeroclaw status |
expected provider/model/channels |
| Daemon heartbeat/state | ~/.zeroclaw/daemon_state.json |
file updates periodically |
~/.zeroclaw/logs/daemon.stdout.log~/.zeroclaw/logs/daemon.stderr.log
journalctl --user -u zeroclaw.service -f- Snapshot system state:
zeroclaw status
zeroclaw doctor
zeroclaw channel doctor- Check service state:
zeroclaw service status- If service is unhealthy, restart cleanly:
zeroclaw service stop
zeroclaw service start-
If channels still fail, verify allowlists and credentials in
~/.zeroclaw/config.toml. -
If gateway is involved, verify bind/auth settings (
[gateway]) and local reachability.
Before applying config changes:
- backup
~/.zeroclaw/config.toml - apply one logical change at a time
- run
zeroclaw doctor - restart daemon/service
- verify with
status+channel doctor
If a rollout regresses behavior:
- restore previous
config.toml - restart runtime (
daemonorservice) - confirm recovery via
doctorand channel health checks - document incident root cause and mitigation