NemoClaw + NVIDIA OpenShell: Secure, Managed Inference for OpenClaw Agents

NemoClaw wraps OpenClaw in NVIDIA OpenShell with kernel-level sandboxing and managed inference, turning experimental agents into auditable, enterprise-ready AI services.

What NemoClaw is and why it matters

NVIDIA NemoClaw is an open source reference stack that simplifies running always‑on OpenClaw assistants more safely by installing the NVIDIA OpenShell runtime, configuring sandbox policies, and routing inference through controlled backends.

The official overview describes NemoClaw as a CLI‑driven system that creates an OpenShell sandbox preconfigured for OpenClaw, with filesystem and network policies applied from the first boot.

Unlike running OpenClaw directly on a laptop or a lightly isolated container, NemoClaw adds a four‑layer defense model—network, filesystem, process, and inference—implemented at the runtime and kernel level rather than inside the agent itself.

This is crucial for enterprise and sensitive AI workflows, where autonomous agents that write code, hit APIs, and manipulate files must be governed by out‑of‑process policies instead of hoping the agent “behaves” correctly.

The current NemoClaw release is explicitly marked as alpha and an early preview, with APIs and runtime behavior subject to breaking changes and a clear warning not to use it in production yet, which is important for security architects planning pilots.

NemoClaw vs OpenClaw: security advantages in NVIDIA OpenShell

OpenClaw by itself is an autonomous AI agent framework focused on local‑first assistants; it primarily enforces security at the application layer through mechanisms like API whitelists and configuration flags.

In contrast, NemoClaw is positioned as an enterprise security wrapper around OpenClaw, using NVIDIA OpenShell to provide kernel‑level sandboxing with layered guards for network, filesystem, processes, and inference.

Official and independent analyses highlight several concrete advantages:

• Sandboxed execution: Each OpenClaw agent runs inside an OpenShell sandbox with Landlock, seccomp, and network namespace isolation; no host access is granted by default.
• Declarative network policy: Egress is controlled by YAML policies; unknown hosts are blocked and surfaced for operator approval, enabling deny‑by‑default agent networking.
• Filesystem and process containment: Agents are restricted to sandbox directories (for example /sandbox and /tmp); privileged syscalls and escalation paths are blocked by runtime policy.
• Managed inference routing: All model API calls are rerouted through OpenShell‑configured providers, with centralized control over models, endpoints, and credentials.

The key architectural difference is that NemoClaw enforces security outside the agent process; even if an OpenClaw instance is compromised by prompt injection, it cannot simply disable or bypass the OpenShell sandbox.

Managed inference architecture inside NemoClaw

Plugin, blueprint, sandbox, and inference routing

NemoClaw’s managed inference is built on a four‑component architecture:

• Plugin (TypeScript): Integrates with the OpenClaw CLI and exposes commands like nemoclaw onboard, nemoclaw status, nemoclaw logs, and nemoclaw connect for launching and managing sandboxed agents.
• Blueprint (Python): A versioned artifact that orchestrates sandbox creation, policy configuration, and inference setup. It is digest‑verified before execution and checked against minimum OpenShell/OpenClaw version constraints.
• OpenShell sandbox: An isolated container where OpenClaw runs with filesystem, process, and network isolation enforced by OpenShell; the NemoClaw plugin is preinstalled in this environment.
• Inference layer: NVIDIA inference providers (typically Nemotron and NIM microservices) integrated as OpenShell inference backends, with all agent traffic routed through the OpenShell gateway.

When you run nemoclaw onboard, the CLI calls the plugin, which resolves and verifies the blueprint, then delegates resource orchestration to the OpenShell CLI.

The blueprint plans and creates resources such as the OpenShell gateway, inference providers, sandbox, and network policy, resulting in an OpenClaw agent running inside a hardened OpenShell container with managed inference configured.

Inference profiles and routing behavior

NemoClaw ships with multiple inference profiles (for example default, nim-local, and others), each mapping to a specific provider and endpoint.

The default profile typically routes OpenClaw traffic to NVIDIA’s hosted Nemotron models via the NVIDIA API endpoint (integrate.api.nvidia.com) using an NVIDIA_API_KEY credential.

Key properties of the managed inference layer include:

• Centralized model control: The active inference profile determines which model and endpoint are used; agents do not embed raw provider URLs or keys.
• Transparent routing: From the agent’s perspective, it just calls the model; OpenShell intercepts those calls and forwards them through the configured gateway and privacy router.
• Runtime switching: Profiles can be changed at runtime in many setups (for example, from NVIDIA Cloud to local NIM) without recreating the sandbox, enabling gradual rollout and testing.

For security and compliance teams, this “managed inference” model means that data‑flow decisions—what data can leave, which provider can process it, and how keys are stored—happen at the runtime layer, not buried inside ad‑hoc agent code.

Prerequisites for NemoClaw in NVIDIA OpenShell

Before deploying NemoClaw in a hardened environment, ensure your platform matches NVIDIA’s documented requirements:

• Operating system: Linux, specifically Ubuntu 22.04 LTS or later.
• Node.js and npm: Node.js 20+ and npm 10+; the installer often recommends Node.js 22.
• Container runtime: A supported container runtime installed and running; Docker and k3s are the common baseline in examples.
• NVIDIA OpenShell: OpenShell must be installed and reachable via its CLI, as NemoClaw relies on it to create sandboxes and manage gateway, policy, and inference resources.
• OpenClaw: Either an existing OpenClaw installation or readiness to let NemoClaw create a sandboxed instance as part of onboarding.
• NVIDIA API key: An NVIDIA_API_KEY from NVIDIA’s endpoint platform to enable managed cloud inference with Nemotron models; this is collected during onboarding.

