Recommended Quick Setup
Use this path when you want the shortest practical route from VPS order to a usable NemoClaw test workspace. The full checklist below expands each step.
Alpha status
NemoClaw is alpha/early-preview software, and NVIDIA currently says not to use it in production environments. Keep the VPS isolated for testing, review the current upstream docs and avoid sensitive, customer-facing or production workloads until upstream guidance changes.
VPS plan
Choose a plan with enough CPU, RAM and NVMe storage for the sandbox stack, Docker images, policy files and security-review logs, plus unlimited bandwidth, 1 free snapshot and IPv4 + IPv6.
Operating system
Use Ubuntu VPS or another supported Linux server for the selected NemoClaw runtime path.
Access method
Connect with SSH, use root or sudo access for setup and restrict exposed ports to the services you intentionally run.
Runtime workflow
Best when an operator can answer onboarding prompts and inspect the sandbox summary.
Session continuity
Use tmux, systemd, Docker Compose, queues or service supervision only where they fit the chosen NemoClaw deployment path.
Safety checkpoint
Take a snapshot before major dependency changes, protect provider keys and repository credentials, test a small workflow and scale the VPS only after measuring real CPU, RAM, storage and runtime activity.
Who This Guide Is For
This page is for users who want NemoClaw-related experiments to run inside a narrow, controlled VPS boundary instead of a local workstation.
Security-conscious teams testing agent guardrails
Use a VPS when policies, permissions, logs and runtime isolation need to be reviewed separately from daily local workstations.
Operators who need isolated policy experiments
Keep guardrail tests, command permissions, OpenShell-related requirements and rollback notes in a dedicated server environment.
Builders evaluating NemoClaw-related reference stacks
Use a disposable or tightly controlled VPS while comparing repository instructions, dependencies and early-preview limitations.
Users who want a narrow VPS boundary for autonomous-agent tooling
PakiWebHost provides the VPS infrastructure. You install, configure, secure, update and operate the software you run on it.
What You Need Before You Start
Before selecting a plan or installing NemoClaw, confirm server access, runtime path, credentials, firewall exposure and recovery steps for the test deployment.
A Linux VPS that matches the current NemoClaw and OpenShell prerequisites, with Ubuntu as a practical target plus SSH and root or sudo access ready for host preparation.
Basic terminal knowledge, Git and the package managers required by the selected NemoClaw installation path.
Docker available before onboarding, or let the NemoClaw installer prepare Docker on supported Linux. Verify Node.js, npm, nvm or fnm shell paths, Docker group membership and zstd where the selected path requires them.
Add other runtimes only when your selected provider, tools, repositories or project workflows require them.
Your own API keys, provider accounts, model access, repositories, configuration, domain or firewall rules, your own recovery backups and the included snapshot/backup before persistent or sensitive changes.
If you are still choosing infrastructure, compare the matching NemoClaw VPS hosting page before choosing a plan.
Choose the NemoClaw Runtime Path
Before running commands, decide how NemoClaw should be installed, updated, restarted and recovered on the VPS. Use current upstream documentation as the authority for exact versions, flags, provider options, security policies and alpha-status limitations.
Interactive installer
Best when an operator can answer onboarding prompts and inspect the sandbox summary.
Non-interactive installer
Best for repeatable scripts where acceptance variables are set explicitly.
Sandboxed OpenClaw session
Best when you want OpenClaw inside NemoClaw protection layers rather than directly on the host.
Model router option
Best when you are ready to tune provider cost versus accuracy after the base sandbox works.
Recommended VPS Requirements
Minimum practical starting point for a test environment
Use this to validate the workflow before committing to a persistent test deployment. NemoClaw's documented stack includes Docker, OpenShell gateway components, sandbox image builds and onboarding work, so use a higher baseline than the lighter agent pages.
- 4 CPU cores
- 8 GB RAM
- 40 GB NVMe storage
- Ubuntu VPS or another supported Linux server
- Root or sudo access for Docker preparation
- A non-root deployment user for the NemoClaw installer
Recommended PakiWebHost starting point
- 6 CPU cores
- 16 GB RAM
- 100 GB NVMe storage
- Unlimited bandwidth
- 1 free snapshot
- IPv4 + IPv6
The recommended starting point gives NemoClaw CPU headroom for Docker, OpenShell, onboarding and package work; RAM for the sandbox stack and runtime processes; NVMe storage for images, policy files, OpenShell requirements, guarded actions and security-review logs; and root or sudo access for Docker and firewall preparation.
