OpenClaw Jetson

Secure OpenClaw + Ollama devcontainer setup for NVIDIA Jetson Orin Nano Super.

Features

• Local LLM inference via Ollama with GPU acceleration
• Clawdstrike security - policy-based access control for AI agents
• Cloudflare Tunnel - zero-trust remote access (optional)
• Hardened containers - non-root, capability-dropped, memory-limited

Quick Start

1. Clone this repo into your workspace
2. Open in VS Code
3. Click "Reopen in Container" when prompted
4. Wait for setup to complete
5. Run openclaw in terminal

Requirements

• NVIDIA Jetson Orin Nano Super (8GB)
• JetPack 6.x (L4T r36.x)
• Docker with NVIDIA runtime
• VS Code with Dev Containers extension

Architecture

┌─────────────────────────────────────────────────────┐
│                  Bridge Network                      │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  │
│  │  openclaw   │  │   ollama    │  │ cloudflared │  │
│  │  (Node.js)  │──│  (LLM GPU)  │  │  (tunnel)   │  │
│  │  Port 18789 │  │  127.0.0.1  │  │  optional   │  │
│  └─────────────┘  └─────────────┘  └─────────────┘  │
└─────────────────────────────────────────────────────┘

Security

Container Hardening

| Measure | Implementation | |---------|---------------| | Non-root user | openclaw (UID 1000) | | Network isolation | Internal bridge network | | Ollama binding | 127.0.0.1 only | | Privilege escalation | no-new-privileges:true | | Capabilities | All dropped | | Temp filesystem | tmpfs with noexec |

Clawdstrike Policy

Policy file: .devcontainer/policy.yaml

• Egress allowlist: localhost, ollama, github.com, pypi.org, npm
• Forbidden paths: ~/.ssh, ~/.aws, ~/.gnupg, .env, *.pem, *.key, /proc, /sys