Compare the bundled Compute Drivers before choosing where to run Agents. The first table summarizes current Agent deployment paths. The detailed capability matrix is a reviewed source snapshot: it describes implementation components, not proof that a complete deployment or model request works. Its baseline and review date are shown above the generated table.
The local docs preview adds search, filters, and expandable source/test evidence to this page. On GitHub, status links in the table open pinned implementation sources. Full cell explanations and evidence are in the canonical matrix data.
| Driver | Current Agent deployment |
|---|---|
| Kubernetes | Embedded OpenClaw supports an OCC Secret-backed API key. Dedicated Codex supports an OCC Secret-backed API key or a managed ChatGPT service-account credential. |
| SSH | Supports embedded OpenClaw with harnessAuth.method: runtime; an operator must supply the model credential on the Linux host. No OCC-managed model credentials or dedicated Codex. |
| Docker/Podman | Runs the local control plane, but rejects all current model-authentication bindings. A newly admitted Agent cannot be deployed through this Driver. |
An optional OpenShell Sandbox Driver can be selected with Kubernetes, but stock OpenShell lacks required credential and workload-identity projection. It is not a supported Agent deployment path. The bundled Compute Drivers expose the current gateway authentication contracts:
| Driver | Gateway authentication |
|---|---|
| Kubernetes | Trusted proxy only, with optional loopback password access. |
| Docker/Podman | Managed password by default; explicit trusted proxy remains supported by the underlying container code. Current Agent admission limits still apply. |
| SSH | Managed password by default; explicit trusted proxy remains supported. |
Current Kubernetes storage uses a private Gateway RWO claim and a separate Harness-only RWO workspace. Replacements stop predecessors before starting the candidate. See the current storage contract.
The detailed matrix retains its older source baseline. Its shared-workspace/RWX and trusted-proxy rows are historical observations, not current storage or credential requirements. Use the current contracts above for those behaviors. For setup, see Drivers quickstart. The Compute Driver contract owns requirements; the platform architecture distinguishes implementation from remaining design work.
- Supported: the inspected implementation provides the scoped behavior.
- Partial: the behavior has a material restriction explained in the cell.
- Unsupported: the implementation rejects or does not provide the behavior.
- Unknown: the available evidence does not establish the behavior.
A checkmark describes an individual implementation component. For example, Docker's embedded and dedicated topology code earns checkmarks in the pinned table, even though current Agent authentication prevents a new deployment. A required-contract row records an obligation; optional-capability rows record choices. Production also requires activation stages. Tests linked in the interactive view were not executed in this source review. No cell certifies a live model response or production readiness. Contributors can use the testing guide for runtime verification.
- Docker runs the Compose control plane on Docker or Podman for development.
- Kubernetes supports Kubernetes workload orchestration and production configuration.
- SSH runs embedded OpenClaw on operator-provisioned Linux/systemd hosts.
LocalTest is not a bundled selectable implementation in this snapshot. External ComputeDriver packages remain an extension point, not an additional implementation with inferred support. Selection and preflight rules belong to Driver selection.
Reviewed 2026-09-16 at 23d490b93d59dc810f28430f31576209200ba9ba.
| Capability | Requirement | Docker / Podman | Kubernetes | SSH |
|---|---|---|---|---|
| Production startup selection | implementation boundary | — Unsupported | ✓ Supported | ✓ Supported |
| Prepare Namespace infrastructure | required contract | ✓ Supported | ✓ Supported | ✓ Supported |
| Delete owned Namespace resources | required contract | ✓ Supported | ✓ Supported | ✓ Supported |
| Prepare an Agent revision | required contract | ✓ Supported | ✓ Supported | ✓ Supported |
| Explicit activation and deactivation stages | required in production | — Unsupported | ✓ Supported | ✓ Partial |
| Stop an Agent revision by ID without retiring it | required contract | ✓ Supported | ✓ Supported | ✓ Supported |
| Retire predecessor without removing replacement | required contract | ✓ Supported | ✓ Supported | ✓ Supported |
| Embedded OpenClaw Harness | implementation boundary | ✓ Supported | ✓ Supported | ✓ Supported |
| Dedicated Codex Harness | implementation boundary | ✓ Partial | ✓ Supported | — Unsupported |
| Preserve serving runtime until activation | implementation boundary | — Unsupported | ✓ Supported | ✓ Supported |
| Zero-downtime gateway replacement | implementation boundary | — Unsupported | — Unsupported | — Unsupported |
| Adopt an existing tenant namespace | optional capability | — Unsupported | ✓ Supported | — Unsupported |
| Delegate dedicated Harness to SandboxDriver | optional capability | — Unsupported | ✓ Supported | — Unsupported |
| Selected-driver lifecycle hooks | optional capability | ✓ Supported | ✓ Supported | ✓ Supported |
| Install admitted native plugins | optional capability | ✓ Supported | ✓ Supported | — Unsupported |
| Tenant network isolation | implementation boundary | ✓ Partial | ✓ Supported | — Unsupported |
| Explicit CPU/memory limits and tenant quotas | implementation boundary | — Unsupported | ✓ Supported | — Unsupported |
| Non-root workload execution | implementation boundary | ✓ Supported | ✓ Supported | ✓ Supported |
| Workload filesystem and privilege restrictions | implementation boundary | ✓ Supported | ✓ Supported | ✓ Partial |
| Project service-principal workload token | implementation boundary | — Unsupported | ✓ Supported | — Unsupported |
| Resolve private WSS gateway endpoint | optional capability | — Unsupported | ✓ Supported | — Unsupported |
| Persist Agent state across runtime replacement | implementation boundary | — Unsupported | ✓ Supported | ✓ Supported |
| Share dedicated gateway/Harness workspace | implementation boundary | — Unsupported | ✓ Supported | — Unsupported |
| Provision initial Agent runtime credentials | optional capability | — Unsupported | ✓ Supported | — Unsupported |
| Deliver model credential only to executing Harness | implementation boundary | ✓ Supported | ✓ Supported | ✓ Partial |
| Project OCC Secret bindings | optional capability | — Unsupported | ✓ Partial | — Unsupported |
| Backend-issued dedicated Codex access token | optional capability | — Unsupported | ✓ Supported | — Unsupported |
| Persist dedicated transport authentication across retries | implementation boundary | ✓ Partial | ✓ Supported | — Unsupported |
| Honor native trusted-proxy gateway authentication | optional capability | ✓ Supported | ✓ Supported | ✓ Supported |
| Schedule periodic active-runtime maintenance | optional capability | — Unsupported | — Unsupported | — Unsupported |
| Runtime log collection path | implementation boundary | ✓ Partial | ✓ Supported | ✓ Supported |
| Enforce immutable runtime image digests | implementation boundary | — Unsupported | ✓ Supported | — Unsupported |
Edit docs/assets/compute-driver-matrix.json after reviewing the intended source
revision. Keep implementation citations and test citations separate. Regenerate
this table with node scripts/generate-compute-matrix.mjs; the docs build rejects
a stale fallback. Follow local preview validation
and record executed proof separately from support judgments.