Deploy a Personal AI Agent with NVIDIA

Run a sandboxed personal AI agent locally using NVIDIA's NemoClaw stack.

Introduction

30 Second Summary

AI assistants are getting powerful enough to browse the web, write code, and manage files on your behalf. Running one without guardrails on your own machine is risky, but wrapping it in a secure sandbox changes the game entirely.

In this project, you will deploy a personal AI agent using NVIDIA's NemoClaw stack. Your agent runs inside an isolated container with enforced network policies and connects to NVIDIA's free Nemotron 3 Super 120B model for inference.

What You'll Build

A secure, always-on personal AI assistant running inside NVIDIA's OpenShell sandbox, powered by the free Nemotron 3 Super 120B model.

By the end of this project, you'll have:

  • A running NemoClaw sandbox with a configured OpenClaw agent connected to NVIDIA's free inference API.
  • Both terminal and browser-based chat interfaces to interact with your agent.
  • Network policy presets controlling exactly what your agent can access on the internet.
  • Secret Mission: Connect your agent to a Telegram bot so you can message it from your phone.

Are there any prerequisites?

No prior experience with AI agents or Docker is needed. This guide walks you through installing every tool from scratch, including Docker Desktop, the NVIDIA developer account, and NemoClaw itself.

Before We Start

Before We Start...

Install Docker Desktop

NemoClaw runs your AI agent inside a Docker container. This gives the agent a secure, isolated environment where every network request and file access is controlled by policy.

In this step, you'll install the two prerequisites NemoClaw needs on macOS: Xcode Command Line Tools and Docker Desktop.

In this step, get ready to:
  • Install Xcode Command Line Tools for macOS compatibility.
  • Install and launch Docker Desktop.
  • Verify Docker is running and accessible from Terminal.
Install Xcode Command Line Tools

NemoClaw relies on system-level build tools that ship with Apple's Xcode Command Line Tools. These must be installed before Docker Desktop will work correctly on macOS.

  • Press Cmd+Space to open Spotlight Search.
  • Type Terminal and press Enter to open it.
  • Install Xcode Command Line Tools by running this command:
xcode-select --install

What does this command do?

This triggers a macOS system dialog asking if you want to install developer tools. These include compilers, Git, and other utilities that Docker Desktop and NemoClaw need under the hood.

  • A pop-up dialog will appear asking you to confirm the installation. Click Install.
  • Click Agree to accept the license agreement.
  • Wait for the installation to complete. This can take a few minutes depending on your internet connection.

Seeing 'already installed'?

If Terminal says the tools are already installed, you're all set. Move on to the next substep.

Help me troubleshoot this error

Download and install Docker Desktop

Docker Desktop provides the container runtime that NemoClaw uses to build and run its secure sandbox. You'll download the installer from Docker's website.

  • Visit the Docker Desktop download page in your browser.
  • Click Download for Mac – Apple Silicon if your Mac has an M-series chip (M1, M2, M3, M4).
  • Click Download for Mac – Intel Chip if your Mac uses an Intel processor.

Which chip do I have?

Click the Apple menu in the top-left corner of your screen, then click About This Mac. If you see "Apple M1" (or M2, M3, M4), choose Apple Silicon. If you see "Intel", choose Intel Chip.

  • Once the download finishes, double-click the Docker.dmg file to open the installer.
  • Drag the Docker icon into the Applications folder when prompted.
  • Open Docker Desktop by pressing Cmd+Space, typing Docker, and pressing Enter.
  • Docker will display the Docker Subscription Service Agreement. Accept it to continue.
  • Wait for Docker Desktop to finish starting up. You should see the Docker whale icon appear in your menu bar at the top of the screen.

What is Docker Desktop?

Docker Desktop is an application that lets you run containers on your Mac. Containers are lightweight, isolated environments that package everything an application needs to run.

NemoClaw uses Docker to build a hardened sandbox container where your AI agent lives. This keeps the agent isolated from the rest of your system.

Verify Docker is working

Before moving on, confirm that Docker's background service (the daemon) is running and accessible from your terminal.

  • Switch back to Terminal and verify Docker is running by running this command:
docker info

What does this command do?

The docker info command asks the Docker daemon for system-wide information. If Docker Desktop is running correctly, you'll see details about the server version, storage driver, and number of containers.

✔️ I see Docker system information

You should see output that includes lines like Server Version, Storage Driver, and Operating System. This confirms the Docker daemon is running and ready.

