NVIDIA NemoClaw update narrows local vLLM access
NVIDIA released NemoClaw 0.0.142 on November 6 with a change that matters for people running local AI agents: newly created, managed single-host vLLM containers publish their model-serving port only to local and private Docker addresses. Existing containers keep their old bindings until they are recreated, according to the release notes.
The practical question is therefore which runtime is actually serving your agents. Updating the command-line tool, rebuilding an agent sandbox and recreating a model server are different operations. Operators need to check the relevant component rather than assuming that installing a newer release changes every running container.
What changes for managed vLLM
The merged implementation change explains that managed onboarding could previously publish its port on every host interface when the selected profile did not use bearer authentication. The new approach applies the same host-network boundary regardless of that authentication choice.
For new single-host managed containers, the published addresses are loopback, 127.0.0.1, and the private OpenShell Docker bridge gateway. Recovery also rejects an owned container without bearer authentication if its bindings are unsafe. That is a specific change to how the host exposes a model server, not evidence that every earlier installation was reachable from the internet.
Actual reachability also depends on the surrounding network. NVIDIA does not describe an exploitation incident in this release, and ByteForward has not independently tested the new behavior. The useful takeaway is to inspect existing bindings and follow the documented recovery path where necessary.
Existing containers need a separate check
NVIDIA’s vLLM setup guide distinguishes a server you already operate from a container managed by NemoClaw. A managed single-host server is a host-wide resource that another sandbox may also use. Re-running onboarding does not automatically replace a running server.
Before recreating one, operators should identify its consumers across gateway environments, verify that NemoClaw owns it and preserve the intended model profile and host port. Follow the guide’s recovery procedure rather than removing a container simply because it has a familiar name. That sequence reduces the chance of interrupting another agent or returning with the wrong model.
The guide still calls for restrictive inbound firewall rules and says not to expose the serving port to the LAN or internet. Two-DGX Spark and two-DGX Station configurations use a different networking arrangement. Their instructions should be evaluated separately, rather than treating this single-host change as a universal migration recipe.
Onboarding follows the selected inference route
Version 0.0.142 also repairs how OpenClaw Model Router attaches to a sandbox. The Model Router change uses a restricted native provider attached to the sandbox, instead of relying on the built-in OpenAI catalog profile or changing the shared inference route for that selection.
On resume, it can restore a detached provider and verifies the recorded attachment. This matters when a setup appears ready but the intended provider is no longer attached. Keeping that relationship explicit helps distinguish the selected model route from a shared route used elsewhere.
A separate GPU onboarding repair checks the selected native local endpoint before committing the runtime and registering the sandbox. The release notes retain an important exception: if curl is missing inside the sandbox, onboarding warns and skips that reachability check. A completed setup should therefore be read together with its warnings.
Check the installed version and sandbox state
The upgrade guide starts with the host CLI, then asks operators to assess existing sandboxes. Agent versions are pinned when sandbox images are built. An already-running sandbox does not automatically inherit a newer agent version just because a newer NemoClaw release is available.
The standard installer follows an administrator-promoted release tag called lkg. That tag is not necessarily the newest numbered release. Verify the version actually installed and the state of each affected runtime before concluding that a particular fix is active. Preserve the documented backups and recovery checks during an upgrade.
The limits still matter
NVIDIA’s enterprise-readiness guidance describes NemoClaw as an actively developed open-source reference stack. It is not presented as a hardened multi-tenant enterprise control plane. OpenShell supplies sandbox isolation and outbound network enforcement, the chosen agent controls its behavior, and the inference provider controls model execution and its data policies.
Those responsibilities remain separate after this update. Model selection has its own constraints, too, as ByteForward’s Nemotron local deployment coverage explains. For current NemoClaw users, the immediate priority is narrower: confirm which server the agent reaches, how that server is exposed and whether an existing container needs deliberate recreation.
