Building a Secure, Always-On Local AI Agent with OpenClaw and NVIDIA NemoClaw
In the rapidly evolving world of AI, agents are transforming from simple question-and-answer systems into sophisticated, long-running assistants capable of reading files, calling APIs, and managing complex workflows. However, deploying these agents without proper isolation can expose significant risks, especially when utilizing third-party cloud infrastructure. This is where NVIDIA NemoClaw comes into play, offering a robust solution for creating secure, always-on AI agents.
What is NVIDIA NemoClaw?
NVIDIA NemoClaw is an open-source reference stack that seamlessly integrates NVIDIA OpenShell, OpenClaw, and NVIDIA Nemotron to create a powerful, self-hosted gateway for AI coding agents. It provides a comprehensive pipeline from model inference to secure, interactive agent deployment, ensuring data privacy and control.
Key Components:
- NVIDIA NemoClaw: The orchestrator, responsible for installing and configuring the entire stack.
- NVIDIA OpenShell: A security runtime and gateway that enforces sandboxing, manages credentials, and proxies network/API calls.
- OpenClaw: A multi-channel agent framework that manages chat platforms, memory, and tool integration within the sandbox.
- NVIDIA Nemotron 3 Super 120B: An agent-optimized LLM with 120B parameters, enabling high instruction-following and multi-step reasoning capabilities.
- NVIDIA NIM/Ollama: Inference deployments for running the Nemotron model locally.
Setting Up NemoClaw on NVIDIA DGX Spark
This tutorial guides you through deploying NemoClaw on NVIDIA DGX Spark, creating a local, sandboxed AI assistant accessible via Telegram.
Prerequisites:
- Hardware: NVIDIA DGX Spark (GB10) system with Ubuntu 24.04 LTS and the latest NVIDIA drivers.
- Docker: Version 28.x or higher with the NVIDIA container runtime configured.
- Ollama: Installed as the local model-serving engine.
- Telegram Bot Token: Obtained from @BotFather.
Estimated Setup Time:
- Active Setup: Approximately 20-30 minutes.
- Model Download: 15-30 minutes for the initial 87 GB download.
Verifying System Readiness:
- OS Release:
head -n 2 /etc/os-releaseshould show Ubuntu 24.04. - NVIDIA GPU:
nvidia-smishould display the GB10 GPU. - Docker:
docker info --format '{{.ServerVersion}}'should show 28.x+.
Configuration Steps:
- Register NVIDIA Container Runtime:
sudo nvidia-ctk runtime configure --runtime=docker. - Set Cgroup Namespace Mode:
sudo python3 -c "import json, os; d = {'default-cgroupns-mode': 'host'}; json.dump(d, open('/etc/docker/daemon.json', 'w'), indent=2)". - Restart Docker:
sudo systemctl restart docker. - Add User to Docker Group:
sudo usermod -aG docker $USERandnewgrp docker.
Installing Ollama:
- Use the official installer:
curl -fsSL https://ollama.com/install.sh | sh. - Configure Ollama to listen on all interfaces:
sudo mkdir -p /etc/systemd/system/ollama.service.d; printf '[Service] Environment="OLLAMA_HOST=0.0.0.0" ' | sudo tee /etc/systemd/system/ollama.service.d/override.conf; sudo systemctl daemon-reload; sudo systemctl restart ollama.
Verifying Ollama:
- Check if Ollama is running and reachable:
curl http://0.0.0.0:11434.
Pulling the Nemotron Model:
- Download the 87 GB Nemotron 3 Super 120B model:
ollama pull nemotron-3-super:120b. - Pre-load model weights:
ollama run nemotron-3-super:120b.
Installing NemoClaw:
- Use the installer:
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash. - Follow the onboarding wizard, selecting the appropriate configurations.
Verifying the Setup:
- Connect to the sandbox:
nemoclaw my-assistant connect. - Send a test message:
openclaw agent --agent main --local -m "hello" --session-id test.
Accessing the Web UI:
- Exit the sandbox and open the tokenized URL from the onboarding process.
- For remote access, use port forwarding and SSH tunneling.
Telegram Integration:
- Create a Telegram bot via @BotFather.
- Pair the bot with the sandboxed assistant.
Ongoing Management and Cleanup
- Use commands like
nemoclaw my-assistant connect,nemoclaw my-assistant status, etc., for ongoing management. - For uninstallation, refer to the NemoClaw documentation.
Extending Agent Access with Policy Approvals
- OpenShell restricts network access by default. Approve requests for specific endpoints using the TUI or policy presets.
Get Started with NemoClaw
Explore NemoClaw through the official website, GitHub, and documentation. Engage with the community via livestreams, tutorials, and forums.
This comprehensive guide provides a solid foundation for building secure, always-on AI agents using OpenClaw and NVIDIA NemoClaw. With these tools, you can create powerful, isolated assistants that leverage the latest AI technologies while maintaining data security and control.