Recommended Architecture
The VPS is the runtime layer. You connect over SSH, configure NemoClaw and control logs, state and access. Review the NemoClaw VPS hosting page before scaling beyond testing.
You / Operator
You connect over SSH and control the full workflow, configuration, security and updates.
PakiWebHost VPS
Provides the persistent server with storage, networking, root access, snapshots and backups.
NemoClaw Runtime
NemoClaw runtime layer and processes running on the VPS.
External Services
API and model providers, repositories, tools and integrations that you connect and manage.
Why NemoClaw Benefits from a VPS
NemoClaw is security-oriented, so the VPS should be treated as a controlled boundary for policies, logs, secrets, command permissions and runtime experiments.
Isolated policy boundary
Use a VPS to keep guardrail experiments, allowed-command decisions and OpenShell-related dependencies separate from personal machines.
Observable security-review logs
Keep run output, service logs, policy notes and failed authentication evidence in one server-side location.
Controlled provider and network access
Track API keys, outbound network rules, firewall policy, dashboard access, gateway access and exposed service ports before adding real workloads.
Preview-stage discipline
Begin with the smallest possible access surface. Track policies, command permissions, network access, provider keys, dashboard access, logs and rollback steps before adding real workloads.
Security Basics for NemoClaw on a VPS
- Use SSH keys where possible.
- Keep root login limited.
- Use a non-root user where practical.
- Restrict ports.
- Keep dashboard URLs, gateway tokens, local forwards and tunnels private; treat them like credentials.
- Store provider credentials, sandbox settings and policy material only in the NemoClaw/OpenShell configuration paths documented for your selected setup.
- Avoid committing real NemoClaw config, OpenShell policy files, provider keys, sandbox settings or credential reset notes.
- Review SSH access logs, Docker/OpenShell runtime logs, policy-file changes, guarded-action audit trails, provider-key usage and outbound network rules.
- Keep packages updated.
- Snapshot before major NemoClaw changes and record the rollback step.
- Monitor failed login attempts.
- Rotate exposed keys.
- Keep experiments separate from production systems.
- Document policy files, guardrail decisions, OpenShell-related requirements, allowed commands, outbound network rules, exposed ports and rollback steps before real workloads are added.
The server can contain policy files, guardrail decisions, OpenShell-related requirements, allowed commands, outbound network rules, dashboard URLs, provider credentials and security-review logs. Keep it isolated from production systems while NemoClaw remains alpha.
When This Setup Is Not Necessary
Local testing is enough
You may not need a VPS if you are only testing NemoClaw locally, working from one private machine, reviewing a small repository or experimenting without persistent SSH access.
Server management may be unnecessary
This setup is not ideal if you do not want to manage Linux updates, SSH access, firewall rules, disk usage, credentials or repository permissions yourself.
Use a VPS for persistent remote state
Use a VPS when the workspace, policy state, logs, tools and OpenShell-protected workflow should stay available in a controlled remote environment.
Ready to test NemoClaw on an always-on VPS?
Deploy a NemoClaw VPS and use this guide as your review checklist while you prepare a controlled, non-production setup.
Frequently asked questions
No. NVIDIA currently documents NemoClaw as alpha/early-preview software and says not to use it in production environments. Use a VPS for controlled testing, policy review and isolated experiments until upstream guidance changes.
Yes, if the NemoClaw release supports the Linux distribution and runtime path you choose. Use this guide together with the current official documentation.
Not for the OpenClaw-in-sandbox path using remote provider APIs. This guide focuses on the NemoClaw/OpenShell sandbox, Docker runtime, provider access, policy files, guarded actions and security-review logs; verify separate hardware and driver needs if you plan local model inference.
No. Bring your own provider accounts, credentials, API keys, model access, repositories and framework configuration.
Start with a recommended plan for a practical controlled test, then scale only after measuring CPU, RAM, storage, Docker image usage, sandbox processes, policy files, OpenShell requirements, guarded actions and security-review logs. Verify live pricing and discounts at checkout.
Yes, when the NemoClaw/OpenShell sandbox is installed and managed through the documented server-side lifecycle. The VPS keeps policy files, OpenShell requirements, guarded actions, Docker state and security-review logs separate from your local desktop session.
Yes. For the documented NemoClaw installer path, Docker must be available before onboarding starts; on supported Linux, the installer can prepare Docker or guide you through Docker access.
No. PakiWebHost provides the VPS infrastructure. You install, configure, secure, update and operate the software you run on it.