diff --git a/docs/about/ecosystem.mdx b/docs/about/ecosystem.mdx index 36c11f21534..f6d91da1d30 100644 --- a/docs/about/ecosystem.mdx +++ b/docs/about/ecosystem.mdx @@ -78,7 +78,7 @@ The following table compares the two paths. | Image hardening | The community image includes standard system tools for general-purpose use. | NemoClaw strips build toolchains (`gcc`, `g++`, `make`) and network probes (`netcat`) from the runtime image to reduce attack surface. | | Filesystem policy | The community sandbox bundles a policy for OpenClaw. | NemoClaw defines a targeted read-only and read-write layout. System paths (`/usr`, `/lib`, `/etc`) are read-only. The agent's home directory (`/sandbox`) and config directory (`/sandbox/.openclaw`) are writable by default so the agent can manage config, install skills, and write to standard paths natively. | | Inference setup | The community sandbox includes an `openclaw-start` script that runs OpenClaw's onboarding wizard inside the sandbox. You can also create providers and configure OpenShell inference routing manually from the host. | NemoClaw's onboarding wizard validates your credential from the host, lets you select a provider (NVIDIA Endpoints, OpenAI, Anthropic, Google Gemini, Ollama, and compatible endpoints), and configures OpenShell's inference routing automatically. Credentials stay on the host and are delivered through OpenShell's provider system. | -| Channel messaging | OpenShell provides the credential provider system and L7 proxy that delivers channel tokens securely (including path-based resolution for Telegram's `/bot/` URL pattern). You create providers and configure OpenClaw's channel settings manually. | NemoClaw automates channel setup during onboarding: it collects bot tokens, registers them as OpenShell providers, and bakes OpenClaw channel config with placeholder tokens that OpenShell's proxy resolves at egress. No separate bridge process runs on the host. | +| Channel messaging | OpenShell provides the credential provider system and L7 proxy that delivers channel tokens securely (including path-based resolution for Telegram's `/bot/` URL pattern). You create providers and configure OpenClaw's channel settings manually. | NemoClaw automates channel setup during onboarding: it collects bot tokens (Telegram, Discord, Slack, WeChat), registers them as OpenShell providers, and bakes OpenClaw channel config with placeholder tokens that OpenShell's proxy resolves at egress. No separate bridge process runs on the host. | | Blueprint versioning | No blueprint. The community sandbox uses whatever image version is currently published. | NemoClaw downloads the blueprint artifact, checks version compatibility, and verifies its digest before applying. Running `nemoclaw onboard` on different machines produces the same sandbox. | | State migration | Not included. | NemoClaw migrates agent state across machines with credential stripping and integrity verification. | | Process count limits | OpenShell applies seccomp and privilege dropping. You set process count limits manually with `--ulimit` or orchestrator config. | NemoClaw applies `ulimit -u 512` in the container entrypoint to cap the process count and mitigate fork-bomb attacks, on top of OpenShell's seccomp and privilege dropping. | diff --git a/docs/about/overview.mdx b/docs/about/overview.mdx index 6690562f0d2..b7cded9f1f0 100644 --- a/docs/about/overview.mdx +++ b/docs/about/overview.mdx @@ -32,7 +32,7 @@ NemoClaw provides the following product capabilities. | Guided onboarding | Validates credentials, selects providers, and creates a working sandbox in one command. | | Hardened blueprint | A security-first Dockerfile with capability drops, least-privilege network rules, and declarative policy. | | State management | Safe migration of agent state across machines with credential stripping and integrity verification. | -| Messaging channels | OpenShell-managed processes connect Telegram, Discord, Slack, and similar platforms to the sandboxed agent. NemoClaw configures channels during onboarding; OpenShell supplies the native constructs, credential flow, and runtime supervision. | +| Messaging