NemoClaw review: NVIDIA's sandbox for OpenClaw and Hermes

NemoClaw is easy to misread from its name. It isn’t another OpenClaw clone; it’s NVIDIA’s open-source way to run an existing agent, OpenClaw by default or Hermes Agent or LangChain’s Deep Agents Code, inside a locked-down OpenShell sandbox. The agent’s features come from whichever one you pick. What NemoClaw adds is the box around it: network policy, filesystem rules, and keys kept outside. It’s Apache-2.0, had 22,984 GitHub stars when we checked on November 8, 2026, and NVIDIA calls it alpha. For the background, see What is NemoClaw?.

Who it suits

NemoClaw fits people who already want OpenClaw or Hermes but don’t trust it on their host, and teams where someone should approve what an always-on agent can reach. It also fits anyone with NVIDIA hardware who wants local inference without wiring it up by hand. If you want a lightweight install on a small VPS, the resource floor below rules that out.

What it fixes about OpenClaw security

Plain OpenClaw runs its tools on the host until you turn its sandbox on, and even then the gateway stays on the host (we cover the details in our OpenClaw review and Is OpenClaw safe?). NemoClaw puts the whole agent in the container and starts from deny. Per the network policy reference:

• Network is deny-by-default. The baseline only allows NVIDIA’s inference endpoint, ClawHub, OpenClaw’s own site and docs, and read-only npm for installing plugins. GitHub and messaging platforms aren’t in it; you add them with presets or a policy tier.
• Unknown destinations get blocked and shown to you. When the agent tries an unlisted host, OpenShell blocks it, logs it, and shows the host, port and requesting binary in a terminal UI for an operator to approve or deny. An approval lasts for the session; permanent changes go in the policy file or through openshell policy commands.
• The filesystem is mostly read-only. The agent can write to /sandbox and /tmp; system paths such as /usr, /etc and /app are read-only, and it runs as a dedicated sandbox user.
• Credentials stay outside. Inference, messaging and MCP keys are held by the OpenShell gateway, not inside the sandbox. One exception: QR-paired sessions such as WhatsApp keep their session credentials inside.

The approval prompt is the headline feature: a prompt-injected agent trying to send data somewhere new hits a wall and a human, rather than succeeding quietly. The docs are candid that some enforcement (Landlock) is best-effort, so treat it as a strong layer, not a guarantee.

Setup

The quickstart is one command:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

The installer then asks, in order: accept a third-party software notice, pick the agent, pick an inference provider and model (NVIDIA Endpoints, OpenRouter, OpenAI, Anthropic, Gemini, local Ollama and others), name the sandbox, optionally add web search and messaging channels, and choose a network policy tier (Balanced by default). The docs suggest skipping search and channels on a first run, which is good advice: get a working sandbox, then open it up.

Day to day you use the nemoclaw CLI: nemoclaw my-assistant status, nemoclaw my-assistant connect for a shell inside, and a dashboard on port 18789 that you reach over an SSH tunnel on a remote box. The docs warn to treat the dashboard URL like a password.

Hardware and Docker

NemoClaw needs a container runtime (Docker, Docker Desktop or Colima) and at least 4 vCPU, 8 GB of RAM (16 GB recommended) and 20 GB of free disk, with a 2.4 GB sandbox image. That’s heavier than running OpenClaw alone. Linux and DGX Spark are the primary tested platforms; macOS on Apple Silicon and Windows through WSL2 work with limitations. For local models it routes to Ollama, vLLM or NVIDIA NIM, which is where an NVIDIA GPU earns its keep.

Telemetry

This is the default to change first. The CLI and installer send operation telemetry to NVIDIA unless you set NEMOCLAW_DISABLE_TELEMETRY=1, and the quickstart says to export it before running the installer if you want it off from the start. Your prompts go to whichever inference provider you choose, or stay on the machine with a local model.

Maturity and upkeep

Alpha means alpha: maintainers handle issues on a best-effort basis, and WhatsApp, Microsoft Teams, Google Chat and WeChat are marked experimental (Telegram, Discord and Slack are the supported channels). You’re also tracking two projects: NemoClaw’s releases and the agent’s. What the bot can do depends on the agent version inside NemoClaw’s sandbox image, so new agent features arrive on NemoClaw’s schedule.

How it compares

• Want container isolation without NVIDIA’s stack or the resource floor? NanoClaw runs each agent in its own container and also keeps keys away from agents, and ZeroClaw sandboxes inside one small binary.
• Want to stay on plain OpenClaw or Hermes Agent? Both have their own sandbox or container backends you can turn on yourself; NemoClaw’s draw is the deny-by-default network policy and operator approvals layered on top.

See NemoClaw vs OpenClaw for the head-to-head.

Verdict

NemoClaw is the most thorough way on our list to put OpenClaw or Hermes on a leash: deny-by-default networking with live operator approval, a read-only filesystem and keys outside the box. It costs you RAM, an extra layer to update, NVIDIA telemetry until you switch it off, and alpha-quality support. For a shared or always-on agent that reads untrusted input, that’s often a fair trade.