diff --git a/docs/docs.json b/docs/docs.json
index ec751282ad..168d68d22f 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -136,6 +136,7 @@
                     "group": "How to host IronClaw on...",
                     "pages": [
                       "infrastructure/droplet",
+                      "infrastructure/google",
                       "infrastructure/amazon"
                     ]
                   }
@@ -264,6 +265,7 @@
                     "group": "在以下平台托管 IronClaw",
                     "pages": [
                       "zh/infrastructure/droplet",
+                      "zh/infrastructure/google",
                       "zh/infrastructure/amazon"
                     ]
                   }
diff --git a/docs/images/infrastructure/google/google-ip.png b/docs/images/infrastructure/google/google-ip.png
new file mode 100644
index 0000000000..77fddea2f8
Binary files /dev/null and b/docs/images/infrastructure/google/google-ip.png differ
diff --git a/docs/images/infrastructure/google/google-ssh.png b/docs/images/infrastructure/google/google-ssh.png
new file mode 100644
index 0000000000..cb8ba7015a
Binary files /dev/null and b/docs/images/infrastructure/google/google-ssh.png differ
diff --git a/docs/images/infrastructure/google/google-vm.png b/docs/images/infrastructure/google/google-vm.png
new file mode 100644
index 0000000000..af596415fd
Binary files /dev/null and b/docs/images/infrastructure/google/google-vm.png differ
diff --git a/docs/infrastructure/google.mdx b/docs/infrastructure/google.mdx
new file mode 100644
index 0000000000..13e44147cc
--- /dev/null
+++ b/docs/infrastructure/google.mdx
@@ -0,0 +1,196 @@
+---
+title: Google Compute Engine
+description: Host IronClaw on a Google Compute Engine VM
+---
+
+Google Compute Engine (GCE) lets you run virtual machines on Google's infrastructure with flexible pricing and a generous free tier. In this guide we will create a GCE VM instance and configure it securely so you can run IronClaw and expose only the endpoints you actually need.
+
+<Tip>
+Do not feel like setting up your own infrastructure? You can install IronClaw with a few clicks on [agent.near.ai](https://agent.near.ai)
+</Tip>
+
+---
+
+## Create a Google Cloud Project
+
+Sign in to [Google Cloud Console](https://console.cloud.google.com). If this is your first time, accept the Terms of Service when prompted.
+
+In the top navigation bar, click the **project selector** (it shows the current project name or "Select a project") → **New Project**.
+
+Fill in the project details:
+
+- **Project name**: choose a descriptive name (e.g. `ironclaw`)
+- **Organization**: leave as-is unless your account belongs to a Google Workspace org
+- **Location**: leave as-is for personal accounts
+
+Click **Create**. Google will take a few seconds to provision the project.
+
+Once created, make sure the new project is **selected** in the project selector before continuing — all resources you create are scoped to the active project.
+
+---
+
+## Create a VM Instance
+
+Navigate to **Compute Engine → VM instances**. If this is your first time using Compute Engine, you will be prompted to enable the Compute Engine API — click **Enable** and wait a moment.
+
+![GCE VM instances landing page](/images/infrastructure/google/google-vm.png)
+
+Click **Create Instance** and configure the following:
+
+- **Name**: choose a descriptive name (e.g. `ironclaw`)
+- **Region / Zone**: pick a region close to your users
+- **Machine type**: `e2-micro` (free tier eligible) is sufficient for most use cases, or `e2-small` for more headroom
+- **Boot disk**: Ubuntu 24.04 LTS, at least 10 GB
+- **Firewall**: leave **Allow HTTP traffic** and **Allow HTTPS traffic** unchecked for now
+
+You will add explicit firewall rules after the instance is created (see [Configure Firewall Rules](#configure-firewall-rules) below).
+
+
+In the left sidebar, click **Security**. Scroll down to **VM access → Add manually generated SSH keys** and click **+ Add item**, then paste your public SSH key. 
+![GCE instance configuration](/images/infrastructure/google/google-ssh.png)
+You can generate one locally:
+```bash
+ssh-keygen -t ed25519 -C "your-email@example.com"
+cat ~/.ssh/id_ed25519.pub   # copy this value into the Console
+```
+
+The key should be in OpenSSH public key format: `<type> <base64-encoded-key> [comment]` (for example, `ssh-ed25519 AAAA... your-email@example.com`). GCE accepts multiple key types and adds the key to the instance automatically.
+
+<Note>
+You could also log in with a password, but using SSH keys is more secure and recommended. Make sure to keep your private key safe and do not share it with anyone.
+</Note>
+
+---
+
+## Access Your Instance
+
+Once the instance is running, find its **External IP** in the VM instances list.
