NousResearch/NemoClaw

NousResearch/NemoClaw

Description: Run OpenClaw more securely inside NVIDIA OpenShell with managed inference

Language: TypeScript

License: Apache-2.0

Stars: 23

Forks: 8

Open issues: 6

Created: 2026-04-24T18:35:00Z

Pushed: 2026-06-05T21:20:14Z

Default branch: main

Fork: yes

Parent repository: NVIDIA/NemoClaw

Archived: no

README:

🦞 NVIDIA NemoClaw: Reference Stack for Running OpenClaw in OpenShell

NVIDIA NemoClaw is an open source reference stack that simplifies running OpenClaw always-on assistants more safely. It installs the NVIDIA OpenShell runtime, part of NVIDIA Agent Toolkit, which provides additional security for running autonomous agents.

> Alpha software > > NemoClaw is available in early preview starting March 16, 2026. > This software is not production-ready. > Interfaces, APIs, and behavior may change without notice as we iterate on the design. > The project is shared to gather feedback and enable early experimentation. > We welcome issues and discussion from the community while the project evolves.

NemoClaw adds guided onboarding, a hardened blueprint, state management, OpenShell-managed channel messaging, routed inference, and layered protection on top of the NVIDIA OpenShell runtime. For the full feature list, refer to Overview. For the system diagram, component model, and blueprint lifecycle, refer to How It Works and Architecture.

Getting Started

Follow these steps to install NemoClaw and run your first sandboxed OpenClaw agent.

Prerequisites

Before getting started, check the prerequisites to ensure you have the necessary software and hardware to run NemoClaw.

Hardware

| Resource | Minimum | Recommended | |----------|----------------|------------------| | CPU | 4 vCPU | 4+ vCPU | | RAM | 8 GB | 16 GB | | Disk | 20 GB free | 40 GB free |

The sandbox image is approximately 2.4 GB compressed. During image push, the Docker daemon, k3s, and the OpenShell gateway run alongside the export pipeline, which buffers decompressed layers in memory. On machines with less than 8 GB of RAM, this combined usage can trigger the OOM killer. If you cannot add memory, configuring at least 8 GB of swap can work around the issue at the cost of slower performance.

Software

| Dependency | Version | |------------|----------------------------------| | Node.js | 22.16 or later | | npm | 10 or later | | Platform | See below |

OpenShell Lifecycle

For NemoClaw-managed environments, use nemoclaw onboard when you need to create or recreate the OpenShell gateway or sandbox. Avoid openshell self-update, npm update -g openshell, openshell gateway start --recreate, or openshell sandbox create directly unless you intend to manage OpenShell separately and then rerun nemoclaw onboard.

Container Runtimes

The following table lists tested platform and runtime combinations. Availability is not limited to these entries, but untested configurations may have issues.

| OS | Container runtime | Status | Notes | |----|-------------------|--------|-------| | Linux | Docker | Tested | Primary tested path. | | macOS (Apple Silicon) | Colima, Docker Desktop | Tested with limitations | Install Xcode Command Line Tools (xcode-select --install) and start the runtime before running the installer. | | DGX Spark | Docker | Tested | Use the standard installer and nemoclaw onboard. For an end-to-end walkthrough with local Ollama inference, see the NVIDIA Spark playbook. | | Windows WSL2 | Docker Desktop (WSL backend) | Tested with limitations | Requires WSL2 with Docker Desktop backend. |

For platform-specific pre-setup (for example, Windows WSL 2), see Prerequisites.

Install NemoClaw and Onboard OpenClaw Agent

Download and run the installer script. The script installs Node.js if it is not already present, then runs the guided onboard wizard to create a sandbox, configure inference, and apply security policies.

> ℹ️ Note > > NemoClaw creates a fresh OpenClaw instance inside the sandbox during the onboarding process. > > The installer runs as your normal user and does not require sudo or root. > It installs Node.js via nvm and NemoClaw via npm, both into user-local directories. > Docker must be installed and running before you run the installer. Installing Docker may require elevated privileges on Linux.

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

The piped installer prompts through your terminal. In headless scripts or CI, pass explicit acceptance to the bash side of the pipe:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_NON_INTERACTIVE=1 NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 bash

If you use nvm or fnm to manage Node.js, the installer may not update your current shell's PATH. If nemoclaw is not found after install, run source ~/.bashrc (or source ~/.zshrc for zsh) or open a new terminal.

When the install completes, a summary confirms the running environment:

──────────────────────────────────────────────────
Sandbox my-assistant (Landlock + seccomp + netns)
Model nvidia/nemotron-3-super-120b-a12b (NVIDIA Endpoints)
──────────────────────────────────────────────────
Run: nemoclaw my-assistant connect
Status: nemoclaw my-assistant status
Logs: nemoclaw my-assistant logs --follow
──────────────────────────────────────────────────

To change settings later:
Model: nemoclaw inference get
nemoclaw inference set --model --provider --sandbox my-assistant

[INFO] === Installation complete ===

Chat with the Agent

Connect to the sandbox, then chat with the agent through the TUI or the CLI.

nemoclaw my-assistant connect

In the sandbox shell, open the OpenClaw terminal UI and start a chat:

openclaw tui

Alternatively, send a single message and print the response:

openclaw agent --agent main -m "hello" --session-id test

Model Router (Experimental)

NemoClaw includes an optional model router that automatically picks the most efficient model for each query. Instead of sending every request to a single…