channels | OpenShell-managed processes connect Telegram, Discord, Slack, WeChat, and similar platforms to the sandboxed agent. NemoClaw configures channels during onboarding; OpenShell supplies the native constructs, credential flow, and runtime supervision. | | Routed inference | Provider-routed model calls through the OpenShell gateway, transparent to the agent. Supports NVIDIA Endpoints, OpenAI, Anthropic, Google Gemini, compatible endpoints, local Ollama, local vLLM, and the Model Router. | | Layered protection | Network, filesystem, process, and inference controls that can be hot-reloaded or locked at creation. | diff --git a/docs/get-started/quickstart.mdx b/docs/get-started/quickstart.mdx index 87ca6faf460..b886b0d14be 100644 --- a/docs/get-started/quickstart.mdx +++ b/docs/get-started/quickstart.mdx @@ -69,7 +69,10 @@ If you export `NEMOCLAW_DISABLE_DEVICE_AUTH` after onboarding finishes, it has n ### Respond to the Onboard Wizard -After the installer launches `nemoclaw onboard`, the wizard runs preflight checks, starts or reuses the OpenShell gateway, and asks for an inference provider, sandbox name, optional web search, optional messaging channels, and network policy presets. +After the installer launches `nemoclaw onboard`, the wizard runs preflight checks and starts or reuses the OpenShell gateway. +It asks for an inference provider, prompts for an API key when one is missing, then asks for the model and sandbox name. +It shows a review summary for confirmation. +After confirmation, it prompts for web search, messaging, and network policy presets. At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit. If existing sandbox sessions are running, the installer warns before onboarding because the setup can rebuild or upgrade sandboxes after the new sandbox launches. @@ -82,9 +85,11 @@ The inference provider prompt presents a numbered list. 4) Anthropic 5) Other Anthropic-compatible endpoint 6) Google Gemini - 7) Local Ollama (localhost:11434) + 7) Local Ollama (localhost:11434) - running (suggested) 8) Model Router (experimental) Choose [1]: + +Ollama displays the running suffix only when it is detected and running. ``` Pick the option that matches where you want inference traffic to go, then expand the matching helper below for the follow-up prompts and the API key environment variable to set. @@ -108,7 +113,7 @@ Respond to the wizard as follows. 1. At the `Choose [1]:` prompt, press Enter (or type `1`) to select **NVIDIA Endpoints**. 2. At the `NVIDIA_API_KEY:` prompt, paste your key if it is not already exported. -3. At the `Choose model [1]:` prompt, pick a curated model from the list (for example, `Nemotron 3 Super 120B`, `GLM-5`, `MiniMax M2.7`, `GPT-OSS 120B`, or `DeepSeek V4 Pro`), or pick `Other...` to enter any model ID from the [NVIDIA Endpoints catalog](https://build.nvidia.com). +3. At the `Choose model [1]:` prompt, pick a model from the dynamic list (populated based on the provider) shown in the wizard, or pick `Other...` to enter any model ID from the [NVIDIA Endpoints catalog](https://build.nvidia.com). NemoClaw validates the model against the catalog API before creating the sandbox. @@ -127,8 +132,6 @@ Respond to the wizard as follows. 1. At the `Choose [1]:` prompt, type `2` to select **OpenAI**. 2. At the `OPENAI_API_KEY:` prompt, paste your key if it is not already exported. -3. At the `Choose model [1]:` prompt, pick a curated model (for example, `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.4-nano`, or `gpt-5.4-pro-2026-03-05`), or pick **Other...** to enter any OpenAI model ID. - @@ -163,8 +166,6 @@ Respond to the wizard as follows. 1. At the `Choose [1]:` prompt, type `4` to select **Anthropic**. 2. At the `ANTHROPIC_API_KEY:` prompt, paste your key if it is not already exported. -3. At the `Choose model [1]:` prompt, pick a curated model (for example, `claude-sonnet-4-6`, `claude-haiku-4-5`, or `claude-opus-4-6`), or pick **Other...** to enter any Claude model ID. - @@ -190,20 +191,19 @@ Respond to the wizard as follows. 1. At the `Choose [1]:` prompt, type `6` to select **Google Gemini**. 