Docker is all set. Move on to the next step.

ⓧ I see 'Cannot connect to the Docker daemon'

This means Docker Desktop hasn't finished starting, or isn't running at all.

  • Check your menu bar for the Docker whale icon. If you don't see it, open Docker Desktop again by pressing Cmd+Space, typing Docker, and pressing Enter.
  • Wait 30-60 seconds for the whale icon to stop animating. The animation means Docker is still starting up.
  • Try running docker info again after the icon is steady.

Help me troubleshoot Docker connection issues

Your Mac is now ready with both Xcode Command Line Tools and Docker Desktop. Next up, you'll grab your free NVIDIA API key so your agent can connect to a powerful language model for inference.

Get Your NVIDIA API Key

Your agent needs a brain. NemoClaw routes inference requests from your sandboxed agent to a cloud model, so the agent can reason and respond without running a GPU locally.

NVIDIA offers free access to their Nemotron 3 Super 120B model through the NIM API. In this step, you'll create an NVIDIA Developer account and grab an API key that NemoClaw will use to connect your agent to the model.

In this step, get ready to:
  • Create a free NVIDIA Developer account.
  • Export your API key as an environment variable in Terminal.
  • Verify the key is accessible in your current session.
Sign in to NVIDIA and get your API key

NVIDIA's build platform is where you access free inference endpoints for AI models. You'll create an account here and generate an API key that authenticates your agent's requests.

  • Open your browser and navigate to build.nvidia.com.
  • Click Login in the top right corner.
  • Sign in with an existing NVIDIA account, or click Create Account to register for free.
  • If creating a new account, follow the prompts to verify your email, set a password, and accept the NVIDIA Developer Program terms.
  • Once signed in, click Get API Key on the main page.
  • Copy the API key that appears. Store it somewhere safe. You will only see it once.

What is this API key for?

This key authenticates your agent's inference requests to NVIDIA's cloud. When your agent needs to think, it sends a request through the NemoClaw sandbox to NVIDIA's endpoint. The key proves you have permission to use the model.

The NIM free tier allows 40 requests per minute, which is plenty for a personal assistant.

Keep your key private

Treat your API key like a password. Do not share it, commit it to Git, or paste it in public forums.

Export the key in your terminal

The NemoClaw installer reads your API key from an environment variable called NVIDIA_API_KEY. You need to set this before running the installer in the next step.

  • Switch back to your Terminal window.
  • Export your API key by running this command (replacing the placeholder with the key you just copied):
export NVIDIA_API_KEY=nvapi-your-key-here

What does this command do?

The export command creates an environment variable in your current Terminal session. Any program you run from this terminal (including the NemoClaw installer) can read this variable to authenticate with NVIDIA's API.

Verify the key is set

A quick check confirms the variable is accessible before you move on.

  • Confirm your key is set by running:
echo $NVIDIA_API_KEY
  • You should see your API key printed in the terminal output.

Seeing a blank line instead of your key?

If echo $NVIDIA_API_KEY prints nothing, the variable was not set. Re-run the export command, making sure there are no spaces around the = sign and no extra quotes around your key value.

If you opened a new Terminal tab or window since exporting, the variable only exists in the original session. Run the export command again in the new tab.

Why is my NVIDIA_API_KEY empty after I exported it?

Your API key is ready. Next up, you'll install NemoClaw and use this key to connect your agent to the Nemotron model.

Install NemoClaw and Onboard Your Agent

Your environment is ready. Docker is running, and your NVIDIA API key is exported.

Now it's time to install NemoClaw itself and run the guided onboard wizard that creates your sandboxed AI agent. The wizard handles everything: picking an inference provider, naming your sandbox, and setting network security policies.

In this step, get ready to:
  • Run the NemoClaw installer script.
  • Walk through the onboard wizard to configure inference and name your sandbox.
  • Select a network policy preset and build the sandbox image.
Run the NemoClaw installer

NemoClaw's single installer script handles everything: downloading Node.js 22.16+ if it's not already present, installing NemoClaw globally, and launching the onboard wizard.

  • Switch back to your Terminal and run the installer by entering this command:
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

What does this command do?

This downloads and executes NVIDIA's official installer script. The script checks your system, installs Node.js via nvm if needed, then automatically launches nemoclaw onboard to start the guided setup wizard.

