Verdict
A 32 GB mini PC gives IronClaw room for the agent, its Docker sandbox jobs and a small local model if you want one. Untrusted tools run in WebAssembly sandboxes, and the model runs at the provider you choose during onboarding (OpenAI, a local Ollama or any OpenAI-compatible server among them). Until October 2026 this page sold IronClaw as a regulated-industry product with gVisor, RBAC and a $750-a-seat licence; it is MIT or Apache-2.0 and documents none of those.
Setup notes
Pick an ironclaw-v* release and run its installer script (Linux builds exist for x86_64 and ARM64), then ironclaw onboard: choose a provider and enter its key in the hidden prompt. Onboarding sets up the encrypted credential store and the WebUI login token, then installs and starts the background service. Leave ALLOW_LOCAL_TOOLS unset unless you accept a shell tool that runs on the host.
Performance
No measurement of ours. The model runs at your provider or on a local server; the NUC itself carries the agent and any Docker sandbox jobs.
What breaks
- The largest plugin ecosystem: that is still OpenClaw's
- A confined shell: once ALLOW_LOCAL_TOOLS is on, the shell tool runs on the host
Sources
The agent's defaults and settings above were read in its own documentation on 2026-10-18.
- IronClaw README (main, b0b999d): install, onboarding, security, licence
- IronClaw docs: shell tool, off unless ALLOW_LOCAL_TOOLS=true
- IronClaw release ironclaw-v1.4.1: macOS, Linux (x86_64, ARM64) and Windows builds
Want to know more
See the IronClaw page and the Intel NUC 13 and Geekom IT13 spec sheet.