Reference: NemoClaw on DGX Spark — install order, non-interactive installer quirks, dashboard SSH tunnel, network policy (including wttr.in / weather), TUI vs CLI, DNS and proxy notes, and where official docs live. March 2026.

1. Install on the DGX (root, non-interactive)

Optional: ssh from your Mac, then bash if you prefer a clean shell. Replace YOUR_NVIDIA_API_KEY only on the host.

export NVIDIA_API_KEY="YOUR_NVIDIA_API_KEY"
export NEMOCLAW_NON_INTERACTIVE=1
export PATH="/root/.local/bin:$(npm config get prefix 2>/dev/null)/bin:$PATH"

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
grep -q '.local/bin' ~/.bashrc || echo 'export PATH="/root/.local/bin:$PATH"' >> ~/.bashrc
export PATH="/root/.local/bin:$PATH"

rm -rf /root/NemoClaw
git clone --depth 1 https://github.com/NVIDIA/NemoClaw.git /root/NemoClaw
chmod +x /root/NemoClaw/scripts/setup-spark.sh
/root/NemoClaw/scripts/setup-spark.sh

cd /root
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -s -- --non-interactive

export PATH="/root/.local/bin:$(npm config get prefix)/bin:$PATH"
nemoclaw --version && openshell --version

Why bash -s -- --non-interactive: the installer clears NON_INTERACTIVE at the start of main(); use the flag and/or NEMOCLAW_NON_INTERACTIVE=1. Plain curl … | bash without that often drops you into interactive onboard.

If docker ps fails after Spark setup: newgrp docker or log out and SSH in again.

2. Dashboard from a Mac

On the DGX (example sandbox my-assistant):

export PATH="/root/.local/bin:$PATH"
openshell forward start -d 18789 my-assistant

On the Mac (leave open):

ssh -i ~/.ssh/id_ed25519 -N -L 18789:127.0.0.1:18789 root@192.168.1.182

Browser: http://127.0.0.1:18789/ (add #token=… if required).

3. Official documentation (NemoClaw + OpenShell)

• NemoClaw (rendered): docs.nvidia.com/nemoclaw/latest
• Source on the DGX: /root/NemoClaw/docs/ or /root/.nemoclaw/source/docs/ (same tree as GitHub NVIDIA/NemoClaw).
• OpenShell (rendered): docs.nvidia.com/openshell/latest — policy hot-reload: Sandbox policies.
• Approve blocked egress (TUI): Approve or Deny Network Requests — openshell term; approvals are session-only.
• Customise policy: Customize the Sandbox Network Policy — static (openclaw-sandbox.yaml + nemoclaw onboard) vs dynamic (openshell policy set).

4. Allow a host from the TUI (UI)

export PATH="$HOME/.local/bin:$PATH"
openshell term

Navigate to pending / blocked requests for your sandbox and approve. This updates the running policy until the sandbox stops — it does not persist into the baseline YAML on disk.

5. Allow a host from the CLI (no TUI)

Example sandbox name: my-assistant. OpenShell workflow:

openshell policy get my-assistant --full > /tmp/my-assistant-policy.yaml
# Edit file: add a network_policies block (host, ports, rules, binaries)
openshell policy set my-assistant --policy /tmp/my-assistant-policy.yaml --wait
openshell policy list my-assistant

There is no documented openshell policy approve <id> — approval in the product sense is TUI or YAML + policy set.

6. Editing openclaw-sandbox.yaml (e.g. weather / wttr.in)

Baseline file (typical path after global install):

$(npm root -g)/nemoclaw/nemoclaw-blueprint/policies/openclaw-sandbox.yaml

Add under network_policies: a weather block. Prefer access: full on ports 80 and 443 (TCP passthrough / no L7 inspection) so curl through the egress proxy works without CONNECT vs plain-GET mismatches:

  weather:
    name: weather
    endpoints:
      - host: wttr.in
        port: 443
        access: full
      - host: wttr.in
        port: 80
        access: full
    binaries:
      - { path: /usr/bin/curl }

Why not protocol: rest + rules: only? If the TUI/log shows policy: weather but reason: endpoint has L7 rules; use CONNECT, the policy matched but the proxy rejected the way the request was sent (e.g. plain GET on port 80 while L7 rules expect a CONNECT tunnel). Easiest fix: use the YAML above, or drop protocol/tls/rules for this host. Prefer curl to https://wttr.in/… and, if needed, --proxy "$HTTPS_PROXY".

