Overview
NemoClaw is NVIDIA's answer to a question that arrives the moment an autonomous agent is given a shell: where should it run? It is described by the project as "an open source reference stack for running supported AI agents more safely inside NVIDIA OpenShell sandboxes" — not an agent itself, but the boundary and the plumbing around somebody else's agent.
Three agents are supported out of the box: OpenClaw, which is the default, plus Hermes and LangChain Deep Agents Code. Around each of them NemoClaw supplies sandboxed execution inside OpenShell, managed inference so the model endpoint is configured rather than hand-wired, network policy controls over what the sandbox may reach, managed integrations, and snapshots for capturing and restoring sandbox state. Lifecycle operations run through a CLI, with per-agent aliases so the commands read naturally for whichever agent you picked.
It is an Apache-2.0 reference stack rather than a hosted product, and it is specific about where it runs: supported DGX hosts or Windows Subsystem for Linux, with Docker running, Node.js available for the credential helper, and enough disk for the agent image and model you select. Installation goes through a guided onboarding wizard that walks through choosing the agent runtime, an inference provider (local or cloud), optional messaging channels and the security policy, then creates and launches the first sandboxed agent.
What it does
- Sandboxed agent execution inside NVIDIA OpenShell
- Supports OpenClaw (default), Hermes and LangChain Deep Agents Code
- Managed inference against local or cloud providers, configured during onboarding
- Network policy controls over what the sandboxed agent can reach
- Snapshots of sandbox state, plus managed integrations
- Lifecycle operations through a CLI with per-agent aliases
- Guided onboarding wizard covering runtime, inference, channels and security policy
Getting started
NemoClaw installs through a maintained last-known-good installer that also runs the onboarding wizard. Check the prerequisites first — the stack targets supported DGX hosts or Windows Subsystem for Linux.
Check the prerequisites
You need a supported OS (Linux, macOS or Windows WSL), Docker installed and running, Node.js 22.19+ if you use the credential helper, administrator or sudo access, enough disk for the chosen agent and model, and network access to pull images and weights.
docker info
node --versionRun the installer
This starts the maintained last-known-good (`lkg`) installer and the onboarding wizard.
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bashChoose your agent runtime
The wizard asks which supported agent to sandbox. OpenClaw is the default; Hermes and LangChain Deep Agents Code are the other options.
Select agent: OpenClaw (default) / Hermes / LangChain Deep Agents CodePick inference and set policy
Still in the wizard: select a local or cloud inference provider, configure optional messaging channels, and set the security policy that the sandbox will enforce.
Inference provider → local or cloud
Channels → optional
Security policy → network + integration rulesLaunch the sandboxed agent
The wizard creates and starts the first sandbox. From there, follow the quickstart for the agent you chose in the NemoClaw documentation, and use the CLI for lifecycle operations and snapshots.
https://docs.nvidia.com/nemoclaw/latest/Commands and code are distilled from the project's own documentation — always check the official repo for the latest.
When to use it
- Reach for it when an autonomous agent needs shell and network access but must not have it on the host
- Reach for it when you want a network policy in front of an agent rather than trusting its own tool restrictions
- Reach for it when running OpenClaw, Hermes or LangChain Deep Agents Code on DGX hardware or WSL
- Reach for it when you want to snapshot a sandbox so an agent's environment can be restored or reproduced
How NVIDIA NemoClaw compares
NVIDIA NemoClaw alongside other open-source code sandboxes & isolation tools AI/TLDR tracks, ranked by GitHub stars.
| Tool | Stars | What it does |
|---|---|---|
| Daytona | ★ 71.7k | Daytona is an open-source runtime that spins up isolated sandboxes in under 90ms so agents can safely run and persist AI-generated code. |
| NVIDIA NemoClaw | ★ 22.5k | NVIDIA's reference stack for running third-party agents inside an OpenShell sandbox |
| OpenSandbox | ★ 15.4k | OpenSandbox gives AI agents a safe place to run code and commands, with one unified API across Docker and Kubernetes runtimes and SDKs in five languages. |
| E2B | ★ 13.8k | E2B is open-source infrastructure that runs AI-generated code inside secure, isolated cloud sandboxes, controlled from JavaScript or Python SDKs. |
| Astrid | ★ 10.3k | A portable Rust runtime that executes software as sandboxed WebAssembly capsules, where every file, network, process and tool call is gated by a signed, revocable, per-principal capability instead of ambient authority. |
| Cloudflare Computer | ★ 9.2k | A virtual filesystem inside a Durable Object that gives an agent one execution surface across Workers isolates and full Linux containers. |
| smolvm | ★ 6.1k | A cross-platform CLI that boots sub-second Linux microVMs from a declarative Smolfile, so untrusted or agent-generated code runs behind a hypervisor boundary. |
| micropython-wasm | ★ 174 | Runs untrusted Python inside a WASI MicroPython module via Wasmtime, with memory caps, a CPU fuel budget, a wall-clock timeout and no network access. |