> ## Documentation Index
> Fetch the complete documentation index at: https://noradocs.solomontsao.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Runtimes

# Agent runtimes and sandbox types

> Understand the runtimes Nora supports, including OpenClaw, and how to choose between the GA standard sandbox and the experimental NemoClaw secure sandbox.

When you deploy an agent in Nora, you choose both a runtime and a sandbox type. The runtime is the agent framework that runs inside the container — OpenClaw is the primary supported runtime today. The sandbox type controls how that container is provisioned and what security policies are applied to it. Understanding the difference helps you pick the right deployment option for your workload.

## What is a runtime?

A runtime is the agent framework Nora deploys and manages on your behalf. Nora acts as a control plane: it provisions the container, manages the lifecycle, syncs your provider keys, and gives you access to chat, logs, terminal, and monitoring — regardless of which runtime is running inside.

<Note>
  OpenClaw is the most mature and best-supported runtime in Nora today. Nora is designed to support
  additional runtimes over time, but OpenClaw is the recommended path for first deployments.
</Note>

## OpenClaw

OpenClaw is an open-source agent runtime and the default deployment target in Nora. When you deploy an agent without specifying a sandbox, Nora provisions an OpenClaw instance inside a standard container and exposes it through the gateway.

<CardGroup cols={2}>
  <Card title="Chat" icon="message-circle">
    Use OpenClaw's chat workflow directly from the Nora dashboard with streaming responses.
  </Card>

  <Card title="Terminal" icon="terminal">
    Open an interactive shell into the running OpenClaw container from the agent detail page.
  </Card>

  <Card title="Logs" icon="file-text">
    Inspect runtime output and activity logs without leaving the dashboard.
  </Card>

  <Card title="Gateway" icon="globe">
    Access the full OpenClaw control UI through the published gateway URL.
  </Card>
</CardGroup>

<img src="https://mintcdn.com/sttechnologyllc/hES1KHpUWDvLb_Wr/images/operator/openclaw-ui-tab.png?fit=max&auto=format&n=hES1KHpUWDvLb_Wr&q=85&s=84864989ae156ec38af4049d00f4bf2b" alt="OpenClaw gateway embedded in the agent detail page" width="1256" height="1000" data-path="images/operator/openclaw-ui-tab.png" />

Hermes agents expose an analogous embedded surface — the Hermes WebUI tab — when a Hermes runtime is selected at deploy time.

<img src="https://mintcdn.com/sttechnologyllc/hES1KHpUWDvLb_Wr/images/operator/hermes-webui-tab.png?fit=max&auto=format&n=hES1KHpUWDvLb_Wr&q=85&s=1bac228bc82bf8188eb71bae5a77aae6" alt="Hermes WebUI tab — embedded Hermes operator dashboard" width="1256" height="1000" data-path="images/operator/hermes-webui-tab.png" />

## Sandbox types

The sandbox type determines how OpenClaw's container is provisioned. You choose the sandbox type at deploy time; it cannot be changed without redeploying the agent.

### Standard sandbox

The standard sandbox (`standard`) runs OpenClaw inside a Docker container with the resource limits you specify. This is the default option and the right choice for most workloads.

* No additional configuration required
* Supports all agent lifecycle actions (start, stop, restart, redeploy)
* Available in all Nora deployments

### NemoClaw sandbox

The NemoClaw sandbox (`nemoclaw`) is experimental. It runs OpenClaw inside a policy-controlled OpenShell sandbox and routes model inference to configured [NVIDIA Nemotron](https://build.nvidia.com) APIs. Nora does not allocate a local GPU device to the container.

Use NemoClaw when you need:

* Stronger runtime isolation for sensitive workloads
* Policy-controlled execution environments
* NVIDIA Nemotron model access through configured API credentials

<Warning>
  NemoClaw must be enabled by your Nora operator before it is available as a sandbox option. If you
  select NemoClaw and it has not been enabled, deployment will fail with an error. Contact your
  operator to enable it.
</Warning>

## Choosing a sandbox

|                   | Standard              | NemoClaw                                                        |
| ----------------- | --------------------- | --------------------------------------------------------------- |
| **Availability**  | GA / always available | Experimental; requires `nemoclaw` in `ENABLED_SANDBOX_PROFILES` |
| **Isolation**     | Container-level       | Container + policy controls                                     |
| **NVIDIA models** | Via LLM provider keys | Integrated at sandbox level                                     |
| **Best for**      | Most workloads        | Security-sensitive or NVIDIA-accelerated workloads              |

<Tip>
  If you are evaluating Nora for the first time, start with the standard sandbox. It requires no
  additional configuration and gives you the full OpenClaw experience through the Nora dashboard.
</Tip>

## Related concepts

<CardGroup cols={2}>
  <Card title="Agents" icon="cpu" href="/concepts/agents">
    Understand agent lifecycle, statuses, and resources.
  </Card>

  <Card title="LLM providers" icon="key" href="/concepts/llm-providers">
    Configure provider keys and sync them to your agents.
  </Card>
</CardGroup>