Install and configure NVIDIA NemoClaw (sandboxed OpenClaw agent platform) on Linux. Handles cloudflared tunnels, Docker cgroup fixes, OpenShell, sandbox creation, remote access via Cloudflare Tunnel, and known bug workarounds. Use whenever the user mentions installing NemoClaw, setting up OpenClaw,

NemoClaw Setup Install NVIDIA NemoClaw — a sandboxed AI agent platform built on OpenClaw with Landlock + seccomp + network namespace isolation. Runs inside Docker via k3s (OpenShell). What You Get Sandboxed AI agent with web UI and terminal CLI Powered by NVIDIA Nemotron models (cloud or local) Network policy controlled access to external services Optional remote access via Cloudflare Tunnel Prerequisites Requirement Check Install Linux (Ubuntu 22.04+) uname a — Docker docker ps sudo apt install docker.io Node.js 20+ (22 recommended) node version nvm install 22 NVIDIA GPU (optional but recommended) nvidia smi — NVIDIA API key — https://build.nvidia.com/settings/api keys Workflow Step 1: Pre flight Checks If nemoclaw is already installed, skip to Step 4. Step 2: Install NemoClaw This installs NemoClaw and OpenClaw via npm globally (to ~/.npm global/bin/ ). If the installer can't find Node.js , install it first: Step 3: Install OpenShell Installs to ~/.local/bin/openshell . Step 4: Fix Docker Permissions and cgroup Docker group — the user must be in the docker group: cgroup v2 fix — required for k3s inside Docker: This adds "default cgroupns mode": "host" to /etc/docker/daemon.json and restarts Docker. IMPORTANT : The nemoclaw setup spark command also asks for an NVIDIA API key. Have it ready (starts with nvapi ). Get one at https://build.nvidia.com/settings/api keys. Step 5: Run Onboarding The interactive wizard will: 1. Check Docker and OpenShell 2. Start the OpenShell gateway (k3s in Docker) 3. Ask for a sandbox name — use claw or any name 4. Configure the NVIDIA API key 5. Set up inference (Nemotron 3 Super 120B via cloud API) 6. Launch OpenClaw inside the sandbox 7. Apply network policy presets — select the ones you need Common port conflict : If port 8080 is in use, find and kill the process: Step 6: Verify Step 7: Set Up Web UI Access The web UI runs inside the sandbox and needs a port forward: Then open: http://127.0.0.1:18789/ Known bug (OpenClaw ≤ v2026.3.11) : "device identity required" error. Workaround — append the gateway token to the URL: Then visit: http://127.0.0.1:18789/ token=<gateway token Fix : Update to OpenClaw v2026.3.12+ (see Updating section below). Step 8: Make the Port Forward Persistent Create a health checked keepalive script: Create the systemd service: Step 9: Remote Access via Cloudflare Tunnel (Optional) If you have a Cloudflare Tunnel already running, add NemoClaw to it. Add DNS route: Update tunnel config ( /etc/cloudflared/config.yml ): Restart tunnel: Update sandbox allowed origins — SSH into the sandbox and add your domain: Protect with Cloudflare Access — add the hostname to your Access application in the Zero Trust dashboard. Access URL : https://nemoclaw.<domain / token=<gateway token Step 10: Install Custom Skills Skills are markdown files in /sandbox/.openclaw/skills/<name /SKILL.md . SSH into the sandbox to create them: Verify with: openclaw skills list Step 11: Configure the Workspace Update the workspace files so the agent knows who you are: /sandbox/.openclaw/workspace/USER.md — your profile, preferences /sandbox/.openclaw/workspace/TOOLS.md — available tools and access /sandbox/.openclaw/workspace/SOUL.md — agent personality and behaviour Updating OpenClaw The sandbox bundles OpenClaw at install time. To update: Note : Sandbox network policies block npm/PyPI inside the sandbox. Updates must be done by rebuilding. Troubleshooting Issue Cause Fix Docker is not running Docker service stopped or user not in docker group sudo systemctl start docker then newgrp docker cgroup v2 detected Docker not configured for cgroupns=host sudo nemoclaw setup spark Port 8080 in use Another service on that port fuser k 8080/tcp nemoclaw: command not found Not in PATH PATH=$HOME/.npm global/bin:$HOME/.local/bin:$PATH device identity required Bug in OpenClaw ≤ v2026.3.11 Append token=<gateway token to URL, or update to v2026.3.12+ gateway token mismatch Token changed after sandbox rebuild Get new token from sandbox config too many failed auth attempts Rate limited from old token attempts Restart gateway: ssh F /tmp/nemoclaw ssh config openshell claw 'pkill f "openclaw gateway"; sleep 2; openclaw gateway &' origin not allowed Domain not in allowedOrigins Add to gateway.controlUi.allowedOrigins in sandbox config Port 18789 not responding SSH tunnel died sudo systemctl restart nemoclaw forward (auto recovers within 13s) npm 403 Forbidden inside sandbox Network policy blocking TLS Cannot install packages inside sandbox — rebuild instead Tunnel not found on DNS route Wrong Cloudflare account/cert Check cloudflared tunnel list matches your cert Error 502 on Cloudflare Tunnel connections dropped sudo systemctl restart cloudflared Assets 404 via Cloudflare Browser not authenticated for sub requests Hard refresh (Ctrl+Shift+R) after Cloudflare Access login Architecture References [NemoClaw GitHub](https://github.com/NVIDIA/NemoClaw) [OpenShell GitHub](https://github.com/NVIDIA/OpenShell) [OpenClaw docs](https://docs.openclaw.ai) [NemoClaw quickstart](https://docs.nvidia.com/nemoclaw/latest/get started/quickstart.html) [awesome nemoclaw presets](https://github.com/VoltAgent/awesome nemoclaw) [awesome openclaw skills](https://github.com/VoltAgent/awesome openclaw skills) [device auth bug fix](https://github.com/openclaw/openclaw/issues/43909)

nemoclaw-setup