A Hermes Agent sandbox is a walled-off place where the Hermes AI agent runs its commands, so its mistakes land in a container or a separate box instead of on your business laptop.
Hermes Agent is the free, open-source agent from Nous Research, and you pick its sandbox with one setting called terminal.backend.
The worry I hear most from agency owners is simple.
"If I let an AI agent run commands, what stops it wrecking my machine or leaking a client's keys?"
That's a fair worry, because by default Hermes uses the local backend, and the official docs say the agent then has the same file access as your user account.
A sandbox is the fix.
In this post I'll explain what a Hermes Agent sandbox is, how to set one up, and seven practical ways a business can use one.
I'm building this from the official Hermes docs, the plugin catalog and the release notes, so I'll stick to what Nous Research documents and I won't invent results.
Hermes Agent Sandbox Use Cases At A Glance
This table maps each business job to the sandbox setting that fits it, and each one gets its own section below.
| Business job | The sandbox that fits | The key setting |
|---|---|---|
| Letting an agent work on client code safely | Docker | terminal.backend: docker with an empty docker_forward_env. |
| Running a client-facing chat bot | A container backend on the gateway | terminal.backend: docker plus user allowlists. |
| Analysing sensitive files offline | Docker with no network, or bubblewrap | docker_network: false or the bubblewrap workspace profile. |
| Keeping each client separate | Per-profile and per-session containers | One profile per client, or container_persistent: false. |
| Burst work on cloud machines | Modal, Daytona or Vercel Sandbox | terminal.backend: modal, daytona or vercel_sandbox. |
| Logged-in browser jobs with a human hand-off | Docker, SSH or Singularity with Bot Screen | The screen runs inside the sandbox by default. |
| Shared office or HPC machines | Singularity or Apptainer | terminal.backend: singularity. |
🔥 Want my exact What Is A Hermes Agent Sandbox setup, step by step? Inside the AI Profit Boardroom you get step-by-step video trainings, my installable Agent OS and four coaching calls a week with 3,400+ members building real automations. → Join the AI Profit Boardroom
What A Hermes Agent Sandbox Is, In Plain English
Think of Hermes as a new hire who types commands for you.
The terminal backend decides which computer that new hire is allowed to type on.
The official configuration docs list seven backends, which are your own machine, Docker, a server over SSH, Modal, Daytona, Vercel Sandbox and Singularity or Apptainer.
On 21 October 2026 the plugin catalog added an official bubblewrap backend for Linux machines, and the v0.22.4 release notes mention it.
Every option except local puts some kind of wall between the agent and your real files.
If you want the full technical breakdown of each backend, read my Hermes Agent backend explainer.
The Problem A Sandbox Solves For A Business
Most businesses I talk to start Hermes on a laptop that also holds their email, their client logins and their accounting files.
On the default backend, the agent can see whatever that user account can see.
Hermes does have approval prompts for dangerous commands, and that helps.
But approval prompts rely on a human being there to answer, and an agent that runs overnight or answers clients in a chat app often has nobody watching.
A sandbox gives you protection that doesn't depend on someone clicking "deny" in time.
The Docker backend, for example, drops all Linux capabilities apart from three, blocks privilege escalation and caps the container at 256 processes.
How To Set Up A Hermes Agent Sandbox
You only need the route that matches your machine.
Route 1: Docker, for most businesses
Install Docker Desktop or Docker Engine, then check it with this command.
docker version
Then switch Hermes over.
hermes config set terminal.backend docker
If you prefer a guided wizard, hermes setup terminal walks you through the same choice.
Since v0.22.0, the default image is nousresearch/hermes-sandbox:desktop, which includes a display stack for Bot Screen and the browser.
Route 2: Bubblewrap, for a lean Linux server
Bubblewrap is an official Nous Research plugin that sandboxes each command on the same Linux machine with no image and no daemon.
sudo apt install bubblewrap # Debian, Ubuntu
hermes plugins install bubblewrap
hermes config set terminal.backend bubblewrap
Then run hermes doctor to check that the sandbox probe passes.