+
+![GCE instance IP address](/images/infrastructure/google/google-ip.png)
+
+Click the **SSH** button next to the instance to open a browser-based terminal — no local setup needed.
+
+To connect from your own terminal using the IP address:
+
+```bash
+# Replace <IP_ADDRESS> and <USERNAME> accordingly
+ssh <USERNAME>@<IP_ADDRESS>
+```
+---
+
+## Configure Firewall Rules
+
+IronClaw's Web Gateway defaults to `127.0.0.1:3000`, which means it is local-only by default and not directly reachable from the internet.
+
+Recommended exposure model:
+
+- Keep the Web Gateway bound to `127.0.0.1:3000`
+- Expose public traffic with a reverse proxy on `80/443` that forwards to `127.0.0.1:3000`
+- Or keep the gateway private and access it through SSH tunnel/VPN
+
+Navigate to **VPC Network → Firewall** in the left sidebar and create rules based on your model.
+
+Baseline rules (recommended for most setups):
+
+| Rule name | Direction | Targets | Source IP ranges | Protocols / Ports |
+|-----------|-----------|---------|-----------------|-------------------|
+| `allow-ssh-myip` | Ingress | All instances | Your public IP (e.g. `203.0.113.10/32`) | TCP 22 |
+| `allow-webhook` | Ingress | All instances | `0.0.0.0/0` | TCP 8080 |
+
+If you run a reverse proxy (recommended for public web access), also allow:
+
+| Rule name | Direction | Targets | Source IP ranges | Protocols / Ports |
+|-----------|-----------|---------|-----------------|-------------------|
+| `allow-http` | Ingress | All instances | `0.0.0.0/0` | TCP 80 |
+| `allow-https` | Ingress | All instances | `0.0.0.0/0` | TCP 443 |
+
+If you intentionally expose the gateway directly (generally not recommended), you must:
+
+1. Set `GATEWAY_HOST=0.0.0.0` (and optionally `GATEWAY_PORT=<port>` if not `3000`)
+2. Set `GATEWAY_AUTH_TOKEN=<strong-random-token>`
+3. Add a firewall rule for that gateway port, ideally restricted to trusted source IPs
+
+With SSH tunnel or VPN access, keep `GATEWAY_HOST` at the default (`127.0.0.1`) and do not open the gateway port in GCE firewall.
+
+<Note>
+Restricting SSH to your IP prevents brute-force attacks from the internet. You can update the source range later if your IP changes. Port `8080` is required for webhooks (e.g. Telegram) to deliver events to IronClaw. On Linux, the orchestrator internal API listens on port `50051` and binds to `0.0.0.0`; unless you add a firewall rule for it, GCE's default deny-all ingress policy will still block external access. Other IronClaw listeners bind to `127.0.0.1` by default.
+</Note>
+
+---
+
+## Secure Your Instance
+
+Now that you have access to your VM, harden it before installing IronClaw.
+
+### Update and Upgrade
+
+Make sure the system is up to date:
+
+```bash
+sudo apt update && sudo apt upgrade -y
+```
+
+### Create a New User
+
+It is good practice to create a dedicated user with sudo privileges instead of relying on the default account. You can create a new user (for example, `ironclaw`) and add it to the sudo group:
+
+```bash
+sudo adduser ironclaw
+sudo usermod -aG sudo ironclaw
+```
+
+Copy your SSH key from the current user to the new one so you can log in:
+
+```bash
+# Create the .ssh directory for the new user
+sudo mkdir -p /home/ironclaw/.ssh
+
+# Copy the authorized_keys from the current user
+sudo cp ~/.ssh/authorized_keys /home/ironclaw/.ssh/authorized_keys
+
+# Set the correct permissions (critical — SSH will ignore the file otherwise)
+sudo chown -R ironclaw:ironclaw /home/ironclaw/
+sudo chmod 700 /home/ironclaw/.ssh
+sudo chmod 600 /home/ironclaw/.ssh/authorized_keys
+```
+
+Open a new terminal window and confirm you can log in before continuing:
+
+```bash
+ssh ironclaw@<IP_ADDRESS>
+```
+
+<Warning>
+Do not move forward until you have confirmed that you can log in with the new user. If you lose access without another user set up, you will need to recreate the VM.
+</Warning>
+
+
+---
+
+## Install IronClaw
+
+With the server hardened, install IronClaw and start it up:
+
+```bash
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
+```
+
+Then start IronClaw and follow the prompts to complete the setup:
+
+```bash
+ironclaw
+```
+
+<Tip>
+We recommend using a session manager like `tmux` or `screen` so you can easily detach and reattach to your running IronClaw instance between SSH sessions.
+</Tip>
+
+---
+
+## Next Steps
+
+Follow our [Quickstart Guide](/quickstart) to create your first agent, connect it to Telegram, and start exploring IronClaw's capabilities.
