A Hermes Agent sandbox is the isolated environment where the Hermes AI agent runs its shell commands, and this review scores every sandbox option, explains each security feature and ends with my verdict.
Hermes Agent is free and open source from Nous Research, and you choose the sandbox with a single setting called terminal.backend.
The official docs list seven backends, and Nous Research added an official bubblewrap backend for Linux to the plugin catalog on 21 October 2026.
That makes eight ways to decide where your agent's commands actually run.
The short verdict is that Docker is the best all-round Hermes sandbox, bubblewrap is the most interesting new option for Linux, and the default local backend isn't a sandbox at all.
One thing to be clear about up front is that my scores are my judgement from reading the official docs, the plugin pages and the release notes, not from a lab test of each backend.
Hermes Agent Sandbox Verdict At A Glance
These are my scores out of 10 for how well each backend works as a sandbox for everyday agent work, based on what the official docs say each one does.
| Backend | What it is | Isolation score | Ease score | My verdict |
|---|---|---|---|---|
docker |
It is one hardened, persistent container. | 9 | 8 | It is the best all-round sandbox. |
bubblewrap |
It is a per-command bwrap sandbox on Linux. | 7 | 8 | It is the best light option for a Linux box. |
ssh |
It runs commands on a separate server. | 7 | 7 | It is great when the agent should live on another machine. |
modal |
It is a Modal cloud VM. | 9 | 6 | It is strong for burst and eval work. |
daytona |
It is a managed Daytona workspace. | 8 | 6 | It is good for persistent cloud dev, with a 10 GiB disk cap. |
vercel_sandbox |
It is a Vercel cloud microVM. | 9 | 5 | It is solid but needs three credentials and an SDK extra. |
singularity |
It is a rootless Singularity or Apptainer container. | 8 | 6 | It is the pick for HPC clusters without Docker. |
local |
It runs commands straight on your machine. | 0 | 10 | It is not a sandbox at all. |
My overall rating for the Hermes sandbox system is 4.5 out of 5, because the choice is wide and the defaults are sensible once you leave local.
🔥 Want my exact Hermes Agent Sandbox Review setup, step by step? Inside the AI Profit Boardroom you get step-by-step video trainings, my installable Agent OS and four coaching calls a week with 3,400+ members building real automations. → Join the AI Profit Boardroom
What The Hermes Agent Sandbox Is
| Item | Detail |
|---|---|
| Name | The Hermes sandbox is the terminal backend, set with terminal.backend. |
| Maker | Nous Research builds Hermes Agent and the official sandbox plugins. |
| Cost and licence | Hermes is free and open source under the MIT licence. |
| Built-in backends | The docs list local, docker, ssh, modal, daytona, vercel_sandbox and singularity. |
| New in the catalog | Bubblewrap and Singularity/Apptainer were listed as official plugins on 21 October 2026. |
| Default | The default is local, which has no isolation. |
| Default image | Since v0.22.0 the default sandbox image is nousresearch/hermes-sandbox:desktop. |
The terminal backend decides where every shell command, file call and execute_code run happens.
If you want the plain-English explainer of every backend meaning, see my Hermes Agent backend review.
How To Switch Your Hermes Sandbox
Switching is one command, and the docs show it like this.
hermes config set terminal.backend docker
You can also run the setup wizard for just the terminal section.
hermes setup terminal
Bubblewrap needs its plugin first.
hermes plugins install bubblewrap
hermes config set terminal.backend bubblewrap
To go back to the default, the docs give hermes config set terminal.backend local.
Backend-By-Backend Review
Docker: 9 for isolation, 8 for ease
Docker runs one long-lived container that every session, /new and subagent shares, so packages and background processes carry over.
The docs list the hardening as --cap-drop ALL with only DAC_OVERRIDE, CHOWN and FOWNER added back, no-new-privileges, a 256-process limit and size-limited tmpfs mounts.
The default resources are one CPU core, 5 GB of memory and 50 GB of disk.
You can air-gap it with docker_network: false, and docker_forward_env is an explicit allowlist that keeps secrets out when empty.
Setting container_persistent: false gives every chat its own fresh container, which I'd use when each chat is a separate client.