Route 3: A separate machine or the cloud
For a separate server, set terminal.backend: ssh and put TERMINAL_SSH_HOST and TERMINAL_SSH_USER in ~/.hermes/.env.
For the cloud, Modal needs MODAL_TOKEN_ID and MODAL_TOKEN_SECRET, Daytona needs DAYTONA_API_KEY, and Vercel Sandbox needs VERCEL_TOKEN, VERCEL_PROJECT_ID and VERCEL_TEAM_ID.
Use Case 1: Let The Agent Work On Client Code Without Touching Your Secrets
This is the first job I'd move into a sandbox.
You want Hermes to install packages, run tests and edit a client's site, but you don't want it anywhere near your SSH keys or cloud logins.
With Docker, docker_forward_env is an explicit allowlist, and the docs say leaving it empty keeps secrets out of the container.
Mount only that client's project folder with docker_volumes, and add :ro to anything the agent should read but never change.
If a job needs one token, such as GITHUB_TOKEN, forward just that one, because the docs warn that code in the container can read anything you forward.
Use Case 2: Run A Client-Facing Bot On A Safe Gateway
Plenty of agencies want a Hermes bot on Telegram, Slack or WhatsApp that clients can message.
That's exactly when nobody is around to answer an approval prompt.
The security docs' production checklist says to use a container backend, set explicit allowlists, restrict resource limits, set terminal.cwd, run as a non-root user and run hermes update regularly.
They also say to never use GATEWAY_ALLOW_ALL_USERS=true in production.
If bots are new to you, my Hermes Agent bot mode guide shows how they work before you lock them down.
🔥 Want my Hermes business setups, step by step? Inside the AI Profit Boardroom, I've got a full Hermes Agent course plus the Agent OS, with walkthroughs on bots, profiles and safe setups. You'll be learning alongside 3,400+ members with four coaching calls every week. → Get access here
Use Case 3: Analyse Sensitive Files With No Internet
Some client data should never leave the building, such as exports, contracts or customer lists.
On Docker, setting docker_network: false runs the container with --network=none, which the docs say cuts off all network egress from agent commands.
On Linux, the bubblewrap workspace profile gives the agent a writable working folder with loopback-only networking.
The bubblewrap restricted profile goes further and makes the working folder read-only, which suits inspection and read-only analysis.
Remember that a local or cloud model still sees what you paste into the chat, so this protects commands, not your prompts.
Use Case 4: Keep Each Client's Work Separate
Mixing two clients' files in one workspace is how mistakes happen.
The docs say Hermes labels each Docker container with its profile, so a container for a work profile is invisible to a Hermes process running a research profile.
That means one Hermes profile per client gives you one sandbox per client.
If you want even tighter separation, container_persistent: false gives every chat its own fresh container that is removed when the session closes or goes idle.
The trade-off is that nothing carries over between chats, including installed packages and background processes.
Use Case 5: Burst Heavy Work Onto Cloud Machines
Sometimes a job needs more power than your laptop has, such as a big batch of evaluations or a long build.
The cloud backends run commands on someone else's hardware.
Modal gives each task an isolated VM, Daytona gives a managed workspace with stop and resume, and Vercel Sandbox runs a cloud microVM.
The docs say persistence keeps the filesystem, not live processes, so plan your jobs to finish or save their work.
For SSH, Modal and Daytona, Hermes syncs its own state back when the sandbox closes, but you should copy client deliverables out yourself.
Use Case 6: Logged-In Browser Jobs With A Human Hand-Off
v0.22 added Bot Screen, which gives a bot on a Linux gateway its own desktop you can watch and take over.
The release notes say that with a Docker, SSH or Singularity backend, the bot's screen, computer use and the browser run inside the sandbox, never on your host.
So when the bot hits a login or a two-factor prompt, you take the screen, finish that step, and hand it back without exposing your own desktop.
The Bot Screen docs say Modal, Daytona and Vercel Sandbox can't host a display yet, so Hermes refuses to start the screen there.
Use Case 7: Share One Powerful Machine Across A Team
If your team shares a research server or an HPC cluster, Docker often isn't allowed.