2. At the `GEMINI_API_KEY:` prompt, paste your key if it is not already exported. -3. At the `Choose model [5]:` prompt, pick a curated model (for example, `gemini-3.1-pro-preview`, `gemini-3.1-flash-lite-preview`, `gemini-3-flash-preview`, `gemini-2.5-pro`, `gemini-2.5-flash`, or `gemini-2.5-flash-lite`), or pick **Other...** to enter any Gemini model ID. - Routes inference to a local Ollama instance. Depending on your platform, the wizard can use an existing daemon, start an installed daemon, or offer an install action. No API key is required. On non-WSL hosts, NemoClaw generates a token and starts an authenticated proxy so containers can reach Ollama without exposing the daemon directly to your network. +When the wizard prints `proxy on :11435`, it refers to the authenticated reverse proxy described in [Use a Local Inference Server](/inference/use-local-inference). On WSL, NemoClaw can also use Ollama on the Windows host through `host.docker.internal`. Respond to the wizard as follows. 1. At the `Choose [1]:` prompt, type `7` to select **Local Ollama**. -2. At the `Choose model [1]:` prompt, pick from **Ollama models** if any are already installed. If none are installed, pick a **starter model** to pull and load now, or pick **Other...** to enter any Ollama model ID. +2. At the `Choose model [1]:` prompt, pick from Ollama models if any are already installed. If none are installed, pick a starter model to pull and load now, or pick `Other...` to enter any Ollama model ID. For setup details, including GPU recommendations and starter model choices, refer to [Use a Local Inference Server](/inference/use-local-inference). @@ -351,12 +351,18 @@ Treat the authenticated URL like a password. Connect to the sandbox and use the OpenClaw CLI. -```bash -nemoclaw my-assistant connect -# inside the sandbox: -openclaw tui +```console +$ nemoclaw my-assistant connect ``` +In the sandbox shell, send a single message and print the response. + +```console +$ openclaw agent --agent main -m "hello" +``` + +NemoClaw rejects the `--local` flag inside sandboxes because it bypasses gateway protections. + ## Next Steps Navigate to the following topics to learn more about NemoClaw. diff --git a/docs/inference/set-up-sub-agent.mdx b/docs/inference/set-up-sub-agent.mdx index 231988663da..a3863a97f07 100644 --- a/docs/inference/set-up-sub-agent.mdx +++ b/docs/inference/set-up-sub-agent.mdx @@ -55,8 +55,9 @@ Fetch the current OpenClaw config from the sandbox, patch it with your auxiliary ```console $ export SANDBOX=my-assistant -$ export DOCKER_CTR=openshell-cluster-nemoclaw -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json +$ export DOCKER_CTR=$(docker ps --filter "name=openshell-$SANDBOX" --format "{{.Names}}" | head -n 1) +$ if [ -z "$DOCKER_CTR" ]; then echo "Error: No container found for sandbox $SANDBOX" >&2; exit 1; fi +$ docker exec "$DOCKER_CTR" cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json ``` Create `/tmp/openclaw.updated.json` with the OpenClaw sub-agent config. @@ -66,12 +67,17 @@ Upload the patched config and refresh the hash. In the default mutable state, this keeps the local hash consistent but does not make it tamper-proof; lock the config root-owned and read-only afterward if the sandbox should enforce config integrity at startup. ```console -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/openclaw.json -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/.config-hash -$ cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" kubectl exec -i -n openshell "$SANDBOX" -c agent -- sh -c 'cat > /sandbox/.openclaw/openclaw.json' -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash" -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/openclaw.json -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/.config-hash +$ docker exec "$DOCKER_CTR" chmod 644 /sandbox/.openclaw/openclaw.json +$ docker exec "$DOCKER_CTR" chmod 644 /sandbox/.openclaw/.config-hash +$ cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" sh -c 'cat > /sandbox/.openclaw/openclaw.json' +$ docker exec "$DOCKER_CTR" /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash" +# Optional: Lock the config to be root-owned and read-only to enforce integrity