The installer will display progress messages as it sets up your environment. Once Node.js and NemoClaw are installed, it transitions directly into the onboard wizard.

Seeing 'nemoclaw not found' after install?

If you use nvm or fnm to manage Node.js, the installer might not update your current shell's PATH. Run source ~/.zshrc or open a new Terminal window, then run nemoclaw onboard to continue setup manually.

Help me troubleshoot my NemoClaw installation on macOS

Respond to the onboard wizard

The onboard wizard walks you through three main decisions: which inference provider to use, what to name your sandbox, and which network policies to apply. At any prompt, you can press Enter to accept the default shown in brackets.

  • When the wizard asks you to choose an inference provider, type 1 and press Enter to select NVIDIA Endpoints.
  • If the wizard prompts for your API key, paste the same key you exported earlier as NVIDIA_API_KEY. The wizard may detect it automatically from your environment variable.
  • When prompted to choose a model, select Nemotron 3 Super 120B.
  • When prompted for a sandbox name, type my-assistant and press Enter.

What is OpenShell?

Behind the scenes, NemoClaw uses NVIDIA OpenShell to create a hardened container for your agent. OpenShell enforces network egress policies, confines filesystem access, and intercepts every inference call so it can route requests to your configured provider.

Your agent never sends inference requests directly to the internet. OpenShell intercepts them and routes them to the NVIDIA endpoint you just configured.

Select network policy presets and build the sandbox

Network policies control which external services your agent can reach. The wizard offers preset tiers so you don't have to configure individual endpoints manually.

  • When prompted for network policy presets, select the Balanced tier (the default). This includes common development presets like npm, PyPI, and Homebrew.
  • The wizard prints a configuration summary. Review it and press Enter (or type Y) to confirm and start the sandbox build.

Why does the build take several minutes?

NemoClaw downloads a sandbox image that's approximately 2.4 GB compressed. On first run, this typically takes 5-15 minutes depending on your internet speed and machine. Subsequent rebuilds are much faster because Docker caches image layers.

  • Wait for the sandbox build to complete. When it finishes, you should see a summary that looks like this:
──────────────────────────────────────────────────
Sandbox      my-assistant (Landlock + seccomp + netns)
Model        nvidia/nemotron-3-super-120b-a12b (NVIDIA Endpoints)
──────────────────────────────────────────────────
Run:         nemoclaw my-assistant connect
Status:      nemoclaw my-assistant status
Logs:        nemoclaw my-assistant logs --follow
──────────────────────────────────────────────────

[INFO]  === Installation complete ===

What should I see?

The summary confirms your sandbox name, the model you selected, and lists three commands for interacting with your sandbox. You'll also see a tokenized dashboard URL printed below the summary. Save this URL securely. NemoClaw prints it only once.

Save your dashboard URL

The wizard prints a dashboard URL like http://127.0.0.1:18789/#token=<auth-token>. Copy and save this entire URL somewhere safe. The #token= fragment authenticates your browser to the sandbox gateway. You'll need it in a later step.

Build seems stuck or failed?

Make sure Docker Desktop is still running. Check for the whale icon in your menu bar. If the build ran out of memory, Docker Desktop may need more RAM allocated in its settings (16 GB recommended).

If the build failed entirely, you can retry by running nemoclaw onboard again. NemoClaw cleans up incomplete sandboxes automatically.

Help me troubleshoot my NemoClaw sandbox build on macOS

Your sandboxed AI agent is built and running. Next up, you'll connect to the sandbox and have your first conversation with the agent through the terminal.

Chat with Your Agent from the Terminal

Your NemoClaw sandbox is built and running. The agent is ready to accept messages, but right now it's sitting inside an isolated container with no way for you to talk to it.

In this step, you'll connect to the sandbox's shell and start chatting with your agent. You'll use both a single-command approach and an interactive terminal UI for multi-turn conversations.

In this step, get ready to:
  • Connect to your sandbox's shell.
  • Send your first message to the agent and receive a response.
  • Open the interactive terminal UI for a multi-turn chat session.
Connect to your sandbox

The OpenClaw agent lives inside the OpenShell sandbox. To interact with it, you first need to open a shell session inside that container.

  • In your Terminal, connect to the sandbox by running this command:
nemoclaw my-assistant connect

Your terminal prompt changes to show you're now inside the sandbox environment.

What just happened?

