Hermes Agent Bubblewrap: The Linux Sandbox for Every Terminal Command
Hermes Agent bubblewrap is the official plugin that runs every terminal and execute_code command in its own bubblewrap sandbox on the machine Hermes runs on. It arrived as a one-command install in the v0.23.0 release, and its README says it is built and supported by Nous Research. It’s Linux only. My video is right under this intro.
Key takeaways
Official plugin, Linux only, needs Hermes 0.22.6 or later.
Not a container: no image, no daemon, host paths read-only.
Credentials, agent sockets and the Hermes home are hidden.
Three profiles: restricted, workspace and network.
Bubblewrap (bwrap) is a small Linux sandboxing tool. The Hermes plugin is a terminal backend: instead of running commands straight on your machine, every command gets its own sandbox.
The README is clear that it is not a container. The sandbox sees the host filesystem read-only at the same paths, can write to the working directory, and can’t read your credentials. It needs no image, no daemon and no network round trip.
Why it exists
The configuration docs say the default local backend runs commands directly on your machine with no isolation. The Docker backend isolates more, but needs Docker and a container.
The README pitches bubblewrap for the gap in between: a personal machine or small server where local is too open and Docker is too heavy.
Want AI agents that are safe to run on your own server? Inside the AI Profit Boardroom you get the Agent OS — Hermes, OpenClaw, OpenCode, Claude and Codex in one place — plus step-by-step Hermes training and four live coaching calls a week.
Add the plugin: hermes plugins install bubblewrap.
Switch backend: hermes config set terminal.backend bubblewrap.
Check it: hermes doctor reports whether bwrap is found and the sandbox probe passes.
On Ubuntu 24.04 and later, the README points to an AppArmor restriction on unprivileged user namespaces if the probe fails. If bwrap is missing, commands are never run outside the sandbox.
What it hides and isolates
The host root is read-only; only the working directory is writable.
Each command gets a private process namespace, fresh /dev and fresh /tmp.
ssh-agent, gpg-agent, keyring and D-Bus sockets are unreachable, and the Docker socket is masked.
Dot entries in your home directory are hidden unless allowlisted, and credential stores like .ssh, .aws and .config/gh are always hidden.
The Hermes home is hidden, so a command can’t read its .env or auth files.
Memory, CPU time and process limits apply per command.
Hermes’s file tools (read_file, write_file, patch, search_files) run inside the sandbox too.
The three profiles
restricted: working directory read-only, no network. For inspection and read-only analysis.
workspace: working directory writable, no network. For builds and edits that must not reach the internet.
network: writable, shares the host network. The default.
Set it with hermes config set plugins.entries.bubblewrap.settings.profile workspace. Set terminal.cwd for each profile too, so the writable folder is a project folder, not your whole home directory.
If you run Hermes on Linux with the local backend, switch to bubblewrap with the workspace profile and a project folder as the working directory. It’s an easy safety upgrade with no Docker needed. That’s the simple case for Hermes Agent bubblewrap.
About Julian Goldie
I’m Julian Goldie — founder of Goldie Agency and the AI Profit Boardroom. I test new AI agents almost every day for 432K+ YouTube subscribers and run Hermes, OpenClaw, OpenCode, Claude and Codex side by side in my own Agent OS. Claim your free strategy session or join the AI Profit Boardroom.
