Is Hermes Agent Bubblewrap Worth It For A Small Business?

Hermes Agent bubblewrap is worth setting up if your business runs an AI agent on a Linux machine you care about, because it stops the agent's shell commands from touching your passwords, keys and other files outside one folder.

It is an official plugin from Nous Research, the team behind Hermes Agent, and the plugin page says it is built and supported by them.

This page skips the deep config and answers the owner's questions: what it protects, what it does not, who needs it, and what a normal week looks like with it switched on.

If you would rather talk it through with my team first, book a free SEO strategy session.

The Short Answer For Business Owners

Yes, for most small teams that let Hermes run commands on their own Linux server or office PC.

No, if you run Hermes on a Mac or Windows laptop, because the plugin is Linux only.

And probably not, if your agent already lives inside Docker or a cloud sandbox and you are happy with that.

The rest of this page explains how to tell which camp you are in.

What Problem It Solves On A Small Server

By default Hermes runs shell commands as you, on your machine, with the same reach you have.

That is convenient, and it is also how an agent ends up able to read your SSH keys, your cloud logins or your saved database passwords.

Bubblewrap changes the deal for every command.

The command can see the machine, but only read it.

It can write inside one working folder you choose.

Your credential folders, browser profiles, keyrings and the Hermes settings file with its keys simply do not exist from inside the sandbox.

Each command also gets caps on memory, CPU time and the number of processes it can start, so one bad script cannot swamp the server.

Why "No Container" Matters For A Small Team

The usual advice for isolating an agent is Docker.

Docker works, but someone has to keep an image up to date, keep a daemon running and understand how folders map in and out.

The bubblewrap README is clear that this plugin is not a container: no image, no daemon, no network round trip.

Your installed tools, your project folders and your system files stay at their normal paths, just read-only.

For a business without a dedicated IT person, that is the appeal.

You keep one machine, one set of tools and one Hermes install, with a fence around what the agent can change.

Which Plan Or Licence You Need

There is no plan tier to look for.

Hermes Agent is open source under the MIT licence, per the Hermes Agent repo.

Bubblewrap sits in the official tier of the Hermes plugin catalog, and the v0.23.0 catalog entry pins plugin version 1.3.0.

What you do need is a Linux machine, Hermes 0.22.6 or later, the bubblewrap package at 0.9.0 or newer, the prlimit tool that ships with util-linux, and user namespaces allowed for your account.

Your AI model provider is a separate choice and is not affected by this plugin.

🔥 Want to see how other owners lock down their Hermes servers? Inside the AI Profit Boardroom you get step-by-step video trainings, the installable Agent OS, four coaching calls a week and 3,400+ members comparing safe agent setups for real businesses. → Join the AI Profit Boardroom

Five Use Cases, Step By Step

A Bookkeeper Trying A Downloaded Script

A bookkeeping practice finds a script online that promises to tidy up bank-export CSV files.

Here is how they try it without risking the server.

Save the script and one sample export into a single test folder.
Set that folder as the agent's working folder and pick the restricted profile, which is read-only with no internet.
Ask Hermes to read the script and list every file it opens and every web address it contacts.
Switch to the workspace profile, still offline, and let the agent run it on the sample.
Check the output by hand before the script goes anywhere near real client files.

At no point can the script read the practice's saved logins, because those folders are hidden from every command.

A Web Agency Building Client Sites

A small agency uses Hermes to update client websites on a shared Linux build box.

Each job points the working folder at one client's project.
The default network profile stays on, because installing packages needs the internet.
Memory is raised to 2048 MB, since the README warns package managers and compilers need more than the default 256 MB.
The agent edits, installs and builds inside that one project.
A person on the team reviews the changes and publishes them.

Other clients' folders on the same box stay read-only to that job.

A Trades Business With A Telegram Agent

An electrician runs a Hermes assistant on an office mini PC and messages it from site.

The working folder is set to the job-sheets directory.
The profile is workspace, so the shell has no internet.
When the owner asks for a summary of this week's open jobs, the agent reads and sorts files in that folder only.
Anything that looks risky still triggers the normal Hermes approval prompt.

An Online Shop Cleaning Product Feeds

A small shop exports its product list each week and needs it reshaped for a marketplace upload.

The export lands in a feeds folder on a Linux server, set as the working folder.
The agent writes and runs a small cleanup script there under the workspace profile.
The finished file is saved next to the original.
The owner uploads it by hand.

The script never sees the shop's admin logins, because they live in hidden folders.

A Salon Reviewing Its Booking Exports

A salon owner exports appointments from the booking system each month and wants a plain summary of busy days and no-shows.

The export file goes into a reports folder on the office Linux PC.
The profile is set to restricted, because the job only needs to read.
The owner asks Hermes for a summary, and the agent reads the file and replies in chat.
When a saved report file is wanted, the profile moves to workspace so the agent can write it into the same folder.