The only knock is that you need Docker Desktop or Docker Engine running, and docker_extra_args can weaken isolation if you're careless.
Bubblewrap: 7 for isolation, 8 for ease
Bubblewrap is the newest option, built and supported by Nous Research as an official plugin.
Each command runs in its own bwrap sandbox with a read-only host root, a writable working directory, private process and temp folders, and the agent and docker sockets masked.
It hides .ssh, .aws, .gnupg, .config/gcloud, .azure, .docker, .kube, .npmrc, .pypirc, .netrc, .env and the Hermes home.
It has three profiles, which are restricted, workspace and network, and network is the default.
I score isolation lower than Docker because the plugin page says file tools still run on the host, there's no seccomp filter, and the network profile has no egress filtering.
The default limits of 256 MB of memory and 30 seconds of CPU per process are deliberately tight, so real builds need higher values.
It's Linux only and needs bubblewrap 0.9.0 or later, but it needs no image and no daemon, which is why I like it for a small server.
SSH: 7 for isolation, 7 for ease
SSH runs commands on a remote server, which the docs call a network boundary.
You set TERMINAL_SSH_HOST and TERMINAL_SSH_USER in ~/.hermes/.env, and the docs keep them there so profile exports don't share them.
The approval checks stay on, which is good, but the remote box is only as safe as you make it.
Modal: 9 for isolation, 6 for ease
Modal gives each task an isolated cloud VM with configurable CPU, memory and disk.
It needs MODAL_TOKEN_ID and MODAL_TOKEN_SECRET, or a ~/.modal.toml file.
Snapshots keep the filesystem across sessions, but not live processes.
Daytona: 8 for isolation, 6 for ease
Daytona runs a managed cloud workspace that stops and resumes instead of being deleted.
It needs DAYTONA_API_KEY, and the docs say it enforces a 10 GiB disk maximum.
Vercel Sandbox: 9 for isolation, 5 for ease
Vercel Sandbox runs commands in a cloud microVM with snapshot-backed filesystem persistence.
It needs VERCEL_TOKEN, VERCEL_PROJECT_ID and VERCEL_TEAM_ID, plus an optional SDK extra, which is why it scores lowest on ease.
Singularity or Apptainer: 8 for isolation, 6 for ease
Singularity is built for HPC clusters and shared machines where Docker isn't allowed.
It runs rootless with --containall --no-home, so the container never sees your home folder.
The plugin catalog now lists it as an official plugin, and existing users are migrated automatically.
Local: 0 for isolation, 10 for ease
Local runs commands directly on your machine.
The docs warn that the agent has the same filesystem access as your user account, so I only use it for quick tests.
🔥 Want my Hermes setups and the Agent OS? Inside the AI Profit Boardroom, I've got a full Hermes Agent course plus the Agent OS, with walkthroughs on profiles, models and safe setups. You'll be learning alongside 3,400+ members with four coaching calls every week. → Get access here
The Security Features, Scored
The backend is only half of the story, so I've scored the controls that sit around it too.
| Feature | What it does | My score |
|---|---|---|
approvals.deny |
It blocks matching commands on every backend, even under --yolo. |
9 |
| Container approval bypass | It skips dangerous-command prompts where the container is the boundary. | 7 |
docker_forward_env allowlist |
It keeps secrets out of the container unless you name them. | 9 |
docker_network: false |
It air-gaps the container with --network=none. |
9 |
container_persistent: false |
It gives every chat a fresh container. | 8 |
HERMES_WRITE_SAFE_ROOT |
It limits write_file and patch to the folders you list. |
7 |
| Bot Screen placement | It runs the bot's screen and browser inside Docker, SSH or Singularity sandboxes. | 8 |
| Hardline blocklist | It refuses a fixed set of catastrophic commands on every mode. | 8 |
approvals.deny is the feature I rate highest
The security docs describe approvals.deny as a list of glob patterns that block matching terminal commands before --yolo, /yolo and approvals.mode: off are even checked.
The v0.22.0 release notes say it now works in sandboxes, which closes the gap left by the container bypass.
The docs are honest that deny rules are a command policy, not a complete sandbox, so I treat them as a seatbelt and the backend as the car.