Editing alone does not apply the change. On the host:

openshell policy set my-assistant \
  --policy "$(npm root -g)/nemoclaw/nemoclaw-blueprint/policies/openclaw-sandbox.yaml" \
  --wait

Or run nemoclaw onboard to reapply the static baseline (may recreate the sandbox depending on the wizard).

Do you need to restart? No DGX reboot. openshell policy set … --wait hot-reloads network policy. Gateway “Healthy” is enough.

Caution: edits under node_modules/nemoclaw/… can be overwritten on the next npm install -g nemoclaw; keep a copy or patch the tree under ~/.nemoclaw/source for durability.

7. When curl still fails: EAI_AGAIN and empty output

• getaddrinfo EAI_AGAIN wttr.in — DNS/resolver path inside the sandbox; traffic often must go through the egress proxy. Inside the sandbox check echo $HTTP_PROXY $HTTPS_PROXY. If set, try: curl -sS --proxy "$HTTPS_PROXY" "https://wttr.in/London?format=3".
• OPA deny on wttr.in + /usr/bin/curl — allow host and binary in one block. If the log says endpoint has L7 rules; use CONNECT, switch the weather block to access: full (see §6) and reapply policy.
• Other sites (Google, httpbin) — default baseline is deny-by-default; failure is often policy, not “no internet”.
• ping: command not found — normal in minimal images; use curl for checks.

8. Presets and permanent baseline

nemoclaw my-assistant policy-add
nemoclaw my-assistant policy-list

Official presets include telegram, slack, discord, npm, pypi, docker, huggingface, jira, outlook. There is no dedicated “weather” preset — add wttr.in manually as above.

Static permanence: merge into openclaw-sandbox.yaml and nemoclaw onboard. Dynamic: openshell policy set — see Nemo/OpenShell docs for session scope vs baseline.

9. Uninstall (optional)

export PATH="/root/.local/bin:$(npm config get prefix 2>/dev/null)/bin:$PATH"
( nemoclaw uninstall --yes ) 2>/dev/null || true
# … remove clones, ~/.nemoclaw, openshell binary, /tmp nemoclaw files (see full runbook)

10. Related

Alpha notice and breaking changes: see NemoClaw docs and _includes/alpha-statement.md in the repo. NVIDIA API / Endpoints validation errors: check keys at build.nvidia.com or switch provider during interactive onboard.

DGX Spark: prerequisites, step-by-step non-interactive install on the DGX, then dashboard (forward + Mac SSH tunnel). SSH login, bash, and uninstall are optional and kept in their own sections.

Prerequisites

• Docker — daemon running; after setup-spark.sh, use newgrp docker or log out and SSH in again if docker ps fails.
• Git and curl — for cloning NemoClaw and running the installers.
• Node.js / npm — you do not need to install these first; nemoclaw.sh checks or installs a supported Node runtime ([1/3] in the installer).

Optional checks (run on the DGX if you like):

docker ps

git --version

curl --version

Optional: SSH from your Mac to the DGX

Skip this if you are already logged into the DGX (console or another session).

ssh -i ~/.ssh/id_ed25519 root@YOUR_DGX_LAN_IP

Omit -i … if your default SSH key is already configured for the DGX.

Optional: use bash on the DGX

Skip this if you are already in bash. If the DGX drops you into zsh and you want a predictable shell for copy-paste:

bash

Install on the DGX (as root, non-interactive)

Run the steps below in order on the DGX. Replace YOUR_NVIDIA_API_KEY only on the machine — never put real keys in posts, screenshots, or chat.

Why bash -s -- --non-interactive: with curl … | bash, the installer clears NON_INTERACTIVE; the flag and NEMOCLAW_NON_INTERACTIVE=1 keep onboarding non-interactive.

Step 1 — NVIDIA API key

export NVIDIA_API_KEY="YOUR_NVIDIA_API_KEY"

Step 2 — Non-interactive installer / onboard

export NEMOCLAW_NON_INTERACTIVE=1

Step 3 — PATH (OpenShell + npm)

export PATH="/root/.local/bin:$(npm config get prefix 2>/dev/null)/bin:$PATH"

Step 4 — Install OpenShell

OpenShell is not installed by nemoclaw.sh.

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

Step 5 — Persist OpenShell PATH in ~/.bashrc

grep -q '.local/bin' ~/.bashrc || echo 'export PATH="/root/.local/bin:$PATH"' >> ~/.bashrc

Step 6 — OpenShell PATH for this session

export PATH="/root/.local/bin:$PATH"

Step 7 — Remove any old NemoClaw clone

rm -rf /root/NemoClaw

Step 8 — Clone NemoClaw (for the Spark script only)

git clone --depth 1 https://github.com/NVIDIA/NemoClaw.git /root/NemoClaw

Step 9 — Spark Docker fix — make the script executable

chmod +x /root/NemoClaw/scripts/setup-spark.sh

Step 10 — Run the Spark Docker fix

/root/NemoClaw/scripts/setup-spark.sh

If docker then fails with permission errors: run newgrp docker once, or log out and SSH in again.

