ericksoa · Sep 3, 2026 · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -5676,6 +5676,39 @@ jobs:
       - name: Install OpenShell CLI
         run: bash scripts/install-openshell.sh
 
+      - name: Hide Docker CLI from native Podman public install
+        if: ${{ matrix.runtime_provider == 'podman' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          disabled_path="${RUNNER_TEMP}/nemoclaw-disabled-docker-cli"
+          docker_cli="$(command -v docker || true)"
+          install -d -m 0700 "${E2E_ARTIFACT_DIR}"
+          if [[ -n "${docker_cli}" ]]; then
+            case "${docker_cli}" in
+              /usr/bin/docker | /usr/local/bin/docker) ;;
+              *)
+                echo "::error::Refusing to move unexpected Docker CLI path: ${docker_cli}" >&2
+                exit 1
+                ;;
+            esac
+            if [[ -e "${disabled_path}" || -L "${disabled_path}" ]]; then
+              echo "::error::Docker CLI disable target already exists" >&2
+              exit 1
+            fi
+            printf 'NEMOCLAW_E2E_DISABLED_DOCKER_CLI=%s\n' "${disabled_path}" >>"${GITHUB_ENV}"
+            printf 'NEMOCLAW_E2E_DOCKER_CLI_RESTORE_PATH=%s\n' "${docker_cli}" >>"${GITHUB_ENV}"
+            sudo mv -- "${docker_cli}" "${disabled_path}"
+          fi
+          if command -v docker >/dev/null 2>&1; then
+            echo "::error::Native Podman public install still resolves a Docker CLI" >&2
+            exit 1
+          fi
+          jq -n \
+            --arg originalPath "${docker_cli}" \
+            '{schemaVersion: 1, dockerClientAvailable: false, originalPath: $originalPath}' \
+            >"${E2E_ARTIFACT_DIR}/docker-client-absence.json"
+
       - name: Run cloud-onboard live Vitest test
         env:
           NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
@@ -5694,6 +5727,39 @@ jobs:
           "$OPENSHELL_BIN" --version
           npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/cloud-onboard.test.ts
 
+      - name: Restore Docker CLI after native Podman public install
+        if: ${{ always() && matrix.runtime_provider == 'podman' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          disabled_path="${NEMOCLAW_E2E_DISABLED_DOCKER_CLI:-}"
+          restore_path="${NEMOCLAW_E2E_DOCKER_CLI_RESTORE_PATH:-}"
+          if [[ -z "${disabled_path}" && -z "${restore_path}" ]]; then
+            exit 0
+          fi
+          if [[ "${disabled_path}" != "${RUNNER_TEMP}/nemoclaw-disabled-docker-cli" ]]; then
+            echo "::error::Refusing unsafe Docker CLI restore source" >&2
+            exit 1
+          fi
+          case "${restore_path}" in
+            /usr/bin/docker | /usr/local/bin/docker) ;;
+            *)
+              echo "::error::Refusing unsafe Docker CLI restore destination" >&2
+              exit 1
+              ;;
+          esac
+          if [[ ! -e "${disabled_path}" && ! -L "${disabled_path}" ]]; then
+            echo "::error::Disabled Docker CLI is missing before restore" >&2
+            exit 1
+          fi
+          if [[ -e "${restore_path}" || -L "${restore_path}" ]]; then
+            echo "::error::Docker CLI restore destination is already occupied" >&2
+            exit 1
+          fi
+          sudo mv -- "${disabled_path}" "${restore_path}"
+          test -x "${restore_path}"
+          test "$(command -v docker)" = "${restore_path}"
+
       - name: Build trusted cloud-onboard timing summary
         if: always()
         shell: bash