at startup +$ docker exec --user root "$DOCKER_CTR" chown root:root /sandbox/.openclaw/openclaw.json +$ docker exec --user root "$DOCKER_CTR" chmod 444 /sandbox/.openclaw/openclaw.json +$ docker exec --user root "$DOCKER_CTR" chown root:root /sandbox/.openclaw/.config-hash +$ docker exec --user root "$DOCKER_CTR" chmod 444 /sandbox/.openclaw/.config-hash +# Rollback: If you need to edit the config again, restore write permissions +# $ docker exec --user root "$DOCKER_CTR" sh -c 'chown sandbox:sandbox /sandbox/.openclaw/openclaw.json /sandbox/.openclaw/.config-hash && chmod 644 /sandbox/.openclaw/openclaw.json /sandbox/.openclaw/.config-hash' ``` Check `/tmp/gateway.log` after upload and confirm the gateway hot-reloaded the provider or `agents.list` change. @@ -89,7 +95,7 @@ Use the same provider ID that appears in `models.providers`, such as `nvidia-omn After uploading the auth profile, make sure the sub-agent directory is owned by the sandbox user: ```console -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator +$ docker exec "$DOCKER_CTR" chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator ``` ## Allow Auxiliary Provider Egress diff --git a/docs/monitoring/monitor-sandbox-activity.mdx b/docs/monitoring/monitor-sandbox-activity.mdx index 60abca9fe9f..72398c8314a 100644 --- a/docs/monitoring/monitor-sandbox-activity.mdx +++ b/docs/monitoring/monitor-sandbox-activity.mdx @@ -33,26 +33,28 @@ Key fields in the output include the following: - Sandbox details, which show the configured model, provider, GPU mode, and applied policy presets. - Gateway and process health, which show whether NemoClaw can still reach the OpenShell gateway and whether the in-sandbox agent process is running. -- Inference health for local Ollama and local vLLM, which shows `healthy` or `unreachable` together with the probed local URL. +- Inference health for local Ollama and local vLLM, which shows `healthy`, `unreachable`, or `not probed` (when the endpoint URL is unknown for compatible-* providers) together with the probed local URL. - NIM status, which shows whether a NIM container is running and healthy when that path is in use. Run `nemoclaw status` on the host to check sandbox state. Use `openshell sandbox list` for the underlying sandbox details. -## View Blueprint and Sandbox Logs +## Run Diagnostics -Stream the most recent log output from the blueprint runner and sandbox: +Run the `doctor` command to perform a grouped health check across the host, gateway, sandbox, inference, messaging, and local services: ```console -$ nemoclaw logs +$ nemoclaw doctor [--json] ``` -To follow the log output in real time: +Stream the most recent log output from the blueprint runner and sandbox: ```console -$ nemoclaw logs --follow +$ nemoclaw logs [--follow] [--tail |-n ] [--since ] ``` +The command reads both OpenClaw gateway output and OpenShell audit events, so policy denials appear alongside the gateway log stream. + ## Monitor Network Activity in the TUI Open the OpenShell terminal UI for a live view of sandbox network activity and egress requests: diff --git a/docs/reference/architecture.mdx b/docs/reference/architecture.mdx index 0bde7c8a6c7..4a4923ed83f 100644 --- a/docs/reference/architecture.mdx +++ b/docs/reference/architecture.mdx @@ -77,8 +77,7 @@ graph LR The logical diagram above shows how components relate. This section shows what actually runs where on the host. NemoClaw uses a Docker daemon. -The OpenShell gateway runs as a container that embeds a k3s cluster. -The sandbox runs as a Kubernetes pod inside that embedded cluster. +For the default Docker driver, the OpenShell gateway runs as a host process and the sandbox runs as a Docker container. ```mermaid graph TB @@ -86,7 +85,6 @@ graph TB classDef cli fill:#76b900,stroke:#5a8f00,color:#fff,stroke-width:2px,font-weight:bold classDef docker fill:#2496ed,stroke:#1577c2,color:#fff,stroke-width:2px,font-weight:bold classDef gateway fill:#1a1a1a,stroke:#1a1a1a,color:#fff,stroke-width:2px,font-weight:bold - classDef k3s fill:#ffc61c,stroke:#c89a00,color:#1a1a1a,stroke-width:2px,font-weight:bold classDef pod fill:#444,stroke:#76b900,color:#fff,stroke-width:2px classDef external fill:#f5f5f5,stroke:#e0e0e0,color:#1a1a1a,stroke-width:1px @@ -96,34 +94,23 @@ graph TB subgraph DOCKER["Docker daemon"] direction TB - - subgraph GWCON["OpenShell gateway container"] - direction TB - PROXY["OpenShell L7 proxy
