What to run OpenClaw on.
Self-hosted AI agent at the centre of the January 2026 security crisis. Its tool sandbox is off by default: the main session's tools run on the host until you configure one.
The machine
Starting fresh? Hermes Agent runs on the same machines and is the easier on-ramp; it ships a command that imports an OpenClaw setup. Migration guide.
What OpenClaw needs
- Node.js gateway; tools run on the host until you configure a sandbox backend (Docker, Podman, SSH and others).
- Sandboxing is off by default: plan for Docker or Podman from day one.
Our sizing, an estimate: 4 GB at the very least, 8 GB to be comfortable, with the model at a cloud provider. The gateway plus a Docker sandbox: 8 GB leaves room for both. The project publishes no minimum and we have not measured one.
Sources: OpenClaw README (v2026.10.4) · OpenClaw docs, checked 2026-10-18.
Every machine we cover
| Raspberry Pi 5 | Fits | Get the 8 GB configuration or more. |
| Intel NUC 13 and Geekom IT13 | With caveats | Post-2026.4 OpenClaw on a NUC 13 32 GB works fine, but Hermes Agent on the same hardware is the easier on-ramp for new deployments. Our notes |
| Mac Mini M4 / M4 Pro | Fits | Get the 16 GB configuration or more. |
| Framework Laptop 13 / 16 | Fits | Get the 8 GB configuration or more. |
| Orange Pi 5 Plus | Fits | Get the 8 GB configuration or more. |
| Mac Studio M3 Ultra | Fits | Get the 96 GB configuration or more. |
| MacBook Air M3 / M4 | Fits | Get the 8 GB configuration or more. |
| Lenovo ThinkCentre M75q (used) | Fits | Get the 8 GB configuration or more. |
| Minisforum UM790 Pro | Fits | Get the 16 GB configuration or more. |
| Khadas Edge2 Pro | Fits | Get the 8 GB configuration or more. |
| Dell OptiPlex 3070 / 5070 Micro (used) | Fits | Get the 8 GB configuration or more. |
| Geekom Mini Air 12 | Fits | Get the 16 GB configuration or more. |
Before you install: OpenClaw CVEs
- CVE-2026-102807 (CVSS 5.3): install
2026.9.4or later. - CVE-2026-102806 (CVSS 6.3): install
2026.9.5or later. - CVE-2026-100599 (CVSS 8.8): install
2026.7.1or later. - CVE-2026-100598 (CVSS 7.1): install
2026.7.1or later. - CVE-2026-100597 (CVSS 7.8): install
2026.7.1or later.
The OpenClaw blueprint: everything above, plus the setup, on one page you keep.
- The machine for your answers above, the configuration to buy and the parts that go with it.
- The install steps for OpenClaw on that machine, from the project's docs and our setup guides.
- A security checklist for OpenClaw: what is off by default and what to switch on.
- The current CVEs with the release to install, refreshed every time you open the page.
Nothing in it is secret: it is what this site publishes, assembled for your agent and your machine. One payment through Stripe, no account, no subscription. The link is emailed to you.
The shop links go through /go/ and may earn PocketClaw a commission; the price you pay does not change, and no partner pays for a place in these picks (disclosure). Raspberry Pi 5 on Amazon.