diff --git a/ci/platform-matrix.json b/ci/platform-matrix.json
@@ -169,7 +169,7 @@
       "name": "Local vLLM (managed install/start)",
       "status": "caveated",
       "endpoint_type": "Local OpenAI-compatible",
-      "notes": "Appears by default on DGX Spark and qualifying DGX Station GB300 hosts. A labeled Deferred preview appears on hosts that match the N1x identity requirements; N1x remains Deferred until a physical NemoClaw Express E2E test passes. DGX Station is Tested with limitations across qualified profiles on one physical DGX Station GB300. Full Station Express end-to-end qualification for the accepted no-OTA DGX OS `7.6.x` profile is pending. Dual-Station configurations are not yet validated, and dedicated CI coverage is not available. For canonical Station qualification and host preparation, see the Additional Setup page for [OpenClaw](/user-guide/openclaw/get-started/additional-setup/dgx-station-preparation), [Hermes](/user-guide/hermes/get-started/additional-setup/dgx-station-preparation), or [Deep Agents](/user-guide/deepagents/get-started/additional-setup/dgx-station-preparation). Generic Linux NVIDIA GPU hosts require `NEMOCLAW_EXPERIMENTAL=1` or `NEMOCLAW_PROVIDER=install-vllm`, NVIDIA Container Toolkit, and CDI. NemoClaw pins runtime images to immutable digests. Station Express defaults to `nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4`; `--station-deepseek` selects `deepseek-ai/DeepSeek-V4-Flash`. Direct managed-vLLM defaults are `nvidia/Qwen3.6-35B-A3B-NVFP4` on DGX Spark and the Deferred N1x preview, `deepseek-ai/DeepSeek-V4-Flash` on DGX Station, and `nvidia/NVIDIA-Nemotron-3-Nano-4B-FP8` on generic Linux NVIDIA GPU hosts. Image pulls from `nvcr.io` require NGC registry login."
+      "notes": "Managed install/start requires Docker on `PATH`; attaching an already-running local vLLM server is a separate path. Appears by default on DGX Spark and qualifying DGX Station GB300 hosts. A labeled Deferred preview appears on hosts that match the N1x identity requirements; N1x remains Deferred until a physical NemoClaw Express E2E test passes. DGX Station is Tested with limitations across qualified profiles on one physical DGX Station GB300. Full Station Express end-to-end qualification for the accepted no-OTA DGX OS `7.6.x` profile is pending. Dual-Station configurations are not yet validated, and dedicated CI coverage is not available. For canonical Station qualification and host preparation, see the Additional Setup page for [OpenClaw](/user-guide/openclaw/get-started/additional-setup/dgx-station-preparation), [Hermes](/user-guide/hermes/get-started/additional-setup/dgx-station-preparation), or [Deep Agents](/user-guide/deepagents/get-started/additional-setup/dgx-station-preparation). Generic Linux NVIDIA GPU hosts require `NEMOCLAW_EXPERIMENTAL=1` or `NEMOCLAW_PROVIDER=install-vllm`, NVIDIA Container Toolkit, and CDI. NemoClaw pins runtime images to immutable digests. Station Express defaults to `nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4`; `--station-deepseek` selects `deepseek-ai/DeepSeek-V4-Flash`. Direct managed-vLLM defaults are `nvidia/Qwen3.6-35B-A3B-NVFP4` on DGX Spark and the Deferred N1x preview, `deepseek-ai/DeepSeek-V4-Flash` on DGX Station, and `nvidia/NVIDIA-Nemotron-3-Nano-4B-FP8` on generic Linux NVIDIA GPU hosts. Image pulls from `nvcr.io` require NGC registry login."
     }
   ],
 
@@ -367,7 +367,7 @@
     {
       "name": "Native rootless Podman on Linux",
       "status": "caveated",
-      "notes": "Set `NEMOCLAW_GATEWAY_RUNTIME=podman` before standard onboarding. The provider requires a qualified current-user Podman socket, rootless service, cgroups v2, bridge networking and DNS, and exact managed-image receipts. Full native E2E qualification currently runs on Linux amd64; the managed-image contract accepts `linux/amd64` and `linux/arm64` receipts. Custom `--from` Dockerfiles and read-only host mounts are not qualified. The portable experimental profile remains separate."
+      "notes": "Set `NEMOCLAW_GATEWAY_RUNTIME=podman` before standard onboarding. The provider requires a qualified current-user Podman socket, rootless service, cgroups v2, bridge networking and DNS, and exact managed-image receipts. Full native E2E qualification currently runs on Linux amd64; the managed-image contract accepts `linux/amd64` and `linux/arm64` receipts. Managed local vLLM install/start remains Docker-backed and is unavailable without Docker. Custom `--from` Dockerfiles and read-only host mounts are not qualified. The portable experimental profile remains separate."
     },
     {
       "name": "Headless Linux server",

diff --git a/docs/get-started/prerequisites.mdx b/docs/get-started/prerequisites.mdx
@@ -20,7 +20,7 @@ Before you start, verify that your machine has the software and hardware needed
 | Disk     | 20 GB free     | 40 GB free       |
 
 The sandbox image is approximately 2.4 GB compressed.
-During image push, the Docker daemon, k3s, and the OpenShell gateway run alongside the export pipeline.
+During image push, the selected container runtime, k3s, and the OpenShell gateway run alongside the export pipeline.
 The pipeline buffers decompressed layers in memory.
 On machines with less than 8 GB of RAM, this combined usage can trigger the OOM killer.
 If you cannot add memory, configure at least 8 GB of swap to work around the issue at the cost of slower performance.
@@ -33,15 +33,22 @@ If you cannot add memory, configure at least 8 GB of swap to work around the iss
 | npm        | 10 or later |
 | SHA-256 tool | `sha256sum` or `shasum`, required only when the installer must install or upgrade Node.js through nvm |
 | Python     | Python 3 at a trusted system location, with POSIX descriptor-relative filesystem support |
-| Docker     | Docker Engine, Docker Desktop, or Colima on a tested platform |
+| Container runtime | Docker Engine, Docker Desktop, or Colima on a tested platform (default), or native rootless Podman on qualified Linux |
 | Platform   | Refer to [Platforms](#platforms) below |
 