Step 11 — Install NemoClaw from /root

Stay out of /root/NemoClaw for this step so the installer uses the release tree under ~/.nemoclaw/source.

cd /root

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -s -- --non-interactive

Step 12 — Refresh PATH after install

export PATH="/root/.local/bin:$(npm config get prefix)/bin:$PATH"

Step 13 — Confirm nemoclaw is on PATH

command -v nemoclaw

Step 14 — Versions

nemoclaw --version

openshell --version

NVIDIA Endpoints errors (e.g. 404 / timeout) during onboard usually mean API key, account, or outbound access — check build.nvidia.com, or run interactive nemoclaw onboard once and pick another provider (e.g. OpenAI).

Dashboard (after install checks)

The UI listens inside the sandbox; start a forward on the DGX, then tunnel from the Mac where the browser runs.

Step 1 — On the DGX: PATH

export PATH="/root/.local/bin:$PATH"

Step 2 — On the DGX: start the forward

openshell forward start -d 18789 my-assistant

Step 3 — On your Mac: SSH tunnel (example DGX 192.168.1.182)

Leave this terminal open.

ssh -i ~/.ssh/id_ed25519 -N -L 18789:127.0.0.1:18789 root@192.168.1.182

Step 4 — On your Mac: tunnel with your DGX address

ssh -i ~/.ssh/id_ed25519 -N -L 18789:127.0.0.1:18789 root@YOUR_DGX_LAN_IP

Step 5 — On your Mac: tunnel without -i (default SSH key)

ssh -N -L 18789:127.0.0.1:18789 root@YOUR_DGX_LAN_IP

Step 6 — Browser on the Mac

Open http://127.0.0.1:18789/. Add #token=… if your setup shows a token (from config inside the sandbox). Prefer 127.0.0.1 over localhost if origin checks are strict.

Optional: user openclaw

State under /home/openclaw. Run setup-spark.sh once as root first. Then as openclaw: same OpenShell install, cd "$HOME" before nemoclaw.sh, same bash -s -- --non-interactive, and PATH including $HOME/.local/bin and the npm prefix.

Checks (optional)

docker ps

nvidia-smi

docker run --rm --runtime=nvidia --gpus all ubuntu:22.04 nvidia-smi

Local Ollama (optional)

See spark-install.md. Use OLLAMA_HOST=0.0.0.0 only on a trusted LAN.

Remote access

Private LAN addresses work on the same network or VPN. The Mac that runs the browser must run ssh -L.

Links

• NemoClaw · Spark install · Docs
• OpenShell · API keys · Installer script

Publishing with PraisonAIWP

praisonaiwp update POST_ID --post-content "$(cat article.html)" --category "AI" --server default

Optional: uninstall (only to remove NemoClaw / this setup)

On the DGX as root. Skip entirely for a first-time install.

Uninstall step 1 — PATH

export PATH="/root/.local/bin:$(npm config get prefix 2>/dev/null)/bin:$PATH"

Uninstall step 2 — NemoClaw uninstaller

( nemoclaw uninstall --yes ) 2>/dev/null || true

Uninstall step 3 — Global npm package

npm uninstall -g nemoclaw 2>/dev/null || true

Uninstall step 4 — CLI symlinks

rm -f /usr/bin/nemoclaw /usr/local/bin/nemoclaw 2>/dev/null || true

Uninstall step 5 — Config and clone

rm -rf /root/NemoClaw /root/.nemoclaw /root/.config/openshell 2>/dev/null || true

Uninstall step 6 — Installer leftovers in /tmp

rm -f /tmp/nemoclaw.sh /tmp/nemoclaw-install.sh 2>/dev/null || true

find /tmp -maxdepth 1 -name 'nemoclaw-build-*' -exec rm -rf {} + 2>/dev/null || true

Uninstall step 7 — OpenShell binary (this install path)

rm -f /root/.local/bin/openshell 2>/dev/null || true

Optional: remove all unused Docker data

Removes all unused images/containers on the host — skip if you need other Docker workloads.

docker system prune -af

Optional: full reinstall

Run every block under Optional: uninstall, then repeat Install on the DGX and Dashboard above.