OpenClaw on NemoClaw — IT-Admin Deployment Guide

Runbook for deploying and operating the NemoClaw runtime as the substrate for a fleet's custom agents on Dell deskside systems.

Target: a new admin reaches a working, verified agent sandbox in < 60 minutes (warm model cache) following this guide end-to-end.

Developer quick-start: Developer Deploy Guide.

Shipping agent: if the fleet wants the ready-to-use Hermes agent, see Hermes on NemoClaw (IT-Admin guide there).

Overview

The same Plane 1 endpoint is reusable across other solutions in this repository (coding assistant, Hermes agent, video search & summarization) — you do not need one vLLM instance per solution on the same workstation.

0. Prerequisites

Every target host must have:

• Ubuntu 24.04+ on Dell Pro Precision 9 towers and Dell Pro Precision with GB300; GB10 systems ship with DGX OS.
• Docker CE ≥ 24 and NVIDIA Container Toolkit — verify with docker run --rm --gpus all nvidia/cuda:12.4.0-base-ubuntu24.04 nvidia-smi.
• Hugging Face token (HF_TOKEN) with access to Nemotron 3.5 Lightning NVFP4, or weights already staged in ~/.cache/huggingface.
• ~30 GB free in the HF cache path (~60+ GB on L tier if serving larger alternative models).
• Outbound network to huggingface.co, nvidia.com, github.com from Plane 2 hosts for the initial NemoClaw installer. For air-gapped fleets, pre-seed ~/.cache/huggingface from a connected host (rsync) and run the Plane 2 install once from staged media per NVIDIA's installer docs.

# Prerequisite checks — every command must pass
cat /etc/os-release | grep VERSION_ID            # 24.04+
nvidia-smi --query-gpu=driver_version --format=csv,noheader   # >= 570
docker --version                                 # Docker 24+
docker info 2>/dev/null | grep -i nvidia         # nvidia runtime present
df -h ~/.cache/huggingface --output=avail 2>/dev/null || df -h /home --output=avail
# Expected: >= 30 GB free (S/M)
_Commands in this guide run from the repository root (`git clone` this repo and `cd` into it)._

1. Plane 1 — Serving

Path A — Multi-host fleet

Fleet rollout of the serving recipes today uses Canonical Landscape script execution (no SSH) — see Fleet Deploy via Landscape. Until then map hosts to per-tier recipes in your own automation; every recipe blocks until ready and exits non-zero on failure, so it composes safely.

Path B — Recipe script per host

For a single workstation, run the platform recipe directly:

recipes/<platform>/vllm/docker-nemotron-3.5-lightning-nvfp4.sh --port 8000
curl -sf http://localhost:8000/health && echo VLLM_OK

On T6 (L tier), run one vLLM instance per GPU behind a LiteLLM-style proxy for load balancing instead of tensor-parallelism over PCIe.

Verify Plane 1

curl -sf  http://localhost:8000/health              # 200
curl -s   http://localhost:8000/v1/models           # lists nemotron-lightning
curl -sfI http://localhost:3000/login | head -1     # Grafana (port may differ: printed by the recipe)
curl -sf  http://localhost:9090/-/healthy           # Prometheus (port may differ: printed by the recipe)

2. Plane 2 — NemoClaw runtime

Plane 2 uses NVIDIA's shipping installer; for a fleet, scripts/landscape/deploy-solution.sh runs it non-interactively (see Fleet Deploy via Landscape). Inline:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
export PATH="$HOME/.local/bin:$PATH"

# Onboard the runtime (accepts defaults for the base install)
nemoclaw onboard

# Wire inference to Plane 1 on this host
openshell provider create \
  --name vllm-local \
  --type openai \
  --credential OPENAI_API_KEY=local \
  --config base_url=http://host.docker.internal:8000/v1

openshell inference set --provider vllm-local --model nvidia/nemotron-3.5-lightning
openshell status              # Connected

3. Policy tiers

Every sandbox runs under a policy that governs filesystem, network, and subprocess boundaries. Tier semantics follow NemoClaw's own tiers; use the policies NVIDIA's installer provides and review what "standard" allows before approving it:

Apply at sandbox create time. Filesystem landlock cannot be retrofitted on a running sandbox — network policy can be applied live.

4. Validation checklist

Before handing a host to a developer or agent, confirm:

5. Monitoring

• vLLM exposes /metrics — the tokenomics Grafana started by each recipe (URL printed by the recipe) covers tokens, cost vs cloud, utilisation, TTFT / ITL, KV-cache, queue. Sustained KV-cache > 80 % → shorten context length or reduce concurrency.
• NemoClaw emits agent telemetry (task success rate, agent turns, tool-call counts).
• GPU telemetry via NVIDIA DCGM exporter (recommended add-on).

6. Lifecycle

Never commit HF tokens or credentials to the repository; use environment variables or a secrets manager. The vLLM endpoint takes no API key by default — front it with the org gateway/proxy for AD/LDAP-backed auth on multi-user tiers.

7. Scale (dev → prod)

Measured per-tier agent envelopes (wall p50, Hermes-shaped harness): Solution overview.

8. Common issues

Related

• Solution overview — sizing, benchmarks.
• Developer Deploy Guide — developer quick-start.
• docs/recipes/ — serving recipe catalog · S/M/L Sizing — tier framework.
• Hermes on NemoClaw — shipping Hermes agent on top of this runtime.
• Agentic Coding — coding assistant sharing the same serving layer.