Guides.

73 guides on self-hosted AI, hardware repurposing, edge computing, and the post-OpenClaw landscape.

agents

AI Agents

OpenClaw, Hermes, Nanobot — comparisons, audits, migrations

16 guides

OpenClaw security crisis 2026: what you need to know

OpenClaw shipped a one-click RCE in January 2026. ~1000 public installations were running without auth. Here's what happened, what's exposed, and what to do.

2026-04-28#openclaw

agents#101

5 best OpenClaw alternatives in 2026 (tested and ranked)

Hermes Agent, Nanobot, NanoClaw, IronClaw, ZeroClaw — installed, broken, fixed. Honest comparison of the top OpenClaw alternatives, ranked by what actually works in production.

2026-04-28#openclaw

agents#102

How to migrate from OpenClaw to Hermes Agent: step-by-step

Concrete migration guide from OpenClaw to Hermes Agent. Export your config, port your tools, rewire your dashboard, decommission the old install.

2026-04-28#openclaw

agents#103

The complete OpenClaw timeline (Nov 2025 → Apr 2026): from weekend project to 135K installs to security crisis

Long-form history of OpenClaw — Peter Steinberger's autonomous AI agent. Origin, viral growth, technical architecture, the move to OpenAI, the security collapse, and what it means for self-hosted AI in 2026.

2026-04-28#openclaw

agents#104

Self-hosted AI agents in 2026 — the complete landscape report

Comprehensive landscape report on self-hosted AI agents in 2026: ecosystem map, vendor analysis, security posture, hosting economics, model integrations and the regulatory environment. Covers OpenClaw, Hermes, Nanobot, NanoClaw, IronClaw, ZeroClaw, Moltworker and the wider category.

2026-04-28#self-hosted-ai

agents#105

Pocket AI 2026 — the complete guide to running self-hosted AI on portable hardware

The reference guide on Pocket AI: running self-hosted AI agents and local LLMs on Raspberry Pi, Mac Mini, mini PCs, Framework laptops and edge devices. Hardware comparison, agent compatibility, real-world benchmarks, and the manifesto.

2026-04-29#pocket-ai

agents#106

Edge AI hardware buyer's guide 2026 — Raspberry Pi 5 vs Mini PC vs Mac Mini vs Framework

Honest hands-on hardware buyer's guide for self-hosted AI agents in 2026. Raspberry Pi 5, Intel NUC and clones, Mac Mini M4, Framework Laptop, Orange Pi 5 Plus — real benchmarks, real bills, concrete recommendations by budget.

2026-04-30#edge-ai

agents#107

Local LLMs in 2026 — the complete benchmark report on portable hardware

Real-world benchmarks of Llama 3.3 70B, Qwen 2.5 72B, Mistral 7B, Llama 3 8B and Phi-3 mini across Raspberry Pi 5, Intel mini PCs, Apple Silicon Mac Mini, and Mac Studio. Tokens-per-second, agentic task pass rates, power and cost economics.

2026-04-30#local-llm

agents#108

Self-hosted AI security playbook 2026 — the practical operator's guide

Practical security playbook for self-hosted AI agent operators in 2026. Threat model, sandbox setup, credential storage, network isolation, monitoring, incident response. Step-by-step, post-OpenClaw-crisis.

2026-05-01#security

agents#109

How to choose a self-hosted AI agent in 2026 — a decision tree

Pick the right self-hosted AI agent in 2026 with a six-question decision tree. Covers OpenClaw, Hermes Agent, Nanobot, NanoClaw, IronClaw, ZeroClaw, Moltworker. Practical, vendor-agnostic, no-bullshit.

2026-05-02#self-hosted-ai

agents#110

GDPR for self-hosted AI agents in 2026 — a practical compliance walkthrough

Practical GDPR compliance walkthrough for self-hosted AI agent operators. Lawful basis, data residency, sub-processor disclosure, DPIA triggers, breach notification. Plain language. Not legal advice.

2026-05-03#gdpr

agents#111

Solo developer self-hosted AI — a year-long retrospective

What it's actually like to run a self-hosted AI stack for a year as a solo developer. Real numbers on cost, ops time, downtime, regrets. What worked, what didn't, what we'd do differently.

2026-05-04#self-hosted

agents#112

Raspberry Pi 5 as a self-hosted AI host — 90 days of real-world benchmarks

What it's actually like to run a self-hosted AI agent on a Raspberry Pi 5 for 90 days. Real numbers on tokens-per-second, watt-hours, thermal throttle, SD card wear and the workloads where the Pi is genuinely good — and the workloads where it absolutely is not.

