Massed Compute

Launch GPU VM

# Launch via Massed Compute dashboard or API
# Product: gpu_1x_l40
# Image: 184 (Ubuntu Server 24.04 w/ Drivers)
# SSH Key: attach your public key
# Instance name: openclaw-local-llm

Verify the GPU

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP \
  'nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader'

This run printed NVIDIA L40, 46068 MiB, 580.126.16.

Install Ollama on loopback

The GPU workload is Ollama. Bind it to 127.0.0.1 so the model API is not on the public interface.

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP 'bash -s' <<'EOF'
set -euo pipefail
curl -fsSL https://ollama.com/install.sh | sh
sudo mkdir -p /etc/systemd/system/ollama.service.d
sudo tee /etc/systemd/system/ollama.service.d/override.conf >/dev/null <<'CONF'
[Service]
Environment="OLLAMA_HOST=127.0.0.1:11434"
Environment="OLLAMA_MAX_LOADED_MODELS=1"
CONF
sudo systemctl daemon-reload
sudo systemctl enable --now ollama
sudo systemctl restart ollama
ss -ltn | grep 11434
curl -sS http://127.0.0.1:11434/api/tags
ollama --version
EOF

You should see 127.0.0.1:11434 and ollama version is 0.32.15 (or the version you actually installed that day).

Pull a tool-capable local model

OpenClaw prefers an installed model with tools and a context window of at least 16K. This guide uses ungated qwen2.5:14b (32K, tools).

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP 'bash -s' <<'EOF'
set -euo pipefail
ollama pull qwen2.5:14b
ollama show qwen2.5:14b | sed -n '/Capabilities/,/System/p'
EOF

This pull was 9.0 GB. ollama show reported completion and tools. Swap the tag if you want a smaller 7B (qwen2.5:7b) or a larger 32B on the same 48 GB card.

Ollama-only setup, without OpenClaw, is already covered in Deploy LLMs with Ollama on GPU Cloud.

Install OpenClaw

The published installer provisions Node if the image does not have it. Skip the interactive wizard; onboard next.

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP 'bash -s' <<'EOF'
set -euo pipefail
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
export PATH="$HOME/.npm-global/bin:$PATH"
openclaw --version
node -v
EOF

This VM installed OpenClaw 2026.7.1-2 and Node.js v26.7.0. If openclaw is missing in a new shell, source ~/.bashrc or prepend ~/.npm-global/bin as above. Pin the version you print from openclaw --version — do not copy an older npm tag from a gist.

Onboard: local Ollama + loopback Gateway

--gateway-bind loopback keeps the Control UI and WebSocket on 127.0.0.1:18789. --install-daemon writes a systemd user unit and enables lingering so the Gateway survives logout.

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP 'bash -s' <<'EOF'
set -euo pipefail
export PATH="$HOME/.npm-global/bin:$PATH"
openclaw onboard --non-interactive --accept-risk \
  --mode local \
  --auth-choice ollama \
  --custom-base-url "http://127.0.0.1:11434" \
  --custom-model-id "qwen2.5:14b" \
  --gateway-bind loopback \
  --install-daemon \
  --skip-skills
openclaw gateway status
ss -ltn | grep 18789
EOF

Expected: Gateway: bind=loopback (127.0.0.1), port=18789, Connectivity probe: ok. Config lands in ~/.openclaw/openclaw.json. Primary model should be ollama/qwen2.5:14b. Tools profile on this run was coding (read / write / exec).

Do not set Ollama baseUrl to http://127.0.0.1:11434/v1. OpenClaw’s Ollama provider uses the native API. The OpenAI-compat /v1 URL breaks tool calling.