rewrites Authorization headers
and URL-path segments at egress
(credential injection)"]:::gateway - - subgraph K3S["Embedded k3s cluster"] - direction TB - - subgraph POD["Sandbox pod 馃敀
Landlock + seccomp + netns"] - direction TB - AGENT["OpenClaw agent
+ NemoClaw plugin"]:::pod - end - end - end + SANDBOX["Sandbox container
Landlock + seccomp + netns"]:::pod + AGENT["OpenClaw agent
+ NemoClaw plugin"]:::pod end + + GW["OpenShell gateway
L7 proxy 路 credential store
policy engine 路 device auth"]:::gateway end INFER["Inference provider
NVIDIA Endpoints 路 OpenAI
Anthropic 路 Ollama 路 vLLM 路 Model Router"]:::external - CLI -->|"openshell CLI
(orchestrates)"| GWCON - AGENT -->|"inference requests
placeholder credentials"| PROXY - PROXY -->|"egress with real credentials
injected at the L7 proxy"| INFER + CLI -->|"openshell CLI
(orchestrates)"| GW + AGENT -->|"inference requests
placeholder credentials"| GW + GW -->|"egress with real credentials
injected at the L7 proxy"| INFER class HOST host class DOCKER docker - class GWCON gateway - class K3S k3s - class POD pod + class GW gateway + class SANDBOX pod ``` Layering from top to bottom: @@ -131,11 +118,10 @@ Layering from top to bottom: | Layer | Runs as | Role | |---|---|---| | Host CLI | Host process (`nemoclaw` on Node.js) | Orchestrates OpenShell via `openshell` CLI calls. | -| Docker daemon | Host service | Runs the OpenShell gateway container. | -| Gateway container | Docker container | Hosts the credential store, the L7 proxy, and the embedded k3s control plane. | -| k3s | Process tree inside the gateway container | Kubernetes control plane that schedules the sandbox pod. | -| Sandbox pod | Pod in the embedded k3s cluster | Runs the OpenClaw agent and the NemoClaw plugin under Landlock + seccomp + netns. | -| OpenShell L7 proxy | Process in the gateway container | Intercepts agent egress and rewrites `Authorization` headers (Bearer/Bot) and URL-path segments to inject the real credential at the network boundary. | +| Docker daemon | Host service | Runs the sandbox container. | +| Gateway | Host process | Hosts the credential store, the L7 proxy, and the policy engine. | +| Sandbox container | Docker container | Runs the OpenClaw agent and the NemoClaw plugin under Landlock + seccomp + netns. | +| OpenShell L7 proxy | Process in the gateway | Intercepts agent egress and rewrites `Authorization` headers (Bearer/Bot) and URL-path segments to inject the real credential at the network boundary. | NemoClaw never gives the sandbox a raw provider key. At onboard time it registers credentials with OpenShell's provider/placeholder system, and the L7 proxy substitutes the real value into outbound requests at egress. @@ -146,7 +132,7 @@ For the DGX Spark-specific variant of this topology (cgroup v2, aarch64, unified ## NemoClaw Plugin The plugin is a thin TypeScript package that registers an inference provider and the `/nemoclaw` slash command. -It runs in-process with the OpenClaw gateway inside the sandbox. +It runs in-process with the OpenClaw agent inside the sandbox. It also registers runtime hooks that keep the agent aware of its environment. Before an agent turn starts, the plugin prepends a short context block with the active sandbox name, sandbox phase, network policy summary, and filesystem policy summary. When the policy or phase changes during a session, the plugin sends a smaller update block instead of repeating the full context. diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx index 373b831e8d6..58b929bd95a 100644 --- a/docs/reference/commands.mdx +++ b/docs/reference/commands.mdx @@ -143,7 +143,7 @@ $ BRAVE_API_KEY=... \ `BRAVE_API_KEY` enables Brave Search in non-interactive mode and also enables `web_fetch`. If Brave Search key validation fails in non-interactive mode, onboarding prints a warning, skips web search setup, and continues with the rest of the sandbox setup. -After