Isolation: containers and remote backends
The approval flow catches mistakes; isolation limits what a mistake can do. Neither replaces the other. The backend is one line of configuration, but the outcome is completely different:
- `local` — no isolation; the dangerous-command check runs
- `ssh` — a separate machine; the check runs; the agent cannot modify its own code
- `docker` — the container is the boundary; the dangerous-command check is skipped
- `singularity` — a container for HPC environments
- `modal`, `daytona`, `vercel_sandbox` — cloud sandboxes
The docker backend ships with hardening built in — per the docs, every container starts with these flags: all Linux capabilities dropped (--cap-drop ALL) with only the necessary ones added back, privilege escalation blocked (--security-opt no-new-privileges), a process cap (--pids-limit), and /tmp and /var/tmp mounted as size-limited tmpfs.
The filesystem has two modes: persistent (bind-mounted from a sandbox directory on the host) and ephemeral (tmpfs — lost when cleaned up).
| Backend | Isolation | Dangerous-command check | Fits |
|---|---|---|---|
| `local` | None | Yes | A trusted developer machine |
| `ssh` | A remote machine | Yes | A separate worker server |
| `docker` | A container | No (the container is the boundary) | A production gateway |
| `modal` / `daytona` / `vercel_sandbox` | A cloud sandbox | No | Scalable or disposable environments |
File-write protections are a separate layer: ~/.ssh/, ~/.aws/, ~/.kube/, /etc/sudoers, ~/.netrc, Hermes's own credential files (auth.json, .env, pairing/) and any .env, .env.local, .env.production anywhere are blocked for writing.
But the docs' own warning deserves repeating: those protections apply to the write_file and patch tools. The `terminal` tool runs as the same OS user and can still write to those paths through the shell. So the real boundary is a container or a separate machine, not the path list.
Practice. Set up the docker backend and try to read the host filesystem from inside the container. Then repeat the same test with container_persistent: false and compare. Done means: you can show in which case a file the agent wrote survives on the host, and in which case it disappears.
📚 Sources and documentation
- Security: container isolationofficialhermes-agent.nousresearch.com
The hardening flags, the backend comparison and the protected paths.
- Tools: terminal backend configurationofficialhermes-agent.nousresearch.com
- Platform support (Docker)officialhermes-agent.nousresearch.com