2026-05-12#raspberry-pi-5

agents#113

Migrating from OpenAI Assistants to OpenClaw — six weeks of pain (and what we kept)

A weekly diary of six weeks moving a working internal tool from OpenAI Assistants API to a self-hosted OpenClaw 2026.4 deployment. The actual mistakes, the actual cost reductions, the things that broke that we hadn't anticipated.

2026-05-19#migration

agents#114

GPU vs CPU for self-hosted AI inference — when each genuinely wins in 2026

When does a GPU actually pay for itself in self-hosted AI inference, and when is a modern CPU genuinely the better answer? Real benchmarks across Mac Mini M4, Intel NUC 13, Raspberry Pi 5, and a single-GPU box. Watts per token, euros per million tokens, and the surprising places CPU wins.

2026-05-26#gpu

agents#115

State of self-hosted AI — Q2 2026

PocketClaw's quarterly state-of-the-ecosystem report. The agents that grew, the agents that died, the CVE landscape, the hardware that won, the providers that stopped being interesting. Hard numbers from public sources, opinions credited.

2026-06-02#state-of

infrastructure

Infrastructure

proot, Ubuntu rootfs, dpkg fixes, DNS, git wrappers

7 guides

infrastructure#1

proot-distro Manual Install

Manually installing proot-distro on Termux when the package is missing from apt-android-5 repos, by downloading the .deb from GitHub and patching TERMUX_PREFIX placeholders with sed.

2026-02-18#proot

infrastructure#2

Ubuntu 25.10 Rootfs Manual Extraction

Manual extraction of Ubuntu 25.10 armhf rootfs into Termux proot when proot-distro install fails on old Termux.

2026-02-18#proot

infrastructure#3

Git Wrapper Bridge

Bridge git from Termux into proot Ubuntu using a wrapper script that calls the native binary through bind mounts.

2026-02-18#git

infrastructure#4

Git Argument Parser

An enhanced git wrapper with full argument parsing that extracts URLs and destinations regardless of order, handling the many different invocation patterns npm uses during package installation.

2026-02-18#git

infrastructure#5

--ignore-scripts (Skip Native Compilation)

Skip native module compilation during npm install on resource-constrained ARM32 device using --ignore-scripts flag.

2026-02-18#npm

infrastructure#6

npm Cache on SD Card

Move npm cache to SD card to free internal storage on Moto E2 with only 700 MB available space.

2026-02-18#npm

infrastructure#7

run-proot.sh Helper Script

A helper script that encapsulates the full proot invocation with all bind mounts, environment variables, kill-on-exit, and link2symlink flags needed to run Ubuntu on the Moto E2.

2026-02-18#proot

runtime

Runtime

Node.js cross-compile, NDK, LD_PRELOAD, libc++, native execution

6 guides

runtime#8

Node.js 22 in proot

Installing a pre-compiled Node.js 22.12.0 ARM binary directly inside the proot Ubuntu rootfs, bypassing broken dpkg/apt and the outdated Termux-native Node v12.

2026-02-18#nodejs

runtime#9

hijack.js (Bionic Bypass + GC + Lazy Loading)

Monkey-patch Node.js internals via -r flag to fix Android 6 bionic crashes, add GC, lazy loading, and dashboard endpoints.

2026-02-18#hijack

runtime#10

Bypass systemd (gateway run)

Run OpenClaw gateway in foreground mode to bypass systemd dependency in Termux/proot environment.

2026-02-18#systemd

runtime#11

Git Wrapper sed Rewrite

Using sed in the git wrapper to rewrite all three SSH URL formats (git+ssh://, ssh://, git@) to HTTPS in a single pass, since proot has no SSH agent for GitHub authentication.

2026-02-18#git

runtime#12

Native node22-icu (proot eliminated)

Cross-compile Node.js 22 with NDK r26c and small-icu for ARM32 Android, eliminating proot with an 8.4 KB LD_PRELOAD shim.

2026-02-18#nodejs

runtime#13

fs.promises Patching

Extending the hijack.js path-rewriting shim to also intercept fs.promises methods, which are a separate API surface from the synchronous and callback-based fs methods already patched.

2026-02-18#fs

ram

RAM

V8 heap tuning, lazy loading, semi-space, dead module stubs

9 guides

ram#14

Low-Memory Mode (--max-old-space-size)

Configure V8 heap limit to prevent OOM kills on 1 GB Android device, starting at 384 MB and refined down to 112 MB.

2026-02-18#v8

ram#15

ESM Dead Module Stubs

Replace unused ESM channel SDKs with stub packages exporting empty classes, saving ~80 MB RAM and 262 MB disk.

2026-02-18#esm

ram#16

V8 Heap Binary Search

Systematically binary-search the minimum V8 heap cap that survives OpenClaw startup on 1 GB RAM.