+
+Want to talk with your agent using a messaging app? Check out the [**Channels**](/channels/overview) documentation to learn how to connect.
+
+Need your agent to perform complex tasks that require multiple tools? Check out the [**Extensions**](/extensions/overview) documentation.
diff --git a/docs/zh/infrastructure/google.mdx b/docs/zh/infrastructure/google.mdx
new file mode 100644
index 0000000000..c52088543b
--- /dev/null
+++ b/docs/zh/infrastructure/google.mdx
@@ -0,0 +1,195 @@
+---
+title: Google Compute Engine
+description: 在 Google Compute Engine 虚拟机上托管 IronClaw
+---
+
+Google Compute Engine（GCE）让您在 Google 基础设施上运行虚拟机，提供灵活的定价和慷慨的免费套餐。本指南将带您创建一个 GCE 虚拟机实例，并对其进行安全配置，以便运行 IronClaw 并仅暴露您实际需要的端点。
+
+<Tip>
+如果您不想自己搭建基础设施，也可以在 [agent.near.ai](https://agent.near.ai) 上点几下就安装好 IronClaw。
+</Tip>
+
+---
+
+## 创建 Google Cloud 项目
+
+登录 [Google Cloud Console](https://console.cloud.google.com)。如果是第一次使用，请在提示时接受服务条款。
+
+在顶部导航栏中，点击**项目选择器**（显示当前项目名称或"选择项目"）→ **新建项目**。
+
+填写项目详情：
+
+- **项目名称**：选择一个描述性名称（例如 `ironclaw`）
+- **组织**：除非您的账号属于 Google Workspace 组织，否则保持默认
+- **位置**：个人账号保持默认即可
+
+点击**创建**。Google 需要几秒钟来配置项目。
+
+创建完成后，在继续操作之前，请确保在项目选择器中**选中**新项目——所有后续创建的资源都归属于当前活跃项目。
+
+---
+
+## 创建虚拟机实例
+
+导航到 **Compute Engine → 虚拟机实例**。如果是第一次使用 Compute Engine，系统会提示您启用 Compute Engine API——点击**启用**并稍等片刻。
+
+![GCE 虚拟机实例页面](/images/infrastructure/google/google-vm.png)
+
+点击**创建实例**并进行如下配置：
+
+- **名称**：选择一个描述性名称（例如 `ironclaw`）
+- **区域 / 可用区**：选择离您用户最近的区域
+- **机器类型**：`e2-micro`（符合免费套餐资格）足以满足大多数使用场景，或选择 `e2-small` 以获得更多余量
+- **启动磁盘**：Ubuntu 24.04 LTS，至少 10 GB
+- **防火墙**：暂时**不勾选**"允许 HTTP 流量"和"允许 HTTPS 流量"
+
+实例创建后，您将添加明确的防火墙规则（请参阅下方[配置防火墙规则](#配置防火墙规则)）。
+
+在左侧边栏中，点击**安全**。向下滚动至 **虚拟机访问权限 → 手动添加生成的 SSH 密钥**，点击 **+ 添加项**，然后粘贴您的 SSH 公钥。
+![GCE 实例配置](/images/infrastructure/google/google-ssh.png)
+您可以在本地生成一对密钥：
+```bash
+ssh-keygen -t ed25519 -C "your-email@example.com"
+cat ~/.ssh/id_ed25519.pub   # 将此内容复制到控制台
+```
+
+密钥应为 OpenSSH 公钥格式：`<类型> <base64编码密钥> [注释]`（例如 `ssh-ed25519 AAAA... your-email@example.com`）。GCE 支持多种密钥类型，并会自动将密钥添加到实例中。
+
+<Note>
+您也可以使用密码登录，但使用 SSH 密钥会更安全，也更推荐。请妥善保管私钥，不要与他人共享。
+</Note>
+
+---
+
+## 访问您的实例
+
+实例启动后，在虚拟机实例列表中找到其**外部 IP**。
+
+![GCE 实例 IP 地址](/images/infrastructure/google/google-ip.png)
+
+点击实例旁边的 **SSH** 按钮，即可打开基于浏览器的终端——无需本地配置。
+
+要从您自己的终端使用 IP 地址连接：
+
+```bash
+# 将 <IP_ADDRESS> 和 <USERNAME> 替换为实际值
+ssh <USERNAME>@<IP_ADDRESS>
+```
+---
+
+## 配置防火墙规则
+
+IronClaw 的 Web 网关默认绑定到 `127.0.0.1:3000`，即默认仅限本地访问，无法直接从互联网访问。
+
