Chapter 12. Recommendations for a Self-Hosted Agent Fleet
This chapter is the 's applied synthesis for one scenario: a few personal on your own host, with the prospect of growing to dozens. The typical architecture of such a fleet is mostly right: a supervisor, budgets on the , a ban on direct networking between agents. But an architecture adopted in a single package and without external cross-checking is a set of hypotheses, not verified facts: every "we rejected it because" needs to be checked against the market. Cross-checking the typical decisions against 2025–2026 data shows: some hypotheses are confirmed, some are refuted by numbers, and some by incidents that have already happened.
Isolation: The Anti-microVM Argument Is Two Orders of Magnitude Out of Date
The typical isolation stack for a fleet on one host is layers on top of a shared kernel (UID namespaces, cgroup v2, disk quotas, a per-agent network namespace), while the microVM is rejected because of "hundreds of megabytes of overhead per VM." That figure does not hold up: Firecracker boots in ~125 ms with under 5 MiB of overhead per VM and up to 150 VMs/s per host (Northflank, 02.2026) — a two-orders-of-magnitude gap from the argument. The industry is already voting with practice: the Firecracker-based E2B service grew from ~40K to ~15M a month in a year (AgentMarketCap), and the cheapest managed OpenClaw hosting (LobsterTank, ~$2/mo) advertises isolation specifically on Firecracker microVMs (managemyclaw).
The second assumption behind this choice is fragile too — "the are chat, not code-executing." Microsoft explicitly recommends treating a self-hosted OpenClaw-class agent as "untrusted code execution with credentials" and running it only in disposable, isolated environments (Microsoft Security, 19.02.2026). The 's recommendation: container layers are a reasonable default for purely chat agents, but agents with exec need a separate "microVM" tier, and exec itself should be opt-in, not the default.
The mandatory minimum for any self-hosted fleet is a on loopback and zero public ports. SecurityScorecard found 40,214 exposed OpenClaw instances on 28,663 IPs (35.4% vulnerable at the time of their own report; the counter grew from 24,034 to 40,214 during the scan itself) (Infosecurity, SecurityScorecard), and CVE-2026-25253 (a 1-click RCE via the unvalidated gatewayUrl, CVSS 8.8) was found by an pentester in ~1 h 40 min (Ethiack). The bar: a version no lower than v2026.2.25 (which also closes "ClawJacked" — brute-forcing the gateway password over a localhost WebSocket, Oasis Security).
This is where the open part of the chapter ends. The rest opens with a free registration — no payment, just an email address.