AI Agent on Raspberry Pi: Self-Hosted Setup Guide

Running a Personal AI Agent on a Raspberry Pi: Security-First Setup

TL;DR: A developer built a self-hosted AI assistant using OpenClaw on a decade-old Raspberry Pi for task management and reminders, prioritizing data ownership and security through sandboxing and minimal permissions.

From Junk Drawer to 24/7 Assistant

An engineer resurrected an unused Raspberry Pi to prototype a personal AI agent that actively manages schedules, sends reminders, and handles task coordination—not just passively list them. The setup costs under Rs 10K (~$120 USD) in hardware and runs entirely on self-hosted infrastructure, giving the builder complete data control.

The distinction between a chatbot and an AI agent matters here. OpenClaw functions as an agent: it uses tools, runs commands, interacts with APIs, and executes tasks on behalf of the user. It connects to LLM providers like Anthropic's Claude but delegates the execution layer to local hardware. The Raspberry Pi becomes the "doing" component while the language model handles reasoning.

Why This Approach Works

OpenClaw is architected for edge deployment. It supports persistent memory (learning user preferences over time), custom skills and plugins, and runs entirely on self-hosted hardware without dependency on proprietary cloud platforms. For this builder, Telegram served as the interface—a familiar messaging app that eliminates the need for yet another interface.

The actual use case is deliberately narrow: scheduling, reminders, and task coordination across work and personal life. This constraint is a strength. Rather than attempting home automation or DevOps pipeline management, the setup does one thing well: keeping someone on top of their day through proactive check-ins and contextual awareness. The agent batches smaller tasks in the afternoon, flags forgotten follow-ups, and periodically reviews what's slipping through the cracks.

Setup: Pi OS to Production in Hours

The installation process requires minimal technical overhead:

• Raspberry Pi OS Lite (64-bit) on a fresh SD card via Pi Imager
• System updates and Node.js 22.x runtime
• OpenClaw installed globally via npm, configured through an onboarding wizard
• Systemd service file for auto-start and crash recovery on boot

The builder chose Claude Sonnet as the primary LLM provider and configured Telegram as the chat interface. Setup time: less than an hour. The Pi runs headless (no desktop environment) and persists as a background service.

Security: The Non-Negotiable Layer

This section reveals the builder's security expertise and should inform anyone replicating the setup. An AI agent with machine access is powerful and dangerous without firm boundaries. The defense-in-depth approach includes:

Docker-based sandboxing: All shell operations execute inside isolated containers. Network access is disabled by default (sandbox.docker.network: "none"), and the agent can only perform explicitly allowed actions like task management and file reads.

Dedicated user account: OpenClaw runs as a non-privileged user (openclaw-user) rather than the primary account. Operating system permissions prevent the agent from accessing system directories or resources outside its workspace.

Kill-switch behavior: Commands attempting unauthorized actions—writing to system directories, curling unknown endpoints—are intercepted by the sandbox. Failure defaults to safe rather than permissive.

API spend limits: Hard monthly caps on LLM API spending prevent cost explosion from agent loops. This is set at the provider level (Anthropic dashboard), not self-regulated by the bot.

Data isolation: Personal files, credentials, and browsing history are never stored on or accessible to the Pi. The agent operates only on information explicitly provided through conversation. The Pi remains a task runner; if compromised, an attacker finds a scheduler, not a life.

CVE awareness and dependency management: OpenClaw recently partnered with VirusTotal for skill security scanning. The builder maintains isolation on a network segment, regularly updates dependencies, and reviews skills before enabling them. Open-source code allows inspection of what's actually running.

Real-World Interaction Examples

The agent demonstrates contextual understanding and proactive behavior. When asked "Remind me to prepare for the ABC meeting by 5 PM today," it confirms and offers a 15-minute pre-reminder. When asked "What's on my plate this week?" it lists work items, detects patterns (Monday mornings for planning, afternoon batching preference), and proactively offers to block focus time.

The heartbeat check-in feature runs twice daily, reviewing tasks and flagging items slipping through cracks. The agent weaves work and personal tasks into a single view without context-switching between apps.

Why This Matters to Developers

This prototype demonstrates that AI agents are ready for edge deployment on consumer hardware. The economics are compelling: sub-$150 hardware, minimal power consumption, and zero cloud dependency. For developers concerned about data privacy, vendor lock-in, or API costs, this path is now practical.

The security model also matters. As AI agents gain execution capabilities, the threat model shifts. An agent isn't just generating text—it's a new security principal on your system with access to files, networks, and processes. The builder's defense-in-depth approach (sandboxing, minimal permissions, network isolation, spend limits) should become standard practice for anyone deploying agents on personal hardware.

OpenClaw's architecture—separating the reasoning layer (cloud LLM) from the execution layer (local hardware)—shows a viable path for building intelligent systems that preserve user control. Skills and plugins allow extensibility without requiring code changes to the core.

Key Takeaways

• AI agents can run profitably on decade-old Raspberry Pi hardware for under $150 total investment, making edge deployment practical for individual developers
• OpenClaw separates reasoning (cloud LLM) from execution (local hardware), letting users control sensitive operations while leveraging model intelligence remotely
• Persistent memory and proactive check-ins give the agent contextual awareness—it learns preferences, batching patterns, and flags forgotten tasks without explicit reminders
• Security-first architecture requires sandboxing, dedicated user accounts, network isolation, and API spend limits; this must be designed in, not added later
• Self-hosted agents eliminate cloud dependency, vendor lock-in, and data exposure, making them suitable for privacy-conscious users willing to manage security posture

Source: Ajay Ravichandran, Medium, March 2026