---
title: "Docker OpenClaw E2EE"
description: "Point OpenClaw at a BLACKBOX AI end-to-end encrypted model from inside a Docker container. All requests are sealed with ECDH + AES-256-GCM before they leave your machine and only decrypted inside the GPU enclave."
url: "https://website-zeta-three-37.vercel.app/blog/private-coding-agent-openclaw-docker-e2ee"
canonical: "https://website-zeta-three-37.vercel.app/blog/private-coding-agent-openclaw-docker-e2ee"
date: 2026-07-14
reading_time_minutes: 2
sources:
  - https://www.npmjs.com/package/openclaw
  - https://app.blackbox.ai/dashboard
---

# Docker OpenClaw E2EE

This guide walks you through pointing [OpenClaw](https://www.npmjs.com/package/openclaw) at a BLACKBOX AI end-to-end encrypted model endpoint from inside a Docker container. All requests are sealed with ECDH + AES-256-GCM before they leave your machine and only decrypted inside the GPU enclave.

![Secure inference flow: openclaw → bb-cc-proxy (ECDH + AES-256-GCM) inside your container, then out to https://{your-org}.blackbox.ai/enc/{provider}/{model} and into the GPU enclave](/images/blog/openclaw-docker-e2ee-architecture.png)

## Prerequisites

You need the following installed on your host — links point at the official install pages, we won't repeat them here:

| Tool | Install |
| --- | --- |
| Docker Engine | https://docs.docker.com/engine/install/ |
| Docker Compose (v2) | Included with Docker Desktop, or https://docs.docker.com/compose/install/ |
| Git | https://git-scm.com/downloads |
| OpenClaw (CLI) — used inside the container, no host install required | https://www.npmjs.com/package/openclaw |

You also need:

- Your BLACKBOX AI organisation host — a URL of the form `https://{your-org}.blackbox.ai`. Get it from your BLACKBOX AI account administrator.

- Your BLACKBOX AI API key (`sk-…`). Create one from the [BLACKBOX AI dashboard](https://app.blackbox.ai/dashboard).

- The encrypted model id you want to use, in `provider/model` form (e.g. `google/gemma-4-31b-it`).

## Step 1 — Clone the orchestrator repo

```bash
git clone https://github.com/blackboxai-dev/openclaw-docker-e2e-encrypted.git
cd openclaw-docker-e2e-encrypted
```

The repository ships a Dockerfile, a `docker-compose.yml`, and a pre-baked OpenClaw config. During the build it clones `bb-cc-proxy` from its own upstream repo (`github.com/blackboxai-dev/bb-cc-proxy`) — you never need to interact with the proxy repo directly.

## Step 2 — Configure your environment

Copy the example env file and fill in your values:

```bash
cp .env.example .env
```

Edit `.env`:

```bash
ENC_MODEL_URL=https://your-org.blackbox.ai

# REQUIRED — your BLACKBOX AI API key
BLACKBOX_API_KEY=sk-your-key-here

# OPTIONAL — defaults to google/gemma-4-31b-it
# ENC_MODEL_ID=google/gemma-4-31b-it
```

`.env` is in `.gitignore` by default so your key won't be committed.

> **NOTE — BYO-key mode (default)**
>
> The proxy forwards each caller's `Authorization: Bearer` header upstream verbatim, so multiple users can share the same proxy each with their own key. If you don't want that, set `PASSTHROUGH_API_KEY=0` in `.env` and every request will use the single `BLACKBOX_API_KEY` above.

## Step 3 — Build the container

```bash
docker compose build openclaw
```

This produces one image (`openclaw-enc:latest`) containing both `bb-cc-proxy` and the `openclaw` CLI.

## Step 4 — Run a smoke test

Verify the whole path — attestation, ECDH handshake, encrypted request, decrypted reply, OpenClaw dispatch — with a single one-shot command:

```bash
docker compose run --rm openclaw \
  openclaw agent --local --session-key poc:smoketest \
  --message "In one sentence, what model are you?"
```

You should see output ending with something like:

```
[entrypoint] starting bb-cc-proxy
[entrypoint]   upstream : https://your-org.blackbox.ai/enc/google/gemma-4-31b-it
[entrypoint]   local    : http://127.0.0.1:8080/v1
[entrypoint] waiting for proxy /health ... ready.
cc_proxy.session: ECDH shared key established (session_id=...)
[provider-transport-fetch] start provider=bbenc model=google/gemma-4-31b-it
POST /v1/chat/completions HTTP/1.1 200
Hello! I'm Gemma 4 31B IT, running on encrypted BLACKBOX AI infrastructure.
[agent] run <uuid> ended with stopReason=stop
```

If you see the model reply, the encrypted round-trip works.

> **INSIGHT — What just happened?**
>
> The container started `bb-cc-proxy` on `127.0.0.1:8080`, the proxy fetched `/enc/{provider}/{model}/attestation` from your org host, derived a per-session AES key via ECDH, and OpenClaw's request was then sealed and sent to the enclave. The reply came back encrypted, was verified and decrypted by the proxy, and handed to OpenClaw as a normal OpenAI response.

## Step 5 — Interactive chat

For an interactive session, drop into the container's shell:

```bash
docker compose run --rm openclaw
```

You now have `openclaw` available with the proxy running in the background. Try any of:

```bash
# TUI chat
openclaw chat

# Single agent turn
openclaw agent --local --session-key work:daily --message "Summarise these logs..."

# Verify OpenClaw sees the proxy
openclaw config validate

# Hit the proxy directly (useful for debugging)
curl -s http://127.0.0.1:8080/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $BLACKBOX_API_KEY" \
  -d '{"model":"'"$ENC_MODEL_ID"'","messages":[{"role":"user","content":"hi"}]}'
```

Type `exit` to leave the container. Your OpenClaw workspace (pairing tokens, session history, skills) persists in a Docker volume named `openclaw-workspace`, so subsequent runs pick up where you left off.

## Step 6 — Point another CLI at the proxy (optional)

The proxy is also reachable from your host at `http://127.0.0.1:8080` while the container is running (port 8080 is published in `docker-compose.yml`). Any OpenAI-compatible tool works — set:

| Setting | Value |
| --- | --- |
| base_url | http://127.0.0.1:8080/v1 |
| api_key | your BLACKBOX AI key (sk-…) |
| model | your ENC_MODEL_ID value |

## Troubleshooting

| Symptom | Fix |
| --- | --- |
| `BLACKBOX_API_KEY is required` | You didn't create `.env`, or the variable is empty. See Step 2. |
| `401 Unauthorized` in the proxy logs | Wrong `BLACKBOX_API_KEY`, or the key isn't authorised for the model in `ENC_MODEL_ID`. |
| `409 Conflict` in the proxy logs | Session expired — the proxy auto-reattests and retries; no action needed. If it repeats, check upstream health. |
| Config valid but OpenClaw says "invalid input" | Make sure you didn't edit `openclaw.json` inside the container — the image ships a validated copy. |
| `Pass --to <E.164>, --session-key, --session-id, or --agent` | Add `--session-key <anything>` to your `openclaw agent` call. |
| Proxy log says `INSECURE: NOT verifying GPU attestation` | Expected for this release — see the Security section of the top-level `README.md`. |

## Cleaning up

```bash
docker compose down -v          # stop the container and remove the workspace volume
docker rmi openclaw-enc:latest  # remove the image
```

That's it — you now have OpenClaw talking to your encrypted BLACKBOX AI model inside a fully containerised environment.