You've entered the isolated sandbox where your agent runs. Every command you type from here operates inside the container, not on your Mac's filesystem. Network requests, file access, and inference calls are all governed by the policies you configured during onboarding.

Connection refused or sandbox not found?

Make sure Docker Desktop is still running. Check for the Docker whale icon in your menu bar.

If you see a "not found" error, verify the sandbox name matches what you entered during onboarding. You can list your sandboxes with nemoclaw list from your host terminal.

Help me troubleshoot my NemoClaw sandbox connection

Send your first message to the agent

Now that you're inside the sandbox, you can talk directly to the OpenClaw agent. The quickest way is a single command that sends one message and prints the response.

  • Send your first message to the agent by running:
openclaw agent --agent main --local -m "hello" --session-id test

You should see a text response from the agent printed in your terminal. The agent is powered by the Nemotron 3 Super 120B model you selected during onboarding.

What does this command do?

The --agent main flag selects the default agent profile. --local tells OpenClaw to use the locally configured inference route (which points to NVIDIA's cloud endpoint through the sandbox's secure routing).

The -m "hello" flag is your message. --session-id test creates a named conversation session so the agent can maintain context across multiple messages.

How does inference routing work?

Inference requests from the agent never leave the sandbox directly. OpenShell intercepts every inference call and routes it to the configured provider. Your NVIDIA API key lives on the host machine, not inside the sandbox itself.

Not getting a response?

If you see a timeout or connection error, check that your NVIDIA_API_KEY was set before you ran the NemoClaw installer. The key is baked into the sandbox config at build time.

The NVIDIA NIM free tier has a 40 requests per minute rate limit. If you've been testing rapidly, wait a moment and try again.

Help me debug why my agent isn't responding

Open the interactive terminal UI

Single commands work for quick tests, but a real conversation needs back-and-forth. OpenClaw includes a terminal UI that gives you an interactive chat session right in your terminal.

  • Launch the interactive chat interface by running:
openclaw tui

You should see a chat interface appear in your terminal. You can type messages and receive responses in real time.

  • Try asking the agent to help you with a real task. For example, ask it to write a script, explain a concept, or draft an email.
  • Have a multi-turn conversation. Ask a follow-up question based on the agent's previous response.
  • When you're done, press Ctrl+C to exit the terminal UI.

Why is this running in a sandbox?

Everything your agent does happens inside the OpenShell container. Network egress is restricted by the baseline policy. Filesystem access is confined to /sandbox and /tmp for read-write access, with system paths read-only.

This means even if you ask the agent to do something risky, it physically cannot access your Mac's files or make network requests outside the allowed policy.

Terminal UI not loading?

Make sure you're still inside the sandbox shell (your prompt should look different from your normal terminal). If you exited, reconnect with nemoclaw my-assistant connect first.

Help me get the OpenClaw terminal UI working

You've just had your first conversation with a sandboxed AI agent. Next up, you'll explore the browser-based dashboard for a richer visual interface.

Open the Browser Dashboard

You've been chatting with your agent through the terminal. Now it's time to access the browser-based dashboard that gives you a richer chat experience with formatted responses and visual controls.

NemoClaw ships with a web dashboard powered by OpenClaw's UI. It runs locally on your machine at http://127.0.0.1:18789/ and uses token-based authentication to keep your agent secure.

In this step, get ready to:
  • Retrieve the gateway authentication token for your sandbox.
  • Open the OpenClaw browser dashboard.
  • Chat with your agent through the browser interface.
Retrieve the gateway authentication token

The browser dashboard requires an authentication token to connect. This token proves you're authorized to access the agent running inside the sandbox.

  • Return to your Terminal and retrieve your gateway token by running this command:
nemoclaw my-assistant gateway-token --quiet

What does this command do?

The --quiet flag suppresses security warnings and prints only the raw token string to your terminal. You'll use this token to authenticate the browser dashboard in the next substep.

  • You should see a long string of characters printed in your terminal. This is your authentication token.
  • Copy this token. You'll paste it into your browser URL in the next substep.

Don't see a token?

The command exits with an error when the sandbox is not running. Make sure Docker Desktop is still active (whale icon in your menu bar) and your sandbox is running.

If your terminal says the sandbox is not registered, try reconnecting first with nemoclaw my-assistant connect and then retry the gateway-token command.