2026-02-18#v8

ram#17

Compile Cache Cleanup

Periodic cleanup of Node 22's V8 compile cache directory, which accumulates 51 MB of stale .cache files that waste disk space on a storage-constrained phone.

2026-02-18#compile-cache

ram#18

Lazy Loading v3 (Proxy-based deferred require)

Defer 40 MB of module loading at startup using ES6 Proxy-based lazy require with 37 intercepted package prefixes.

2026-02-18#lazy-loading

ram#19

Dead Packages (_DEAD_PKGS instant stubs)

Splitting intercepted packages into dead (instant empty stub, zero RAM) and lazy (proxy-deferred, loaded on demand), with 23 packages stubbed out completely to save memory and I/O on a 1 GB phone.

2026-02-18#dead-code

ram#20

V8 Heap 192 MB Minimum

Establish 192 MB as the minimum V8 heap for OpenClaw startup, surviving the ESM module linking spike.

2026-02-18#v8

ram#21

V8 Semi-Space 2 -> 1 MB

Shrink V8 young generation semi-space from default to 1 MB, saving RAM on I/O-bound gateway with minimal GC overhead.

2026-02-18#v8

ram#22

UV_THREADPOOL_SIZE=1

Reduce libuv thread pool from 4 to 1 on single-core ARM32, saving 2 MB RAM with zero performance impact.

2026-02-18#nodejs

debloat

Debloat

Package removal, SystemUI, telephony, rootfs diet

11 guides

debloat#23

Android Debloat (No Root)

Remove 31 stock Android packages without root using pm uninstall, freeing ~100 MB RAM on Moto E2. Permanent on Android 6.

2026-02-18#android

debloat#24

Don't Kill GMS (WiFi Routing Dependency)

Critical lesson: killing Google Mobile Services on Android 6 removes the default WiFi route, breaking all internet connectivity.

2026-02-18#gms

debloat#25

Static IP + GMS Kill

Configure static IP to decouple WiFi from Google Play Services, enabling safe GMS kill to reclaim 270 MB.

2026-02-18#gms

debloat#26

boot-debloat.sh (51+ Packages via Dirty COW)

Automated debloat script using Dirty COW root to disable 51+ Android packages on Moto E2 in a single command.

2026-02-18#android

debloat#27

Extended Boot Debloat (+3 Packages)

Second debloat pass adding Chrome, defcontainer, and qcrilmsgtunnel to the disabled list, saving additional 100 MB RAM.

2026-02-18#debloat

debloat#28

Proot Rootfs Diet (741 -> 550 MB)

Trim the proot Ubuntu rootfs from 741 MB to 550 MB by removing unused dev headers, Python, and locale data.

2026-02-18#proot

debloat#29

Deep Rootfs Diet (550 -> 498 MB)

Second-pass rootfs cleanup removing gconv charset modules, perl, systemd, and PAM from proot Ubuntu, cutting rootfs from 550 to 498 MB.

2026-02-18#proot

debloat#30

Tier 1.5: Headless Server Mode

Disable Android's SystemUI, Phone, Media, and Keychain services via Dirty COW root to reclaim 67 MB on a headless server phone.

2026-02-18#headless

debloat#31

npm Cache on ext4

Migrate npm cache from FAT32 SD card to ext4 rootfs partition, eliminating ENAMETOOLONG errors on deep git dependency paths.

2026-02-18#npm

debloat#32

ESM Stubs at HOST Path

Fix invisible ESM stubs by placing them at the Termux host path instead of inside the proot rootfs, where bind mounts shadow them.

2026-02-18#esm

debloat#33

setsid Gateway Detach

Detach PocketClaw gateway from Termux process tree using setsid to survive Dalvik VM kills and cgroup cascades.

2026-02-18#setsid

dirtycow

Dirty COW

Kernel exploit chain, SELinux bypass, boot loop recovery

5 guides

dirtycow#34

Dirty COW Root (CVE-2016-5195)

Exploit CVE-2016-5195 Dirty COW race condition on kernel 3.10.49 to gain temporary root on locked-bootloader Moto E2.

2026-02-18#dirty-cow

dirtycow#35

Recovery After Boot Loop

Documentation of 8 failed recovery attempts after disabling a critical Motorola package caused a permanent boot loop.

2026-02-18#boot-loop

dirtycow#36

Dirty COW SELinux Bypass (zygote context)

Two-phase Dirty COW exploit bypassing SELinux by running code as zygote process to write kernel parameters and kill daemons.

2026-02-18#dirty-cow

dirtycow#37

API Keys Out of ps Output

Move API keys from command-line arguments to a chmod 600 env file, hiding them from ps output.

2026-02-18#security

dirtycow#38

--legacy-peer-deps

Use --legacy-peer-deps to bypass npm's strict peer dependency resolution during OpenClaw installation on constrained ARM32 device.

