Deploy NemoClaw

NemoClaw is an open-source CLI orchestrator from NVIDIA that runs the OpenClaw AI agent inside a Docker sandbox and proxies its network access through a companion process called OpenShell. It is not a typical web app: it is configured through a guided CLI wizard (nemoclaw onboard) that picks an inference provider, collects credentials, and starts the sandboxed dashboard. This Quick Deploy App handles all the necessary infrastructure setup so you can focus on running your AI agent workloads in an isolated, secure environment.

This Quick Deploy App creates a limited user on the system called nemoclaw and configures systemd services for automatic sandbox management.

Deploying a Quick Deploy App

Akamai Quick Deploy Apps let you easily deploy software on a Compute Instance using Cloud Manager. See Get Started with Quick Deploy Apps for complete steps.

1. Log in to Cloud Manager and select the Quick Deploy Apps link from the left navigation menu. This displays the Linode Create page with the Marketplace tab pre-selected.

2. Under the Select App section, select the app you would like to deploy.

3. Complete the form by following the steps and advice within the Creating a Compute Instance guide. Depending on the Quick Deploy App you selected, there may be additional configuration options available. See the Configuration Options section below for compatible distributions, recommended plans, and any additional configuration options available for this Quick Deploy App.

4. Click the Create Linode button. Once the Compute Instance has been provisioned and has fully powered on, wait for the software installation to complete. If the instance is powered off or restarted before this time, the software installation will likely fail.

To verify that the app has been fully installed, see Get Started with Akamai Quick Deploy Apps > Verify Installation. Once installed, follow the instructions within the Getting Started After Deployment section to access the application and start using it.

Configuration Options

• Supported distributions: Ubuntu 24.04 LTS
• Recommended plan: We recommend at least a Linode 8GB or higher plan to comfortably run the OpenClaw agent and associated services.

NemoClaw Options

Limited Sudo User

You need to fill out the following fields to automatically create a limited sudo user, with a strong generated password for your new Compute Instance. This account will be assigned to the sudo group, which provides elevated permissions when running commands with the sudo prefix.

• Limited sudo user: Enter your preferred username for the limited user. No Capital Letters, Spaces, or Special Characters.

  Locating The Generated Sudo Password

  A password is generated for the limited user and stored in a .credentials file in their home directory, along with application specific passwords. This can be viewed by running: cat /home/$USERNAME/.credentials

  For best results, add an account SSH key for the Cloud Manager user that is deploying the instance, and select that user as an authorized_user in the API or by selecting that option in Cloud Manager. Their SSH pubkey will be assigned to both root and the limited user.

• Disable root access over SSH: To block the root user from logging in over SSH, select Yes. You can still switch to the root user once logged in, and you can also log in as root through Lish.

  Accessing The Instance Without SSH

  If you disable root access for your deployment and do not provide a valid Account SSH Key assigned to the authorized_user, you will need to login as the root user via the Lish console and run cat /home/$USERNAME/.credentials to view the generated password for the limited user.

Getting Started after Deployment

What Has Been Installed

After deployment, the following components are installed and ready:

• NemoClaw CLI: Ready to orchestrate and manage your AI agent sandbox
• Docker: Container runtime for isolating agent execution
• OpenShell Gateway: Network proxy for secure sandbox communication
• Onboarding Script: Triggered on your first root login to configure your setup

Performing NemoClaw Onboard

Once the deployment is complete, you need to perform the onboarding wizard to configure your inference provider and start the dashboard. The onboarding is triggered automatically when you log in as root.

1. Log into the instance.

   If you disabled root login during the setup of the NemoClaw app, you need to log into the server as the root or sudo user.

   ssh root@YOUR_INSTANCE_IP

   Replace YOUR_INSTANCE_IP with the IP address of your Linode instance.

2. Once you’ve logged in, note the MOTD (message of the day):

   *********************************************************
   Akamai Connected Cloud NemoClaw Quick Deploy App
   Dashboard Access: SSH tunnel required (see details below)
   Credentials File: /home/admin/.credentials
   Documentation: https://www.linode.com/docs/marketplace-docs/guides/nemoclaw/
   *********************************************************

3. The onboarding script will automatically run and you will be prompted to start the setup wizard for NemoClaw

   Do you want to run the nemoclaw onboard wizard? [y/n]:

4. Complete the onboarding wizard.

   If you are ready to perform the onboarding, enter y to start the nemoclaw onboard wizard. The wizard will prompt you to:

   • Select an inference provider: Choose from supported options including NVIDIA Build/Endpoints, OpenAI, Anthropic, OpenRouter, Gemini, or a self-hosted OpenAI-compatible server.
   • Supply provider credentials: Enter the API key or connection details for your chosen provider.
   Note

   Important: NemoClaw requires an external Large Language Model (LLM) to function. You must provide valid credentials for at least one of the supported inference providers during onboarding. Once setup is complete, the onboarding script automatically removes itself so it won’t prompt again on next login.

Accessing the Dashboard

The NemoClaw dashboard is not exposed on a public HTTP(S) endpoint. Instead, access it securely through SSH tunneling from your local machine.

1. On your local machine, establish an SSH tunnel:

   ssh -L 18789:127.0.0.1:18789 root@YOUR_INSTANCE_IP

   Replace YOUR_INSTANCE_IP with your Linode instance’s IP address. This forwards port 18789 on your local machine to the dashboard port on the instance.

2. While the tunnel is open, obtain the dashboard URL and token by running this command on the instance:

   sudo -i -u nemoclaw nemoclaw dashboard-url

   This outputs a URL similar to:

   Dashboard URL:
   http://127.0.0.1:18789/#token=DbsMSK8L7eyavy2FVR4A1z6YORErn8V9jjWzP4HWL0A
   Treat this URL like a password -- do not log, share, or commit it.

3. Open your browser and visit the local URL with the token to access the dashboard.

Next Steps

• Review the NemoClaw Documentation for advanced features and configurations.
• Check the NemoClaw GitHub Repository for the latest updates and community support.
• Explore inference provider documentation for optimizing your chosen AI model endpoint.

More Information

You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.

• NemoClaw
• NemoClaw Documentation