Help me troubleshoot the gateway-token command for my NemoClaw sandbox

Open the dashboard in your browser

The onboard wizard set up a port forward to the dashboard during setup. The default URL is http://127.0.0.1:18789/.

  • Open your web browser (Safari, Chrome, or Firefox).
  • Paste http://127.0.0.1:18789/ into the address bar and press Enter.
  • If the browser asks for authentication, append #token= followed by the token you copied in the previous substep to the end of the URL. The full URL looks like http://127.0.0.1:18789/#token=your-token-here.

Why the token in the URL?

The #token= fragment authenticates your browser to the sandbox gateway. It stays local to your machine and never gets sent over the network. Treat it like a password.

You should see the OpenClaw dashboard load with a chat interface ready for use.

Dashboard not loading?

If you see a connection refused error, the port forward may have stopped. Make sure Docker Desktop is running and your sandbox is active.

If the page loads but shows a pairing or authentication warning, double-check that you appended the full token string after #token= with no extra spaces.

Help me get the NemoClaw browser dashboard to load

Chat with your agent through the browser

The browser dashboard gives you the same agent you used in the terminal, but with a richer interface for multi-turn conversations.

  • Type a message in the chat input field. Try asking your agent to help with a real task, like drafting an email or explaining a concept.
  • Send the message and wait for the agent to respond.
  • Try a follow-up question to test multi-turn conversation. The agent remembers context within the same session.

How is the agent secured?

Every interaction you have through this dashboard runs inside the OpenShell sandbox. Network egress is restricted by the Balanced policy preset you selected during setup. Filesystem access is confined to /sandbox and /tmp for read-write access.

Inference requests from the agent never leave the sandbox directly. OpenShell intercepts every inference call and routes it to the configured NVIDIA endpoint on your behalf.

Secret mission

Connect Your Agent to Telegram

Your NemoClaw agent is accessible from your terminal and browser. But what if you could message it from your phone, anywhere? In this secret mission, you'll create a Telegram bot and wire it up to your NemoClaw sandbox so your personal AI assistant is always just a message away.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally with NVIDIA's free NIM API tier, so there are no ongoing cloud costs.

Resources you used:

  • Docker containers running the NemoClaw sandbox, OpenShell gateway, and OpenClaw agent.
  • NemoClaw configuration stored in ~/.nemoclaw/ (credentials and sandbox configs).
  • NemoClaw CLI (installed globally via npm).
  • Docker Desktop application.
  • Telegram bot (if you completed the Secret Mission).

Keep everything running

No action needed. Choose this if you're still actively using your agent or plan to keep chatting with it.

  • Your agent runs as long as Docker Desktop is running. NemoClaw is designed to be always-on.
  • The NVIDIA NIM free tier has a 40 requests per minute rate limit, but no monetary cost.
  • Your Telegram bot (if configured) will continue responding to messages while the messaging bridge is active.

Pause - I'll come back to this later

Shut down running processes to free up memory while keeping your configuration intact.

  • Click the Docker Desktop whale icon in your menu bar.
  • Select Quit Docker Desktop.
  • Your sandbox state is preserved. When you reopen Docker Desktop later, your my-assistant sandbox will be available again.
  • Your ~/.nemoclaw/ configuration remains on disk, so you won't need to re-run the onboard wizard.

Delete - I don't want to use this again

Remove all project resources and start fresh.

  • Destroy your NemoClaw sandbox by running this command in Terminal:
nemoclaw my-assistant destroy
  • Uninstall the NemoClaw CLI by running:
npm uninstall -g nemoclaw
  • Remove the NemoClaw configuration directory by running:
rm -rf ~/.nemoclaw/
  • To uninstall Docker Desktop, open Finder, go to Applications, and drag Docker to the Trash.
  • If you completed the Secret Mission and want to delete your Telegram bot, open Telegram and message @BotFather to remove the bot you created.

That's a Wrap!

That's a Wrap!

Nice work! You just deployed a secure personal AI agent on NVIDIA's open-source NemoClaw stack.

You've learned how to:

  • Deployed a sandboxed OpenClaw agent inside an OpenShell security container using a single install command.
  • Connected your agent to NVIDIA's free Nemotron 3 Super 120B model for inference through NIM API routing.
  • Chatted with your agent through both the terminal CLI and browser dashboard, with network policy presets controlling exactly what the agent can access.
  • Connected your agent to Telegram for mobile access using the NemoClaw messaging bridge.

Ready to quiz yourself?