Run a personal AI assistant on a Raspberry Pi 5 in 10 minutes

New to deputyOS? The fastest path is to run it on your laptop first — no Pi, no commitment. This post covers the dedicated-Pi 5 route, which is the right next step once you’ve tried it locally and want a permanent home for your assistant.

This is the boring-on-purpose walkthrough. Most users will just do it and not need to read it. But if you want to know exactly what happens between “flash” and “first message,” here you go.

What you’ll need

A Raspberry Pi 5 (8 GB recommended; 16 GB shines with the air-gapped tier).
A microSD card (32 GB+) or NVMe SSD via the official Pi 5 M.2 hat.
A power supply that delivers 5 A at 5 V — undervoltage is the #1 cause of weird Pi 5 behaviour.
A Wi-Fi network or an Ethernet cable.
A phone or laptop on the same network as the Pi.
(Optional) An HDMI display for the boot-time QR code. Not required.
An API key from your chosen model provider (or the air-gapped tier, which doesn’t need one).

Step 1: Pick the image

Go to the picker. Choose:

Hardware: Raspberry Pi 5
Profile: OpenClaw (we’ll get you on Telegram in 10 minutes)
Tier: Standard (4–8 GB RAM)
Channel: Stable
(Skip the air-gapped toggle for this walkthrough)

The picker reads the latest signed manifest.json from cdn.deputyos.com and resolves the right artefact. You’ll see something like:

Version:  2026.5.x
Tier:     standard
SHA256:   abc123... (long)

Click Download. You’ll also see “Signature” and “Attestation” links — keep them handy if you want to verify provenance with minisign (recommended; details in update trust chain).

Step 2: Flash

Use Raspberry Pi Imager — it knows how to handle .img.xz files.

Open Imager.
CHOOSE OS → Use custom → pick the downloaded deputyos-openclaw-rpi5-<version>-stable.img.xz.
CHOOSE STORAGE → your SD card or NVMe.
Click the gear icon to set:
- Hostname (default deputyos)
- Wi-Fi SSID + password (optional if you’ll plug Ethernet)
- SSH public key (optional but recommended)
WRITE.

Imager verifies the write before declaring success. Five-ish minutes total depending on your card speed.

Verify the signature (optional but recommended). Download the .minisig file from the picker. Run minisign -Vm deputyos-openclaw-rpi5-<version>-stable.img.xz -P RWQ... (the public key is at https://www.deputyos.com/.well-known/pubkey.minisign once that lands; until then, ship your own key with the image). A green checkmark means the bytes you have are byte-identical to what the CI signed.

Step 3: Boot

Eject, slot into the Pi, plug in power. Boot takes about 60–90 seconds on a clean SD card; faster on NVMe. You don’t need a monitor — but if you have one, you’ll see:

The kernel boot lines.
A QR code rendered on TTY1 about 50 seconds in, pointing at http://deputyos.local/wizard?token=….
The IP address of the Pi, also printed.

If you don’t have a monitor, just point your phone or laptop at http://deputyos.local. mDNS makes this work on most home networks. Enterprise Wi-Fi sometimes blocks mDNS; the fallback is to find the IP via your router’s admin panel.

Step 4: First-boot wizard

You’ll land on a clean, single-page wizard at http://deputyos.local/wizard. It walks you through:

System

Hostname (already set if you used Imager), timezone, and Wi-Fi (if not already on Ethernet). The wizard rejects timezones that aren’t in the IANA database to avoid weird cron-related issues later.

Profile

OpenClaw, Hermes, or Khoj. Pick OpenClaw for this walkthrough.

See OpenClaw vs Hermes vs Khoj for picking between them.

Provider key

Choose your model provider:

OpenRouter — easiest entry point, one key for many models, fair pricing.
OpenAI — gpt-4o-mini is great for OpenClaw at low cost.
Anthropic — claude-haiku is also great.
Bedrock — if you have AWS.
Local (LFM2) — only available on the air-gapped tier.

Paste your key. The wizard does a real round-trip validation against the provider (a small 1+1 test prompt). It fails fast if the key is bad — no waiting six minutes to find out.

Channels

Toggle on what you want — Telegram, Slack, Discord, Signal, Matrix, IRC, Email. For each, a short form collects the credentials (bot token, signing secret, etc.).

Quick path for first-time Telegram setup:

Open Telegram, talk to @BotFather.
/newbot → give it a name and username.
Copy the bot token.
Paste into the deputyOS wizard’s “Telegram” form.
Click Verify — the wizard checks the token.

SSH

Optional. If you didn’t add an SSH key in Imager, you can paste one here.

Tailscale / Cloudflare Tunnel (optional)

If your Pi is behind CGNAT and you want webhook-style channels to reach it, opt into either. Tailscale is simpler; Cloudflare Tunnel is faster.

Backup

Set up rclone-style backups to your own B2, R2, or S3 bucket. Or skip and add it later via deputyctl backup schedule.

Cost guardrails

Daily and monthly spend caps with auto-pause. Defaults: $1/day, $20/month. Tune up later.

Review + apply

The wizard shows everything it’s about to write, asks for confirmation, then:

Drops /etc/deputyos/secrets.env mode 0600.
Renders the OpenClaw systemd unit from a template.
Loads the AppArmor profile in enforce mode.
Starts the OpenClaw service.
Hands you off to the /chat endpoint.

Step 5: Say hi

Open Telegram on your phone, find your new bot, send “hi.” The agent replies within seconds. The conversation is logged locally on the Pi in /var/lib/openclaw/ — never on a third-party service.

What just happened

In about 10 minutes you provisioned:

A hardened Linux box with AppArmor enforce, ufw default-deny, fail2ban, hardened sysctls, ClamAV signatures pre-loaded.
OpenClaw running under systemd with a frozen, audited unit file.
mDNS publishing deputyos.local so the device is discoverable.
A local web UI at /chat, a PWA at /app, and a wizard at /wizard (now closed after first boot).
Telegram (or whatever you chose) routing through OpenClaw to your provider.
A backup schedule (if you set one up) writing to a bucket you control.

Total agent code installed at first boot: zero. Everything was already in the image. See why we do zero first-boot installs.

Common gotchas

”I can’t reach deputyos.local”

Enterprise Wi-Fi sometimes blocks mDNS. Use the IP shown on HDMI, or check your router’s admin panel for the new device. Or plug Ethernet, which usually has mDNS.

”The Pi reboots randomly”

Almost always the PSU. Pi 5 needs the 5 A 5 V official supply. Many “Pi 4 PSUs” undervolt the Pi 5 just enough to crash randomly.

”The agent answers slowly”

If you’re on a cloud provider, your network latency dominates. If you’re on the air-gapped tier, you’re running LFM2 locally — expect 5 t/s. Both are working as intended.

”I want to test without using my real Telegram”

The built-in /chat web UI at http://deputyos.local/chat is a fully functional fallback — same agent, same memory, no Telegram required.

What next

Set up Tailscale for remote access.
Mount your files so the agent can read them.
Try the air-gapped tier on a second SD card.
Read about profile-class — what makes OpenClaw / Hermes / Khoj all deputyOS-shaped and how to add a fourth.

That’s the whole loop. Welcome to a personal AI assistant you own.