Bot Screen follows the sandbox
This was one of the v0.22 headlines I covered in the video above.
With a Docker, SSH or Singularity backend, the bot's screen, computer use and the browser run inside the sandbox, never on your host.
The Bot Screen docs say Modal, Daytona and Vercel Sandbox can't host a display yet, so Hermes refuses rather than quietly running the screen on your host.
Smaller Sandbox Changes In v0.22
The v0.22.0 release notes add a few quieter sandbox fixes that are worth knowing.
- Sandbox results now flag when the environment was recreated.
- SSH paths now resolve on the remote machine.
MEDIA:files made inside SSH, Modal and Daytona sandboxes now reach the user.attachments.storage: workspacestages files where a sandboxed agent can read them.
The Limits That Cost Points
These are the reasons the overall score isn't a perfect 5.
- The default backend is
local, so new users start with no isolation unless they change it. - Bubblewrap is Linux only, and its file tools stay on the host.
- Background processes don't survive on bubblewrap, and Python state doesn't carry between
execute_codecalls there. - Cloud sandboxes keep files, not live processes or dev servers.
- Every forwarded token is readable by code inside the sandbox.
If you want a second opinion on how agents should fit your SEO business, you can book a free SEO strategy session with my team.
Who Should Use Which Hermes Sandbox
| You are | My pick | Why |
|---|---|---|
| A solo user on a Mac or Windows laptop | Docker | It is the most contained option that runs on your own machine. |
| Someone on a small Linux server | Bubblewrap | It needs no image or daemon and hides your credentials. |
| A team running a client-facing bot | Docker on the gateway | The security docs recommend a container backend for production. |
| Someone running heavy batch jobs | Modal | It gives each task an isolated VM in the cloud. |
| A researcher on an HPC cluster | Singularity | It runs rootless where Docker isn't allowed. |
For the tools that sit around the sandbox, my best Hermes Agent tools roundup and my Hermes Agent MCP server review are the next reads.
The full release context is in my Hermes Agent v0.22 review.
🔥 Want help choosing the right Hermes setup? The AI Profit Boardroom has Hermes Agent training, the Agent OS and four weekly coaching calls where you can ask me which sandbox fits your work. → Join the AI Profit Boardroom
Related Reading
- The Hermes Agent backend review
- The best Hermes Agent tools, ranked
- The Hermes Agent MCP server, reviewed
Also On Our Network
- 🌐 Set up a Hermes Agent sandbox in five steps
- 🌐 Seven ways a business uses a Hermes Agent sandbox
- 🌐 How the Hermes sandbox fits an Agent OS workflow
- 🌐 GoldieBench's take on the models you run inside a Hermes sandbox
FAQ: Hermes Agent Sandbox Review
What is the best Hermes Agent sandbox?
For most people it's Docker, because it's hardened, local and easy to switch on.
What is the Hermes bubblewrap backend?
It's an official Nous Research plugin that sandboxes each command on a Linux machine with a read-only root and hidden credentials.
Is the local backend a sandbox?
No, it runs commands straight on your machine with the same access as your user account.
Do Hermes approvals work in a sandbox?
Container backends skip the dangerous-command prompts, but approvals.deny rules apply on every backend.
How do I change the Hermes sandbox?
Run hermes config set terminal.backend docker, swapping in the backend you want, or run hermes setup terminal.
If you're weighing up agents for an SEO agency and want a clear plan, you can book a free strategy session with my team.
📺 Video notes + links to the tools 👉
🎥 Learn how I make these videos 👉
🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉
About Julian
I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.
I help business owners scale with AI agents, automation and SEO.
- I've built a 7-figure SEO and link-building agency, Goldie Agency, with 70+ people in Bangkok.
- I've grown a YouTube channel to 400,000+ subscribers.
- I wrote the book "Link Building Mastery", which covers nine link building strategies.
- I run GoldieBench, where I score AI models on real one-shot builds.
→ Get my best AI training inside the AI Profit Boardroom
Switch off local, pick Docker or bubblewrap, keep a deny list, and you'll get the best out of the Hermes Agent sandbox.
