Prerequisites

Step 1 - Create a Droplet from the Marketplace

Step 2 - SSH into the Droplet

Step 3 - Walk Through the Onboard Wizard

Sandbox Name

NVIDIA API Key

Policy Presets

Step 4 - Connect to NemoClaw

Reconnecting After a New SSH Session

What's Next This article was originally written by Amit Jotwani (Staff Developer Advocate at DigitalOcean) At GTC 2026, NVIDIA announced NemoClaw, an open-source stack that makes it easy to run OpenClaw autonomous agents securely. OpenClaw is an open-source agent platform that Jensen Huang called “the operating system for personal AI.” We covered how to run OpenClaw on a Droplet in an earlier tutorial. NemoClaw takes a different approach — it wraps OpenClaw with sandboxing, security policies, and inference routing through NVIDIA’s cloud. NemoClaw is still in alpha, so expect rough edges. Interfaces may change, features might be incomplete, and things could break. But if you’re curious to try it out or just want to see what NVIDIA’s vision for agents looks like, this tutorial will get you up and running on a DigitalOcean Droplet in under 10 minutes. Before you begin, you’ll need: A DigitalOcean account (sign up here if you don’t have one)

An NVIDIA account to generate an API key at build.nvidia.com Head to the NemoClaw 1-Click Droplet on the DigitalOcean Marketplace. Click Create NemoClaw Droplet. When configuring the Droplet, select the CPU-Optimized plan with Premium Intel. You’ll want the option with 32 GB of RAM and 16 CPUs. NemoClaw runs Docker containers, a Kubernetes cluster (k3s), and the OpenShell gateway, so it needs the headroom. Pick a data center region near you, add your SSH key, and hit Create Droplet. Heads up: This Droplet costs $336/mo, so make sure to destroy it when you’re done experimenting. It adds up fast if you forget about it. Once your Droplet is ready, SSH in: You’ll see the usual Ubuntu login banner, and then the NemoClaw onboarding wizard will kick off automatically. It runs through a series of preflight checks, making sure Docker is running, installing the OpenShell CLI, and spinning up the gateway. You’ll see checkmarks fly by as each step completes. The onboarding wizard will ask you a few things. Here’s what to do at each prompt: The first prompt asks for a sandbox name. Just press Enter to accept the default (my-assistant). The wizard will then create the sandbox, build the container image, and push it to the gateway. This takes a couple of minutes, and you’ll see it run through about 20 steps as it builds and uploads everything. Once the sandbox is ready, the wizard asks for your NVIDIA API key. In this setup, inference is routed through NVIDIA’s cloud using the nvidia/nemotron-3-super-120b-a12b model, so it needs a key to authenticate. To get your key, head to build.nvidia.com/settings/api-keys, sign in, and click Generate API Key. Give it a name, pick an expiration, and hit Generate Key. Copy the key (it starts with nvapi-), paste it into the terminal prompt, and press Enter. The wizard saves the key to ~/.nemoclaw/credentials.json and sets up the inference provider. You’ll see it confirm the model and create an inference route. After the inference setup, NemoClaw sets up OpenClaw inside the sandbox and then asks about policy presets. You’ll see a list of available presets including Discord, Docker Hub, Hugging Face, Jira, npm, PyPI, Slack, and more. These control what external services the agent is allowed to reach. At the bottom, the wizard asks: Type n and press Enter. These presets grant the sandbox network access to package registries, which you don’t need for a basic setup. You can always add them later if your agent needs to install packages. Once onboarding finishes, you’ll see a clean summary with your sandbox details and the commands you’ll need going forward: Now for the fun part. Connect to your sandbox. This drops you into a shell inside the sandboxed environment. From here, launch the OpenClaw TUI (terminal user interface): That’s it. You should see the OpenClaw chat interface come up. The agent will greet you and introduce itself, ready to chat. Type a message and hit Enter. You’re now talking to an AI agent running inside a secure, sandboxed environment on your own Droplet. If you close your terminal and SSH back into the Droplet later, you’ll find that nemoclaw and related commands aren’t available. That’s because the onboarding script installed everything through nvm in a separate shell, and that doesn’t carry over to new sessions. Run this once to fix it permanently. It adds nvm to your .bashrc so it loads automatically on every login: Then reconnect to your sandbox and launch the TUI the same way as before: Everything picks up right where you left off. Your sandbox and agent are still running. By default, the sandbox has limited network access, so the agent can’t reach external services out of the box. To unlock more capabilities - like connecting to Slack, GitHub, or pulling packages from PyPI - you’ll want to configure policy presets. Check the NemoClaw documentation for the full list of available integrations and how to set them up. NemoClaw is still very early, so expect things to be rough around the edges. But if you want to get a feel for where always-on agents are headed, this is a good way to start poking around. Templates let you quickly answer FAQs or store snippets for re-use. Hide child comments as well For further actions, you may consider blocking this person and/or reporting abuse