On resource‑constrained hosts, note that the sandbox image is roughly 2.4 GB compressed, and combined Docker, k3s, and gateway activity can exhaust memory; the quickstart recommends at least 8 GB RAM or additional swap to avoid OOM conditions.

Step-by-step: installing NemoClaw and onboarding OpenClaw

Step 1: Preflight checks

On a target Ubuntu 22.04 host, verify core dependencies:

# OS version
lsb_release -d

# Node.js and npm
node -v
npm -v

# Container runtime
docker ps

# Optional: verify OpenShell and OpenClaw if pre-installed
openshell --version
openclaw --version

If Node.js, npm, or the container runtime are missing, install them following your internal hardening standards before proceeding.

Step 2: Install the NemoClaw CLI and runtime

NVIDIA’s quickstart uses a single shell pipeline to install NemoClaw, set up Node.js if needed, and launch the onboarding wizard:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

The script bootstraps the NemoClaw CLI, installs or configures Node.js, and then prepares to run the guided onboarding that will create an OpenShell sandbox, configure inference, and apply initial security policies.

If nemoclaw is not found after installation, re‑source your shell configuration (for example source ~/.bashrc or source ~/.zshrc) or open a new terminal so that PATH changes from Node.js or nvm are applied.

Step 3: Run nemoclaw onboard to create the OpenShell sandbox

Onboarding is where managed inference and sandbox hardening come together:

nemoclaw onboard

According to NVIDIA’s architecture docs and quickstart, this flow performs the following steps:

1. Resolve and verify blueprint: The plugin locates the appropriate blueprint artifact, checks version compatibility, and verifies the cryptographic digest.
2. Plan resources: The blueprint determines which OpenShell resources to create or update (gateway, inference providers, sandbox, network policy).
3. Create sandbox: The OpenShell CLI creates an isolated sandbox container and injects OpenClaw into it.
4. Configure inference: The wizard prompts for your NVIDIA_API_KEY and selects an inference profile (for example, default NVIDIA Cloud profile with nvidia/nemotron-3-super-120b-a12b).
5. Apply policies: Default filesystem and network policies are applied, often with selectable presets for common services or stricter deny‑by‑default egress.

On success, you should see a summary similar to:

Sandbox my-assistant (Landlock + seccomp + netns)
Model nvidia/nemotron-3-super-120b-a12b (NVIDIA Endpoints)

Run:   nemoclaw my-assistant connect
Status: nemoclaw my-assistant status
Logs:   nemoclaw my-assistant logs --follow

At this point, you have an OpenClaw agent running inside an OpenShell sandbox with managed inference configured via NemoClaw.

Secure usage: interacting with OpenClaw through NemoClaw and OpenShell

Managing the sandbox from the host

From the host perspective, NemoClaw exposes a small set of operational commands for each sandbox (here named my-assistant):

# Connect to the sandbox shell
nemoclaw my-assistant connect

# Check sandbox and agent status
nemoclaw my-assistant status

# Stream sandbox logs
nemoclaw my-assistant logs --follow

These commands let DevOps and security teams monitor agent health, inspect logs, and attach to the sandbox without granting direct Docker or k8s access to every developer.

Because policies and inference routes are centrally managed via the blueprint and OpenShell CLI, operators can update network policies or switch inference profiles without touching the agent code running inside the sandbox.

Operating OpenClaw safely inside the sandbox

Once you run nemoclaw my-assistant connect, you are dropped into a shell like sandbox@my-assistant:~$, with OpenClaw preinstalled and the filesystem and network boundaries already enforced.

Typical first actions include:

# Inside the sandbox
openclaw --help           # Inspect available commands
openclaw run              # Start an interactive OpenClaw session

From a security perspective, the critical point is that all OpenClaw activity—filesystem access, spawned processes, outbound HTTP requests, and inference calls—remains within the constraints defined by the NemoClaw blueprint and OpenShell policies:

• If the agent attempts to access disallowed paths, filesystem guards block the operation.
• If it tries to call a non‑allowlisted domain, the network policy denies the request and can surface an approval workflow.
• Every inference call is routed through OpenShell’s inference gateway according to the active profile; credentials and provider endpoints stay under operator control rather than embedded in prompts.

This workflow gives AI developers the familiar OpenClaw experience, while DevOps and security teams retain infrastructure‑level control and observability via NemoClaw and NVIDIA OpenShell.

Practical guidance and cautions

Even though NemoClaw significantly improves the security posture of OpenClaw, NVIDIA’s documentation emphasizes that the project is still alpha and not yet suitable for production.

Security engineers should therefore treat current deployments as controlled pilots: use dedicated hosts, integrate with existing monitoring, and keep policies and inference profiles under tight change management.

Given the curl | bash installer and the sandbox’s broad control over containers, it is wise to:

• Review the install script in secured environments before running it.
• Pin NemoClaw and OpenShell versions in internal tooling to avoid unexpected breaking changes.
• Combine NemoClaw’s runtime safeguards with upstream controls (network segmentation, secret management, logging pipelines) as documented in NVIDIA’s developer guidance.

Used this way, NemoClaw, OpenClaw, and NVIDIA OpenShell form a coherent stack: OpenClaw provides the agent, OpenShell enforces hardened execution, and NemoClaw orchestrates managed inference and security policies so you can run always‑on assistants with far greater confidence than a vanilla containerized setup.