Optional: turn off hosted memory search if you have no OpenAI key:

openclaw config set agents.defaults.memorySearch.enabled false

Reach the Control UI from your laptop with an SSH tunnel, not a public bind:

ssh -o IdentitiesOnly=yes -N -L 18789:127.0.0.1:18789 Ubuntu@YOUR_VM_IP
# then open http://127.0.0.1:18789/ locally

The Gateway still expects its token over the tunnel. openclaw dashboard on the VM is the same origin.

Firewall and optional auth gate

Default incoming deny. Only SSH is public. Ollama 11434 and OpenClaw 18789 stay on loopback.

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP 'bash -s' <<'EOF'
set -euo pipefail
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
echo y | sudo ufw enable
sudo ufw status
EOF

If you later expose the Control UI, put HTTP basic auth in front (and TLS before it faces the internet). This validation listened on 127.0.0.1:8080 only — not 0.0.0.0. Unauthenticated curl returned 401; authenticated curl returned 200.

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP 'bash -s' <<'EOF'
set -euo pipefail
sudo apt-get update -qq
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y nginx apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd YOUR_USER
sudo chown root:www-data /etc/nginx/.htpasswd
sudo chmod 640 /etc/nginx/.htpasswd
sudo tee /etc/nginx/sites-available/authproxy >/dev/null <<'NGX'
server {
    listen 127.0.0.1:8080;
    server_name _;
    location / {
        auth_basic "OpenClaw";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://127.0.0.1:18789;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 3600s;
    }
}
NGX
sudo ln -sf /etc/nginx/sites-available/authproxy /etc/nginx/sites-enabled/authproxy
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/
EOF

htpasswd -c prompts for a password. Do not paste credentials into chat or tickets. For a public listener you still need TLS; basic auth on plaintext HTTP is not enough.

Run a real agent workflow

Not “hello”. Seed a workspace ticket, then ask the agent to use exec against it and write report.md.

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP 'bash -s' <<'EOF'
set -euo pipefail
export PATH="$HOME/.npm-global/bin:$PATH"
cat > ~/.openclaw/workspace/ops-ticket.md <<'TICKET'
# GPU sizing ticket

SKUs:
- gpu_1x_l40
- gpu_1x_l40s
- gpu_1x_A100_SXM4
TICKET

openclaw agent --agent main --timeout 180 --json --session-id sku-report \
  --message 'Use exec once: awk '\''/^- gpu_/{print; c++} END{print "COUNT=" c}'\'' ~/.openclaw/workspace/ops-ticket.md > ~/.openclaw/workspace/report.md && echo RECOMMEND: gpu_1x_l40 for 14B Q4 on 48GB >> ~/.openclaw/workspace/report.md && cat ~/.openclaw/workspace/report.md
Do not invent SKUs.'

cat ~/.openclaw/workspace/report.md
EOF

This L40 produced:

- gpu_1x_l40
- gpu_1x_l40s
- gpu_1x_A100_SXM4
COUNT=3
RECOMMEND: gpu_1x_l40 for 14B Q4 on 48GB

openclaw agent JSON on that turn: toolSummary.calls=1, tool exec, failures=0, provider ollama, model qwen2.5:14b, wall 10.99 s with the model already resident. An earlier turn also issued read + write + exec (four calls, 69.65 s including first load). If the model fires several tools in parallel before seeing read output, it can grep the wrong pattern — wait for the file contents, or pin a single exec as above.

Persistence: workspace files live under ~/.openclaw/workspace/. Sessions are under ~/.openclaw/agents/main/sessions/. The Gateway is the user systemd unit openclaw-gateway.service.

Confirm GPU utilization

ssh -o IdentitiesOnly=yes Ubuntu@YOUR_VM_IP \
  'nvidia-smi --query-gpu=name,memory.used,utilization.gpu --format=csv,noheader; nvidia-smi'

After the agent turns this L40 showed 15099 MiB used of 46068, 36% util, ~241 W. The compute process was ollama llama-server (~15090 MiB). The OpenClaw Gateway is a Node process on CPU. That is the split: GPU = model, CPU = agent control plane.