-On Linux, the installer checks Docker before it installs the NemoClaw CLI.
+Docker is the default runtime provider and the primary onboarding path.
+On Linux, the installer checks Docker before it installs the NemoClaw CLI unless you explicitly select native rootless Podman with `NEMOCLAW_GATEWAY_RUNTIME=podman`.
 The installer can install Docker, start the Docker service, and add your user to the `docker` group.
 When Docker is missing, the installer downloads Docker's official convenience script, prompts for `sudo`, and starts the service when systemd is available.
 In a non-interactive run, the installer can reactivate the group through `sg docker` and continue onboarding.
 If that path is unavailable or does not restore Docker access, the installer exits with `newgrp docker` guidance before it starts onboarding.
 
+Native rootless Podman is an explicit Linux path and does not require the Docker CLI or daemon.
+Start standard onboarding with `NEMOCLAW_GATEWAY_RUNTIME=podman $$nemoclaw onboard`.
+Before selecting it, review its qualified host requirements and limitations in [Platform Support](../reference/platform-support#deployment-paths) and the [Podman troubleshooting guide](../reference/troubleshooting#podman).
+Managed local vLLM install/start remains Docker-backed and is unavailable when Docker is absent; attaching an already-running local vLLM server remains a separate path.
+The portable experimental profile is separate and still requires a Docker-compatible `docker` command.
+
 NemoClaw uses an isolated `python3` helper for descriptor-relative migration snapshot sanitization and deletion.
 NemoClaw does not resolve this credential-bearing helper through the host `PATH`.
 It accepts a verified executable at `/usr/bin/python3`, `/usr/local/bin/python3`, `/opt/homebrew/bin/python3`, `/opt/local/bin/python3`, or beside the Node.js executable.
@@ -52,8 +59,8 @@ Native Windows is not a supported execution path; use WSL.
 If you choose the native Linux Ollama install path, the onboard wizard also requires `zstd` for Ollama archive extraction.
 The installer also requires `strings` from `binutils` to verify the OpenShell binary before it continues with OpenShell install work.
 
-<Warning title="Docker Group Access">
-NemoClaw needs Docker access.
+<Warning title="Docker Group Access (Default Docker Path)">
+The default Docker runtime path needs Docker access.
 On personal Linux development machines, adding your user to the `docker` group is the standard way to run Docker without sudo.
 Members of the `docker` group can control the daemon with root-level impact.
 Grant this access only to trusted local accounts.
@@ -99,6 +106,7 @@ The following table lists platforms with a documented installation path.
 A Tested with limitations row applies only to the configuration in its notes.
 The table comes from [`ci/platform-matrix.json`](https://github.com/NVIDIA/NemoClaw/blob/main/ci/platform-matrix.json), the single source of truth kept in sync by CI and QA.
 
+<!-- markdownlint-disable MD037 MD058 -->
 {/* platform-matrix:begin */}
 | OS | Container runtime | Status | Notes |
 |----|-------------------|--------|-------|
@@ -111,6 +119,7 @@ The table comes from [`ci/platform-matrix.json`](https://github.com/NVIDIA/NemoC
 
 For the complete platform support matrix, including all deferred platforms and CI coverage, refer to [Platform Support](../reference/platform-support).
 {/* platform-matrix:end */}
+<!-- markdownlint-enable MD037 MD058 -->
 
 ## Additional Setup
 

diff --git a/docs/get-started/quickstart-hermes.mdx b/docs/get-started/quickstart-hermes.mdx
@@ -63,7 +63,7 @@ Review the [Prerequisites](prerequisites) before you begin.
       Express install mode preserves the explicit Hermes selection in the install command.
       On supported non-N1x express platforms, enter `n` if you want to select a sandbox name, an inference provider, and a model interactively.
       On N1x, entering `n` stops installation because the Deferred managed-vLLM preview is the only admitted onboarding path.
-      Refer to [Use Docker and supported platforms](#use-docker-and-supported-platforms) for more information.
+      Refer to [Use a container runtime and supported platforms](#use-a-container-runtime-and-supported-platforms) for more information.
     </Note>
 
     The install command creates the `my-hermes` sandbox used in the commands that follow.
@@ -254,8 +254,11 @@ Use these details when your first-run path needs more control.
     Refer to [Recover and Rebuild Sandboxes](../manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) for the recovery workflow.
   </Accordion>
 
