Hermes Agent Bubblewrap - Explained Simply

Hermes Agent bubblewrap is a new official plugin from Nous Research that runs every terminal and code command your agent makes inside its own bubblewrap (bwrap) sandbox on your Linux machine. Your files stay at their normal paths but read-only, only the working directory is writable, and credential stores like .ssh and .aws are hidden. It needs no container, no image and no daemon.

📺 Watch: NEW Hermes Agent OS Updates are WILD!

🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside

It arrived with Hermes Agent v0.23.0, "The Hearth Release", on 5 November 2026. The release notes describe it as "a Linux sandbox for terminal and code commands" and list it among the new one-command installs.

If you want to learn to run Hermes safely for your business, the AI Profit Boardroom has Hermes courses, daily updates and weekly coaching calls.

What Hermes Agent bubblewrap actually is

Hermes has terminal backends. The backend decides where the agent's shell commands run. The default is local, with no isolation. My Hermes Agent sandbox guide covers the Docker route and the other isolated backends.

Bubblewrap is a new option in between. The plugin README puts it plainly: "It is not a container." The sandbox sees the host filesystem read-only at the host paths, can write to the working directory, and cannot read your credentials.

Nous says it fits "a personal machine or a small server where the local backend is too open and Docker is too heavy." That's the gap it fills.

Key facts from the catalog entry and README:

Official tier. It sits in Nous Research's official plugins repo, "built and supported by Nous Research."
Linux only. It needs bubblewrap 0.9.0 or later, prlimit from util-linux and unprivileged user namespaces (or a setuid bwrap).
Hermes 0.22.6 or later. The catalog pins plugin version 1.3.0.
No network calls of its own. It runs your commands through the bwrap and prlimit binaries you install.

Why Hermes Agent bubblewrap matters for a small business

Most small businesses run their agent on a laptop or one cheap server. On the local backend, the agent has the same access as your user account. That includes SSH keys, cloud logins and saved tokens.

Docker fixes that, but it adds an image, a daemon and a container to manage. A lot of owners never set it up, so the agent keeps full access.

Here's the old way versus the new way. The old way: run the agent locally and hope it never touches the wrong file. The new way: install one plugin, set one config key, and every command runs read-only except the project folder you choose.

If you are picking a server for this, my guide to the best Hermes Agent VPS covers Linux hosting options.

📺 Watch: NEW Hermes Agent is Absolutely INSANE!

How to set up Hermes Agent bubblewrap step by step

Install bubblewrap. On Debian or Ubuntu run sudo apt install bubblewrap. On Fedora, sudo dnf install bubblewrap. On Arch, sudo pacman -S bubblewrap.
Install the plugin. Run hermes plugins install bubblewrap.
Switch the backend. Run hermes config set terminal.backend bubblewrap. You can also pick it in hermes setup once the plugin is installed.
Check it works. Run hermes doctor. It reports whether bwrap is found, its version and whether the sandbox probe passes.
Fix a failed probe. If the probe fails, unprivileged user namespaces are disabled for your user. The README says that on Ubuntu 24.04 and later this is the AppArmor kernel.apparmor_restrict_unprivileged_userns restriction.
Pick a profile. Run hermes config set plugins.entries.bubblewrap.settings.profile workspace, using restricted, workspace or network. The default is network.
Raise limits if builds fail. The defaults are tight. The README says pip, node, cargo and most compilers need more than 256 MB, so set memory_mb to 1024 or 2048. Long builds may need a higher cpu_seconds.

In Hermes Desktop the same settings sit under Settings, Plugins, Bubblewrap. If bwrap goes missing later, the README says commands are never run outside the sandbox. The terminal tool returns a degraded result that names the package instead.

Not sure if your setup needs this or Docker? Book a free AI strategy session and we'll work it out.

📺 Watch: New FREE Hermes Computer Use Agents!

What Hermes Agent bubblewrap isolates and what it doesn't

This table comes from the plugin README.

Area	Isolated	Not isolated
Filesystem	Host root read-only; only the working directory is writable	Anything your user can read outside the hidden set stays readable
Credentials	Home dot entries hidden unless allowlisted; .ssh, .aws, .gnupg, .kube, .docker, .netrc, .npmrc, .git-credentials, browser profiles and keyrings always hidden	Secrets kept inside project folders
Hermes home	Hidden, so a sandbox can't read the default .env or auth.json	Its own state and scratch folders stay reachable
Processes	Private pid namespace and /proc; fresh /tmp and /dev per command	No background processes; no persistent code kernel
Sockets	ssh-agent, gpg-agent, keyring, D-Bus and docker socket masked	Other Unix sockets stay connectable
Network	restricted and workspace profiles get loopback only	network profile shares the host network with no egress filtering
Resources	Per-process memory, CPU and process limits	No cgroup limits; no seccomp filter

The README is clear that this is "a filesystem and process boundary, not a defense against kernel exploits."

Hermes Agent bubblewrap profiles and settings

All settings live under plugins.entries.bubblewrap.settings. There are three profiles:

restricted: read-only working directory, no network. For inspection and read-only analysis.
workspace: writable working directory, no network. For builds and edits that must not reach the network.
network: writable working directory and the host network. The default.

The other keys are memory_mb (default 256), cpu_seconds (default 30), max_procs (default 256), binds for extra host folders, and home_allow for extra dot entries you want visible read-only. A value of 0 disables a limit. The writable folder is set by terminal.cwd.

Hermes' file tools (read_file, write_file, patch, search_files) run inside the sandbox too. Dangerous-command approval still applies, as it does for the local backend.

Hermes Agent bubblewrap workflows you can copy

These are illustrations of how a small business might use each profile.

Audit a client project without risk

Set the profile to restricted and point terminal.cwd at the project folder. Then prompt:

Read this project and list every file that handles customer data. Do not change anything.

Nothing can be written and nothing can reach the network.

Offline edits to a site build

Use workspace when the agent should edit and build but not call out. Raise memory_mb to 2048 first if the build uses node. Then prompt:

Fix the broken links in this folder, run the build, and tell me what changed.

Scheduled jobs on a small server

Keep the network profile for jobs that need the web, such as a daily research summary. Credentials stay hidden while commands still reach the internet. Set the job up with my Hermes Agent cron job guide. Note that background processes die on this backend, so long-running dev servers need another backend.

For support or sales agents on a shared server, see Hermes Agent for customer support and Hermes Agent for sales. To check what your jobs are doing, the new Hermes Agent inbox lists them in one view.

Inside the AI Profit Boardroom you get Hermes setups like these, plus my Agent OS and live coaching.

Hermes Agent bubblewrap limits and safety

Linux only. No macOS or Windows support is listed.
Network is all or nothing. The default network profile has no egress filtering.
Not a kernel boundary. No seccomp filter and no cgroup limits.
Tight defaults. Expect failed installs or builds until you raise memory_mb and cpu_seconds.
No background jobs. A background command dies right after it starts.
Keep secrets out of project folders. Only the hidden paths are protected.

If you need full container isolation or per-session sandboxes, Docker is still the stronger choice. My Hermes Agent Docker guide covers that setup. If you want someone to check which one fits, book a free AI strategy session.

For how I run Hermes day to day, read my Agent OS guide. For how I test models, see Goldie Bench.

Hermes Agent bubblewrap FAQ

Does Hermes Agent bubblewrap work on Mac or Windows?

No. The README says "Linux only", and the catalog lists linux as the only platform.

Is bubblewrap the same as the Docker sandbox?

No. Bubblewrap is not a container. It runs commands on your machine at the host paths, read-only except the working directory. Docker runs them inside a separate container.