+推荐的暴露模型：
+
+- 将 Web 网关保持绑定在 `127.0.0.1:3000`
+- 通过反向代理在 `80/443` 端口暴露公共流量，并转发到 `127.0.0.1:3000`
+- 或保持网关私有，通过 SSH 隧道/VPN 访问
+
+在左侧边栏导航到 **VPC 网络 → 防火墙**，根据您的模型创建规则。
+
+基础规则（大多数配置推荐）：
+
+| 规则名称 | 方向 | 目标 | 来源 IP 范围 | 协议 / 端口 |
+|----------|------|------|-------------|------------|
+| `allow-ssh-myip` | 入站 | 所有实例 | 您的公网 IP（例如 `203.0.113.10/32`） | TCP 22 |
+| `allow-webhook` | 入站 | 所有实例 | `0.0.0.0/0` | TCP 8080 |
+
+如果您运行反向代理（推荐用于公网 Web 访问），还需允许：
+
+| 规则名称 | 方向 | 目标 | 来源 IP 范围 | 协议 / 端口 |
+|----------|------|------|-------------|------------|
+| `allow-http` | 入站 | 所有实例 | `0.0.0.0/0` | TCP 80 |
+| `allow-https` | 入站 | 所有实例 | `0.0.0.0/0` | TCP 443 |
+
+如果您有意直接暴露网关（通常不推荐），则必须：
+
+1. 设置 `GATEWAY_HOST=0.0.0.0`（如果端口不是 `3000`，可选设置 `GATEWAY_PORT=<端口>`）
+2. 设置 `GATEWAY_AUTH_TOKEN=<强随机令牌>`
+3. 为该网关端口添加防火墙规则，最好限制为受信任的来源 IP
+
+如果通过 SSH 隧道或 VPN 访问，保持 `GATEWAY_HOST` 为默认值（`127.0.0.1`），不要在 GCE 防火墙中开放网关端口。
+
+<Note>
+将 SSH 限制为您的 IP 可以防止来自互联网的暴力破解攻击。如果您的 IP 发生变化，可以随时更新来源范围。Webhook（例如 Telegram）需要 `8080` 端口来向 IronClaw 发送事件。在 Linux 上，编排器内部 API 监听 `50051` 端口并绑定到 `0.0.0.0`；除非您为其添加防火墙规则，GCE 的默认拒绝所有入站流量策略仍会阻止外部访问。其他 IronClaw 监听器默认绑定到 `127.0.0.1`。
+</Note>
+
+---
+
+## 加固您的实例
+
+获得访问权限后，在安装 IronClaw 之前先对虚拟机进行安全加固。
+
+### 更新和升级
+
+确保系统处于最新状态：
+
+```bash
+sudo apt update && sudo apt upgrade -y
+```
+
+### 创建新用户
+
+良好的实践是创建一个具备 sudo 权限的专用用户，而不是依赖默认账号。您可以创建一个新用户（例如 `ironclaw`），并将其加入 sudo 组：
+
+```bash
+sudo adduser ironclaw
+sudo usermod -aG sudo ironclaw
+```
+
+将 SSH 密钥从当前用户复制到新用户，以便您能够登录：
+
+```bash
+# 为新用户创建 .ssh 目录
+sudo mkdir -p /home/ironclaw/.ssh
+
+# 从当前用户复制 authorized_keys
+sudo cp ~/.ssh/authorized_keys /home/ironclaw/.ssh/authorized_keys
+
+# 设置正确的权限（非常关键——否则 SSH 会忽略该文件）
+sudo chown -R ironclaw:ironclaw /home/ironclaw/
+sudo chmod 700 /home/ironclaw/.ssh
+sudo chmod 600 /home/ironclaw/.ssh/authorized_keys
+```
+
+打开一个新的终端窗口，确认可以成功登录后再继续：
+
+```bash
+ssh ironclaw@<IP_ADDRESS>
+```
+
+<Warning>
+在确认新用户可以成功登录之前，不要继续后续步骤。如果在没有其他可用用户的情况下失去访问权限，您将需要重新创建虚拟机。
+</Warning>
+
+
+---
+
+## 安装 IronClaw
+
+服务器加固完成后，安装 IronClaw 并启动：
+
+```bash
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
+```
+
+然后启动 IronClaw 并按照提示完成配置：
+
+```bash
+ironclaw
+```
+
+<Tip>
+建议使用 `tmux` 或 `screen` 这样的会话管理器，以便在 SSH 会话之间轻松分离和恢复运行中的 IronClaw 进程。
+</Tip>
+
+---
+
+## 下一步
+
+阅读我们的[快速开始指南](/quickstart)，创建您的第一个智能体，把它连接到 Telegram，并开始探索 IronClaw 的能力。
+
+想通过消息应用与您的智能体对话？请查看[**频道**](/channels/overview)文档，了解如何完成接入。
+
+需要让智能体执行依赖多个工具的复杂任务？请查看[**扩展**](/extensions/overview)文档。