2026-02-18#npm

launcher

Launcher

Canvas APK, CRT renderer, escape hatches, native dashboard

5 guides

launcher#39

PocketClaw Launcher APK (8.5 KB)

Build a minimal 8.5 KB Android launcher APK without Android Studio using javac, d8, aapt, and apksigner.

2026-02-18#apk

launcher#40

Native APK: Kill the WebView (216 -> 45 MB)

Replace WebView launcher with native Android Activity using ScrollView and TextView, cutting RSS from 216 MB to 55 MB.

2026-02-18#apk

launcher#41

APK v2: Escape Hatches (Post-Brick Fix)

Five escape hatch protections added to PocketClaw launcher after near-brick experience with fullscreen WebView blocking ADB auth.

2026-02-18#apk

launcher#42

Dashboard v6: Green Cyberpunk + RAM Breakdown

Redesigned dashboard with green CRT theme and per-process RAM breakdown that revealed WebView as the #1 memory consumer.

2026-02-18#dashboard

launcher#43

Process Name Cleanup in Dashboard

Clean up Android package names in PocketClaw dashboard display using regex chain for readability on small screens.

2026-02-18#dashboard

network

Network

WiFi watchdog, SSH config, npm cache, provider setup

4 guides

network#44

IPv6 DNS + autoSelectFamily

Fix intermittent DNS resolution failures in proot by pinning Google IPv6 DNS servers and enabling Node.js autoSelectFamily for dual-stack connection attempts.

2026-02-18#dns

network#45

Kimi Coding Provider + User-Agent Spoof

Configure Kimi Coding API provider for OpenClaw with correct endpoint, User-Agent spoof, and reasoning mode disabled.

2026-02-18#kimi

network#46

WiFi Watchdog

Automated WiFi recovery watchdog using busybox cron to detect silent disconnections and toggle WiFi back on via svc commands from Termux.

2026-02-18#wifi

network#47

SSH Config + Static IP

SSH config alias with static IP and port forwarding for one-command access to Moto E2 Termux over USB and WiFi.

2026-02-18#ssh

gateway

Gateway

hijack.js, dashboard, API endpoints, key management, setup wizard

4 guides

gateway#48

Dashboard via hijack.js (HTTP Intercept)

Inject custom dashboard and status API endpoints into OpenClaw's HTTP server via hijack.js monkey-patching.

2026-02-18#dashboard

gateway#49

3-Page Dashboard (STATUS / KEYS / LOGS)

Three-page dashboard with STATUS, KEYS, and LOGS tabs served from hijack.js alongside the OpenClaw gateway.

2026-02-18#dashboard

gateway#50

API Key Management (Dashboard KEYS Page)

Web-based API key management with masked display, inline editing, one-tap provider testing, and live process.env updates.

2026-02-18#api-keys

gateway#51

Setup Wizard (/setup)

Web-based setup wizard for PocketClaw: choose messaging channel, AI provider, enter credentials, and deploy in 4 steps.

2026-02-18#setup

boot

Boot

Termux boot, healthcheck, crontab, daemon stopper, wake lock

4 guides

boot#52

Termux:Boot Auto-Start

Auto-start PocketClaw gateway, sshd, and cron jobs on phone boot using Termux:Boot BOOT_COMPLETED intent.

2026-02-18#termux

boot#53

Boot Script with WiFi Retry

Replace fixed sleep delay with WiFi retry loop in Termux boot script for reliable gateway startup after reboot.

2026-02-18#boot

boot#54

Healthcheck (2-Phase Gateway Check)

Two-phase gateway healthcheck via cron: process existence check plus HTTP response verification with retry before restart.

2026-02-18#healthcheck

boot#55

termux-wake-lock + Doze Bypass

Prevent Android Doze mode from suspending CPU using termux-wake-lock and deviceidle whitelist for reliable message delivery.

2026-02-18#wake-lock

desktop

Desktop

Merged kill loop, V8 semi-space tuning, final optimizations

2 guides

desktop#56

Merged Kill Loop (3 bash -> 1 bash)

Merge three separate background bash kill loops into a single loop, saving 3 MB RAM and reducing process count.

2026-02-18#optimization

desktop#57

kill-dalvik Cron (Auto-Free ~40 MB)

Cron job to periodically kill com.termux.boot Dalvik VM, freeing 40 MB while avoiding the cgroup cascade from killing com.termux.

2026-02-18#dalvik

also on PocketClaw

More AI security tools

AI agents tracker →OpenClaw, Hermes, Nanobot…AI CVE tracker →every disclosed vulnerability AI hardware →hosts we benchmarked AI providers →OpenRouter, Anthropic, OpenAI…AI comparisons →side-by-side breakdowns AI glossary →every term, defined