-  <Accordion title="Use Docker and supported platforms">
-    Review [Prerequisites](prerequisites) for Docker requirements and the setup-oriented platform table.
+  <Accordion title="Use a container runtime and supported platforms">
+    Review [Prerequisites](prerequisites) for container-runtime requirements and the setup-oriented platform table.
+    Docker is the default runtime provider and primary path.
+    On a qualified Linux host, you can instead select native rootless Podman explicitly with `NEMOCLAW_GATEWAY_RUNTIME=podman`; this path does not require the Docker CLI or daemon.
+    Review the native Podman requirements and limitations in [Platform Support](../reference/platform-support#deployment-paths) and [Troubleshooting](../reference/troubleshooting#podman) before onboarding.
     Before you install from Windows, follow [Prepare a Windows Machine to Install NemoClaw](additional-setup/windows-preparation).
     Before you install on DGX Station, follow [Prepare DGX Station to Install NemoClaw](additional-setup/dgx-station-preparation).
 

diff --git a/docs/get-started/quickstart-langchain-deepagents-code.mdx b/docs/get-started/quickstart-langchain-deepagents-code.mdx
@@ -59,7 +59,7 @@ If you use the coding-agent prompt in the preceding section, you can skip this p
       Express install mode preserves the explicit Deep Agents selection in the install command.
       On supported non-N1x express platforms, enter `n` if you want to select a sandbox name, an inference provider, and a model interactively.
       On N1x, entering `n` stops installation because the Deferred managed-vLLM preview is the only admitted onboarding path.
-      Refer to [Use Docker and supported platforms](#use-docker-and-supported-platforms) for more information.
+      Refer to [Use a container runtime and supported platforms](#use-a-container-runtime-and-supported-platforms) for more information.
     </Note>
 
     The install command creates the `my-deepagents` sandbox used in the commands that follow.
@@ -108,11 +108,17 @@ If you use the coding-agent prompt in the preceding section, you can skip this p
 Use these details when you need more control during setup or after the first sandbox is running.
 
 <AccordionGroup>
-  <Accordion title="Use Docker and supported platforms">
-    Review [Prerequisites](prerequisites) for Docker requirements and the setup-oriented platform table.
+  <Accordion title="Use a container runtime and supported platforms">
+    Review [Prerequisites](prerequisites) for container-runtime requirements and the setup-oriented platform table.
+    Docker is the default runtime provider and primary path.
+    On Linux, the installer can install Docker.
     If the installer prints a `newgrp docker` command, run that command before you retry the installer.
     On macOS, start Docker Desktop or Colima first.
 
+    On a qualified Linux host, you can instead select native rootless Podman explicitly with `NEMOCLAW_GATEWAY_RUNTIME=podman`.
+    This path does not require the Docker CLI or daemon.
+    Review the native Podman requirements and limitations in [Platform Support](../reference/platform-support#deployment-paths) and [Troubleshooting](../reference/troubleshooting#podman) before onboarding.
+
     Before you install from Windows, follow [Prepare a Windows Machine to Install NemoClaw](additional-setup/windows-preparation).
     Before you install on DGX Station, follow [Prepare DGX Station to Install NemoClaw](additional-setup/dgx-station-preparation).
 

diff --git a/docs/get-started/quickstart.mdx b/docs/get-started/quickstart.mdx
@@ -170,13 +170,18 @@ Use these details when your first-run path needs more control.
     Refer to [Choose Messaging Channels](../manage-sandboxes/messaging-channels/choose-messaging-channels) and [Network Policies](../network-policy/approve-network-requests) before enabling them.
   </Accordion>
 
-  <Accordion title="Use Docker and supported platforms">
-    Review [Prerequisites](prerequisites) for Docker requirements and the setup-oriented platform table.
+  <Accordion title="Use a container runtime and supported platforms">
+    Review [Prerequisites](prerequisites) for container-runtime requirements and the setup-oriented platform table.
+    Docker is the default runtime provider and primary path.
     On Linux, the installer can install Docker.
     If it prints a `newgrp docker` command, run that command before you retry the installer.
     On macOS, start Docker Desktop or Colima first.
 
-    When a coding agent reports that its execution sandbox blocked Docker, use its command-scoped approval flow, if available.
+    On a qualified Linux host, you can instead select native rootless Podman explicitly with `NEMOCLAW_GATEWAY_RUNTIME=podman`.
+    This path does not require the Docker CLI or daemon.
+    Review the native Podman requirements and limitations in [Platform Support](../reference/platform-support#deployment-paths) and [Troubleshooting](../reference/troubleshooting#podman) before onboarding.
+
+    When using the Docker path, if a coding agent reports that its execution sandbox blocked Docker, use its command-scoped approval flow, if available.
     Approve only the Docker-dependent command that the coding agent requests to rerun outside the sandbox.
     Do not change Docker socket permissions or grant broad host access only to bypass the restriction.
     If your organization blocks command-scoped approval, stop the coding-agent setup and contact the administrator who manages coding-agent permissions.