Best Practices: Open Claw & Ollama on Fanless Proxmox (i7-1355U / Intel Iris Xe)

[Hanfried]

Hi everyone,

I am planning to set up a self-hosted AI stack (Ollama backend + Open Claw frontend) on a new, completely fanless Proxmox VE system. Since the hardware is passively cooled, I’d appreciate your advice on the best architectural approach, especially regarding iGPU acceleration and thermal management. Please pardon me in case it is a silly question, but I am a Newbie to Proxmox and could not find any specific guides concerning OpenClaw.

The Hardware:

• Model: ZOTAC ZBOX CI669 NANO (Fanless)
• CPU: Intel Core i7-1355U (13th Gen, 10 Cores)
• GPU: Integrated Intel Iris Xe Graphics
• RAM: 32 GB Crucial DDR5-5600 SODIMM (Dual Channel)
• Storage: 2 TB Corsair MP600 MICRO NVMe PCIe Gen4 x4
• Networking: Dual Gigabit LAN, WiFi, Thunderbolt 4

My Questions:

1. LXC vs. VM for Intel iGPU: Since I am using the integrated Iris Xe graphics, what is the current "best practice" for Ollama? Should I use an LXC and map /dev/dri/renderD128 for lower overhead, or is a VM with SR-IOV / PCIe Passthrough more stable on 13th Gen Intel chips?
2. Thermal Considerations: The system is fanless. Running LLMs can be quite taxing. Does anyone have experience with CPU pinning or power-limiting (cgroups/Proxmox settings) to prevent thermal throttling while maintaining decent inference speeds?
3. Permissions: What is the recommended way to handle user rights for the iGPU devices to avoid running the services as root while still allowing the container/VM to access hardware acceleration?
4. Open Claw Integration: Has anyone successfully deployed Open Claw alongside Ollama in separate containers on the same bridge, and are there any networking pitfalls I should be aware of? Is a VM more secure in terms of breach risks?

I’m looking forward to your insights, especially from those running Openclaw on Proxmox!

Best regards
Hans

 

[alexskysilk]

1. lxc.
2. "decent" speeds are very relative. your tps on this system will be abysmal in the best of cases, and will drop as soon as you start hammering the system.
3. running the container in unprivileged mode.
4. since all you need is connectivity via port 11434, this is trivial.