That's what the Singularity or Apptainer backend is for.
It runs with --containall --no-home, so the container gets its own namespaces and never sees the user's home folder.
It needs apptainer or singularity on the PATH, and the plugin catalog now lists it as an official plugin with existing users migrated automatically.
The Rules That Still Apply Inside A Sandbox
Here's the detail that matters for a business owner.
On container backends, Hermes skips its dangerous-command prompts, because the container is treated as the security boundary.
Your own approvals.deny list still applies, and the v0.22.0 release notes say it now works in sandboxes.
approvals:
deny:
- "git push --force*"
- "dd if=* of=/dev/*"
The docs say deny rules run before --yolo and approvals.mode: off, so they're your "never, ever" list.
On the local, SSH and bubblewrap backends, the normal approval prompts stay on.
The Limits A Business Should Know About
No sandbox is magic, and the docs are honest about that.
- Bubblewrap is Linux only, and its file tools still run on the host rather than inside the sandbox.
- Bubblewrap has no seccomp filter and no background processes, and its default memory limit is only 256 MB per process.
- Docker's
docker_extra_argscan silently weaken isolation if you pass flags that clash with the hardening. - Deny rules are a command policy, not a complete sandbox, so pair them with an isolated backend.
- Cloud sandboxes need their own accounts, and Daytona caps disk at 10 GiB.
If you want to plan where agents fit across your client work, you can book a free SEO strategy session with my team.
Choosing The Right Sandbox For Your Business
Here's how I'd decide in one minute.
If you're one person on a Mac or Windows laptop, use Docker.
If you run a small Linux server and want something lighter, use bubblewrap.
If you want the agent off your hardware entirely, use SSH to a separate box or a cloud sandbox.
If you're choosing that box, my best Hermes Agent VPS guide is a good next read.
And if your agent connects to outside tools, read my Hermes Agent MCP server guide too, because tools need the same caution as commands.
🔥 Want help choosing the right Hermes setup for your business? The AI Profit Boardroom has Hermes Agent training, the Agent OS and four weekly coaching calls where you can ask me which sandbox fits your clients. → Join the AI Profit Boardroom
Related Reading
- Hermes Agent backends, explained for business owners
- How Hermes Agent bot mode works
- The Hermes Agent MCP server for business tools
Also On Our Network
- 🌐 The five-step Hermes Agent sandbox setup walkthrough
- 🌐 Every Hermes sandbox option, scored with a verdict
- 🌐 A quick start for the Hermes sandbox inside an Agent OS
- 🌐 The models worth running inside a Hermes sandbox, on GoldieBench
FAQ: Hermes Agent Sandbox For Business
What is a Hermes Agent sandbox?
It's the isolated environment where Hermes runs its shell commands, and you choose it with terminal.backend.
Why would a business run Hermes Agent in a sandbox?
The default local backend gives the agent the same file access as your user account, and a sandbox keeps commands and secrets contained.
Which Hermes sandbox is best for a client-facing bot?
The security docs recommend a container backend for production gateways, plus allowlists, resource limits and a non-root user.
Can I keep each client's work separate in Hermes?
Yes, Docker containers are scoped to each Hermes profile, and container_persistent: false gives every chat a fresh container.
Does a Hermes sandbox cost money?
Hermes is free under the MIT licence, and only the cloud sandboxes need a paid provider account.
If you run an agency and want a plan for putting agents to work safely on client SEO, you can book a free strategy session and we'll map it out together.
📺 Video notes + links to the tools 👉
🎥 Learn how I make these videos 👉
🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉
About Julian
I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.
I help business owners scale with AI agents, automation and SEO.
- I've built a 7-figure SEO and link-building agency, Goldie Agency, with 70+ people in Bangkok.
- I've grown a YouTube channel to 400,000+ subscribers.
- I wrote the book "Link Building Mastery", which covers nine link building strategies.
- I run GoldieBench, where I score AI models on real one-shot builds.
→ Get my best AI training inside the AI Profit Boardroom
Start with Docker, keep each client in its own profile, and a Hermes Agent sandbox lets your business use an AI agent without betting your real machine on it.
