Hermes Agent sandbox options decide where your agent’s commands actually run — straight on your computer, or inside a box that limits what it can touch. With v0.22.4 on 21 October 2026, Nous Research added a new Bubblewrap sandbox for Linux and moved Singularity/Apptainer into the plugin catalog. In the video below I show the Hermes plugin library these backends now install from. Here’s every Hermes sandbox option, what each one protects, and which one I’d choose.
Key takeaways
- Hermes runs commands through a terminal backend — local, or a sandbox.
- Options: Docker, SSH, Modal, Daytona, Vercel Sandbox, Singularity and Bubblewrap.
- Bubblewrap is new: a lightweight Linux sandbox per command.
- Switch with
hermes config set terminal.backend <name>— or claim a free strategy session for help.
Why a Hermes Agent sandbox matters
Hermes is powerful because it can run real commands: install software, edit files, run scripts. That’s also the risk. On the default local backend, commands run directly on your machine with no isolation. A sandbox puts a wall between the agent and the things you care about — your SSH keys, cloud logins, personal files and the rest of your system.
Hermes already has other safety layers: dangerous-command approvals, your own deny rules (which apply to every backend), a file-write denylist and prompt-injection scanning. A sandbox adds the strongest one: even if something goes wrong, it happens inside the box.
Every Hermes Agent sandbox option
| Backend | Where commands run | Good for |
|---|---|---|
| local | Your machine directly, no isolation | Development on a machine you trust |
| docker | A hardened Docker container (all Linux capabilities dropped by default) | Most people who want isolation |
| ssh | A remote server | Keeping the agent off your own computer |
| modal | A Modal cloud sandbox (direct or via the Nous gateway) | Cloud isolation without managing servers |
| daytona | A Daytona workspace | Cloud dev environments |
| vercel_sandbox | A Vercel Sandbox | Cloud sandboxing |
| singularity | A rootless Singularity/Apptainer container | Linux servers and research clusters |
| bubblewrap | A bwrap sandbox per command on Linux | Lightweight local isolation on Linux |
Bubblewrap and Singularity now install as official plugins from the catalog. Singularity used to be built into the core; existing users were moved over automatically.
Want a safe Hermes setup without the guesswork? Claim your free strategy session →
Want Hermes running safely on your own server? Inside the AI Profit Boardroom you get the Agent OS — Hermes, OpenClaw, OpenCode, Claude and Codex in one place — plus step-by-step Hermes training and four live coaching calls a week.
Want a plan for your business first? Claim your free strategy session.
Join the AI Profit Boardroom →Claim Your Free SEO Strategy Session →
The new Bubblewrap sandbox for Hermes Agent
Bubblewrap needs Hermes v0.22.2 or later and works on Linux. Once installed, every terminal and code-execution command runs in its own bwrap sandbox. According to Nous’s catalog entry, each sandbox has:
- A read-only root filesystem with a writable working directory.
- Three profiles: restricted, workspace or network.
- SSH keys, cloud credentials and the Hermes home hidden from commands.
- Private temp and process directories, with agent and Docker sockets masked.
- Per-command memory, CPU and process limits.
Turn it on with hermes config set terminal.backend bubblewrap. You need the bwrap and prlimit programs installed (from the bubblewrap and util-linux packages).
Know the limits. Under the default network profile, commands still share your network. Hermes’ file tools (read, write, patch and search) run on the host and aren’t confined, which is why Hermes keeps its dangerous-command prompts on this backend.
Singularity / Apptainer sandbox
Singularity runs Hermes’ terminal, file and code tools inside a hardened, rootless container with CPU and memory limits and an optional overlay that persists for the session. Switch with hermes config set terminal.backend singularity. By default it pulls the nousresearch/hermes-sandbox:desktop image.
Your skills and registered credential files are mounted read-only. Because the container is disposable, Hermes skips its dangerous-command prompts there — the same as its other container backends.
Which Hermes Agent sandbox should you use?
| If you… | Use |
|---|---|
| Are on a Mac or Windows and want isolation | docker |
| Run Hermes on a Linux VPS and want low overhead | bubblewrap |
| Work on a shared Linux server or cluster | singularity |
| Don’t want the agent on your computer at all | ssh or a cloud sandbox (Modal, Daytona, Vercel) |
| Are just testing on a spare machine | local, with approvals on |
For most business owners, I’d run Hermes on a VPS with Docker or Bubblewrap, keep approvals on, and never expose the agent to the public internet — use Tailscale to reach it. See my Hermes Agent Docker and best Hermes VPS guides.
How to switch your Hermes sandbox
- Update Hermes:
hermes update. - Install the plugin if needed:
hermes plugins install bubblewraporhermes plugins install singularity. - Set the backend:
hermes config set terminal.backend bubblewrap(or docker, singularity, ssh…). - Run a harmless test command and check it can’t see your home folder or keys.
Prefer not to touch the terminal? Ask your agent to do it: “Switch my terminal backend to Docker and confirm it’s isolated.”
Hermes Agent sandbox mistakes to avoid
- Turning approvals off because you’re in a sandbox. On Bubblewrap and local, file tools still run on your host. Keep approvals on.
- Mounting your whole home folder. Give the sandbox one working folder, not everything.
- Exposing the agent to the internet. A sandbox protects your machine, not your accounts. Use Tailscale and allowlists for who can message Hermes.
- Forgetting the network. If a task doesn’t need the internet, use a restricted profile.
- Never testing it. Ask Hermes to list your home folder from inside the sandbox; if it can see your keys, something is wrong.
Get these right and a sandbox turns Hermes from “risky experiment” into something you can trust with real business work.
My verdict on the Hermes Agent sandbox options
Running an agent with no sandbox is like giving a new hire the keys to everything on day one. Docker is the easy default, Bubblewrap is the lightweight new option for Linux, and Singularity suits servers. Pick one, keep approvals on, and your Hermes Agent sandbox will let you automate with confidence.
About Julian Goldie
I’m Julian Goldie — founder of Goldie Agency and the AI Profit Boardroom. I test new AI agents almost every day for 432K+ YouTube subscribers and run Hermes, OpenClaw, OpenCode, Claude and Codex side by side in my own Agent OS. Claim your free strategy session or join the AI Profit Boardroom.
FAQ: hermes agent sandbox
Does Hermes Agent have a sandbox?
Yes — Hermes can run commands through Docker, SSH, Modal, Daytona, Vercel Sandbox, Singularity/Apptainer or the new Bubblewrap backend instead of directly on your machine.
What is the Hermes Bubblewrap backend?
A Linux sandbox added to the plugin catalog in v0.22.4 that runs every command in its own bwrap sandbox, with a read-only root, hidden keys and credentials, and resource limits.
How do I change the Hermes sandbox?
Run hermes config set terminal.backend followed by the backend name, such as docker or bubblewrap.
Is the local backend safe?
It has no isolation, so only use it on a machine you trust, with approvals on.
Which Hermes sandbox is best?
Docker for most people, Bubblewrap for lightweight isolation on Linux, and Singularity for shared Linux servers.
Ready to put Hermes to work in your business? Join the AI Profit Boardroom for the Agent OS, setup training and daily updates.
Or claim your free strategy session and we’ll map out your setup.
Starting from zero? Get the free AI course and community.
Join the AI Profit Boardroom →Claim Your Free SEO Strategy Session →Get the FREE AI Course + Community →
Related reading
Last updated October 2026. This page is a living guide to hermes agent sandbox — the facts here move fast and it is updated as they do.