Client phone numbers in that export are still readable by the agent, so only put the files the job needs into that folder.

📞 Not sure how to fit an AI agent into your business safely? Book a free SEO strategy session and my team will look at your setup and where an agent fits. → Book your free call

The Risks It Does Not Remove

Be straight with yourself about the gaps, because the README is straight about them.

Anything your user can read outside the hidden folders is still readable, including secrets left inside project folders.
The default network profile shares your internet connection with no filtering, so a command could still send data out.
There is no system-call filter; Nous calls it a filesystem and process boundary.
Memory caps apply per process, so a command that starts many processes can use more in total.
Background jobs do not survive, which rules out long-running servers inside the sandbox.

The fix for most of these is housekeeping: keep secrets out of project folders, and use an offline profile whenever the job does not need the internet.

Approvals: You Still Get Asked

Some owners worry a sandbox means the agent stops asking before risky steps.

It does not.

The README says Hermes keeps its dangerous-command approval for this backend exactly as it does for local commands.

Container backends work differently: the Hermes security docs say docker, modal, daytona and vercel_sandbox skip that check because the container is the boundary.

For outbound emails or customer messages, approvals do not cover them, so write "draft only" into those jobs and send them yourself.

What Changes Day To Day Once It Is On

For the people messaging the agent, very little.

They still ask in Telegram, Slack or the terminal, and Hermes still replies the same way.

The differences show up at the edges.

A job that tries to save a file outside its folder gets a read-only error, and the agent has to work inside the folder instead.

A job that tries to keep a server running in the background will find it gone a moment later.

Files dropped in the system temp folder vanish after each command, so anything worth keeping belongs in the working folder.

And a package install that runs out of memory fails with a clear message until someone raises the limit.

None of these break normal file and report work, but they are worth telling your team about before the switch.

Questions To Ask Whoever Runs Your Server

Which Linux distribution and version is it on, and does hermes doctor pass the sandbox check?
Which folder is the agent allowed to write to, and is anything sensitive stored in there?
Which profile is set, and does this job really need the internet?
Has the memory limit been raised for any job that installs packages?
Are approvals left on, and who answers them?

If they cannot answer the second question, sort that out first; it decides what the agent can actually change.

When It Is Not Worth Setting Up

You run Hermes on a Mac or a Windows PC.
Your agent never runs shell commands, only chats.
You already run it inside Docker or a cloud sandbox and someone maintains that.
The job needs a server process that keeps running, such as a preview site.

What It Takes To Get Running

Whoever looks after your server installs one system package, installs the plugin, and changes one Hermes setting.

sudo apt install bubblewrap
hermes plugins install bubblewrap
hermes config set terminal.backend bubblewrap
hermes doctor

On Ubuntu 24.04 and later, the check can fail until the AppArmor restriction on user namespaces is relaxed for bubblewrap, following the distribution's own notes.

If the sandbox cannot start, Hermes refuses to run commands rather than running them unprotected.

It arrived as one of the new official plugins in the Hermes v0.23.0 release.

The Decision Checklist

Is the agent on Linux? If not, stop here.
Does it run commands on a machine that also holds logins or client data? Then switch it on.
Does the job need the internet? Use network; otherwise use workspace or restricted.
Will it install packages or compile? Raise memory first.
Are any secrets sitting in project folders? Move them.

For the other add-ons worth a look, see our guide to the best Hermes Agent plugins.

Also On Our Network

FAQ: Is Hermes Agent Bubblewrap Worth It For A Small Business? Use Cases, Risks And Who Needs It

Do I need a paid Hermes plan to use bubblewrap?

There is no plan tier for it. Hermes Agent is open source and bubblewrap is an official plugin you install from the catalog.

Does bubblewrap work on a Mac or Windows PC?

No. The catalog lists Linux as its only platform.

Can the agent still read my passwords with bubblewrap on?

Credential folders such as .ssh, .aws and .gnupg, browser profiles and keyrings are always hidden. Secrets you keep inside project folders are not, so move them.

Will the agent still ask before risky commands?

Yes. Hermes keeps its dangerous-command approval on this backend, the same as for local commands.

Is bubblewrap a replacement for Docker?

It is a lighter alternative for one machine: no image and no daemon. It is not a container and does not filter network traffic.

📺 Video notes + links to the tools 👉

🎥 Learn how I make these videos 👉

🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉

About Julian

I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.

I help business owners scale with AI agents, automation and SEO.

I've built a 7-figure SEO and link building agency, Goldie Agency, with a team of 70+ SEO experts.
I've grown a YouTube channel to 400,000+ subscribers.
I wrote "Link Building Mastery".
My Udemy courses have taught over 29,000 students.

→ Get my best AI training inside the AI Profit Boardroom

Answer the checklist, switch on the sandbox for any Linux box that holds client data, and book a free SEO strategy session or join the AI Profit Boardroom if you want help rolling out Hermes Agent bubblewrap across your business.