Practical OpenClaw and NemoClaw guides
HowToClaw quick start version: March 19, 2026
NemoClaw is NVIDIA's secure way to run OpenClaw inside an OpenShell sandbox. It adds controlled network access, filesystem limits, process restrictions, and NVIDIA-routed inference so the agent does not run with broad host access by default.
If you want the fastest path to a working agent, use standard OpenClaw. If you want the safer default path, use NemoClaw.
Recommended:
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell --version
Do not continue until openshell --version works.
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
source ~/.zshrc
nemoclaw --version
If you use bash, reload ~/.bashrc instead.
nemoclaw onboard
During onboarding you will:
my-assistantWhen onboarding finishes, note the commands it prints for connect, status, and logs.
From the host:
nemoclaw my-assistant connect
Inside the sandbox:
openclaw tui
For a quick one-shot test instead:
openclaw agent --agent main --local -m "Say hello and explain this sandbox." --session-id smoke-test
If the agent cannot reach a website or API, that is often expected. NemoClaw blocks unknown outbound access until you approve it.
From the host:
openshell term
Use the OpenShell TUI to review blocked destinations and allow only what the workflow actually needs.
# Host
nemoclaw my-assistant status
nemoclaw my-assistant logs --follow
openshell term
# Sandbox
openclaw tui
openclaw agent --agent main --local -m "hello" --session-id test
nemoclaw: command not foundReload your shell and verify the install path is on PATH.
Run:
docker ps
If Docker is not healthy, fix that first.
Open:
openshell term
Then review the blocked host and approve it if appropriate.
Free memory, add swap, or move to a machine closer to the recommended 16 GB RAM.
| Topic | Standard OpenClaw | NemoClaw |
|---|---|---|
| Speed to first run | Faster | Slower |
| Security boundaries | Minimal by default | Stronger by default |
| Network | Broad | Approval-driven |
| Filesystem | Host-oriented | Sandboxed |
| Best use | Prototyping | Secure evaluation and supervised deployment |
Not yet. It is alpha software.
Yes.
Inside the sandbox with openclaw tui or openclaw agent ....
Because NemoClaw is designed to keep outbound access under policy control.
nemoclaw_howtoclaw_summary.mdnemoclaw_guide.mdnemoclaw_research_report.md