33rd of 8 in Sandboxes
NemoClaw
NVIDIA reference stack running OpenClaw and Hermes inside OpenShell sandboxes
- Stars
- 22.7k
- License
- Apache-2.0
- Last commit
- Oct 2026
Overview
CLI and installer that provision OpenShell sandboxes for OpenClaw (default), Hermes or LangChain Deep Agents Code, with guided onboarding, inference provider selection, baseline network policies with operator approval, managed integrations and persistent sandbox state. Express install targets DGX hosts and Windows WSL; a starter prompt lets Cursor, Claude Code or Codex drive setup. For personal agents with kernel-enforced isolation.
Who it is for: People running a personal agent with kernel-enforced isolation
Strengths
- Three supported agents: OpenClaw, Hermes, LangChain Deep Agents Code
- Network policy with operator approval flow and egress control from OpenShell
- Express preset install on DGX and WSL hosts
- Documented sandbox hardening: capability drops and process limits
Weaknesses
- Alpha project; maintainers review issues without guaranteed response times
- Depends on OpenShell as the runtime; details live in NVIDIA docs, not the README
- README is mostly links; no architecture or resource figures in the repo itself
- Supported platforms are limited to those on the prerequisites page
What it needs
- no GPU
- Docker
- Needs NVIDIA OpenShell, Inference provider (local or routed)
- Models: providers configured through OpenShell routed inference
Also in Sandboxes
See all 8| Rank | Project | Score |
|---|---|---|
| 1 | LightpandaHeadless browser written in Zig for AI agents and scraping | 78 out of 100 |
| 2 | ObscuraRust headless browser with CDP, native rendering and stealth mode | 71 out of 100 |
| #4 | OpenShellPolicy-enforced sandbox runtime for autonomous agents with credential brokering | 69 out of 100 |
| #5 | microsandboxLocal microVMs for untrusted code with fork, snapshot and SDKs | 61 out of 100 |
| #6 | Steel BrowserBrowser API that manages Chrome sessions for Puppeteer, Playwright and Selenium | 60 out of 100 |