fixing the key, re-enable web search with `nemoclaw config web-search`. +After fixing the key, re-enable web search by running `nemoclaw policy-add brave`. The wizard prompts for a sandbox name. Names must be 1 to 63 characters, lowercase, start with a letter, contain only letters, numbers, and internal hyphens, and end with a letter or number. @@ -475,10 +475,11 @@ Treat the gateway token like a password. Do not log it, share it, or commit it to version control. +For runtime mutability controls and policy lock behavior, see +[Runtime Controls](../manage-sandboxes/runtime-controls.mdx). + ### `nemoclaw destroy` -Stop the NIM container, remove the host-side Docker image built during onboard, and delete the sandbox. -This removes the sandbox from the registry. For Ollama-backed sandboxes, `destroy` also asks Ollama to unload currently loaded models and clears stale auth proxy state on a best-effort basis. @@ -655,7 +656,7 @@ When `NEMOCLAW_NON_INTERACTIVE=1` is set, any missing token fails fast and no re Clear the stored credentials for a messaging channel and rebuild the sandbox so the image drops the channel. Running `remove` for a channel that was never configured is a no-op against the credentials file and still triggers the rebuild prompt. When the bridge provider is attached to a live sandbox, NemoClaw detaches it before deleting the provider from the OpenShell gateway. -If the matching built-in policy preset is applied, such as `telegram`, `discord`, `slack`, or `whatsapp`, NemoClaw also removes that preset so the upstream API is no longer allow-listed after the channel is gone. +NemoClaw also removes matching built-in policy presets, such as `telegram`, `discord`, `slack`, or `whatsapp`, so the upstream API no longer appears in the allow-list after the channel is removed. ```console $ nemoclaw my-assistant channels remove telegram diff --git a/docs/reference/troubleshooting.mdx b/docs/reference/troubleshooting.mdx index 8fcd081e676..a407d67ddde 100644 --- a/docs/reference/troubleshooting.mdx +++ b/docs/reference/troubleshooting.mdx @@ -9,7 +9,7 @@ keywords: ["nemoclaw troubleshooting", "nemoclaw debug sandbox issues"] content: type: "reference" --- -{/* markdownlint-disable MD014 */} + # Troubleshooting @@ -591,7 +591,7 @@ If sandbox creation reports a TLS or certificate mismatch, the OpenShell gateway Refresh the gateway trust and then resume onboarding: ```console -$ openshell gateway trust -g nemoclaw +$ openshell gateway login nemoclaw $ nemoclaw onboard --resume ``` @@ -1068,6 +1068,7 @@ $ nemoclaw logs Use `--follow` to stream logs in real time while debugging. + ## DGX Spark For an end-to-end Ollama walkthrough on DGX Spark, refer to the [NVIDIA Spark playbook](https://build.nvidia.com/spark/nemoclaw). @@ -1080,11 +1081,11 @@ Run `fix-coredns.sh` to point CoreDNS at the container gateway IP instead, then ### `k3s` cannot find a freshly built image After building a new sandbox image, `k3s` inside the gateway container sometimes fails to pull it even though the image exists on the host. -Destroy and restart the gateway, then re-run setup. +Remove the gateway with `openshell gateway remove nemoclaw`, then re-run onboarding with `nemoclaw onboard`. ```console -$ openshell gateway destroy -$ openshell gateway start +$ openshell gateway remove nemoclaw +$ nemoclaw onboard ``` ### GPU passthrough on Spark @@ -1160,6 +1161,7 @@ NVIDIA AI Workbench's Traefik proxy binds ports 3000 and 10000. If you run other services on Spark that expect port 3000, bind them to a different port. + ## Windows Subsystem for Linux For environment setup steps, see [Windows Prerequisites](/get-started/windows-preparation). diff --git a/package-lock.json b/package-lock.json index 62d8154c30d..7d95e64de5d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1915,6 +1915,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -1932,6 +1935,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -1949,6 +1955,9 @@ "riscv64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -1966,6 +1975,9 @@ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -1983,6 +1995,9 @@ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [