Hermes Agent Bubblewrap: The Linux Sandbox for Every Terminal Command

Hermes Agent bubblewrap is the official plugin that runs every terminal and execute_code command in its own bubblewrap sandbox on the machine Hermes runs on. It arrived as a one-command install in the v0.23.0 release, and its README says it is built and supported by Nous Research. It’s Linux only. My video is right under this intro.

What bubblewrap does

Bubblewrap (bwrap) is a small Linux sandboxing tool. The Hermes plugin is a terminal backend: instead of running commands straight on your machine, every command gets its own sandbox.

The README is clear that it is not a container. The sandbox sees the host filesystem read-only at the same paths, can write to the working directory, and can’t read your credentials. It needs no image, no daemon and no network round trip.

Why it exists

The configuration docs say the default local backend runs commands directly on your machine with no isolation. The Docker backend isolates more, but needs Docker and a container.

The README pitches bubblewrap for the gap in between: a personal machine or small server where local is too open and Docker is too heavy.

How to set it up

You need bubblewrap 0.9.0 or later, prlimit from util-linux and unprivileged user namespaces. Then:

• Install bwrap: sudo apt install bubblewrap (Debian, Ubuntu), sudo dnf install bubblewrap (Fedora) or sudo pacman -S bubblewrap (Arch).
• Add the plugin: hermes plugins install bubblewrap.
• Switch backend: hermes config set terminal.backend bubblewrap.
• Check it: hermes doctor reports whether bwrap is found and the sandbox probe passes.

On Ubuntu 24.04 and later, the README points to an AppArmor restriction on unprivileged user namespaces if the probe fails. If bwrap is missing, commands are never run outside the sandbox.

What it hides and isolates

• The host root is read-only; only the working directory is writable.
• Each command gets a private process namespace, fresh /dev and fresh /tmp.
• ssh-agent, gpg-agent, keyring and D-Bus sockets are unreachable, and the Docker socket is masked.
• Dot entries in your home directory are hidden unless allowlisted, and credential stores like .ssh, .aws and .config/gh are always hidden.
• The Hermes home is hidden, so a command can’t read its .env or auth files.
• Memory, CPU time and process limits apply per command.

Hermes’s file tools (read_file, write_file, patch, search_files) run inside the sandbox too.

The three profiles

• restricted: working directory read-only, no network. For inspection and read-only analysis.
• workspace: working directory writable, no network. For builds and edits that must not reach the internet.
• network: writable, shares the host network. The default.

Set it with hermes config set plugins.entries.bubblewrap.settings.profile workspace. Set terminal.cwd for each profile too, so the writable folder is a project folder, not your whole home directory.

What it doesn’t protect

The README lists the limits honestly:

• The rest of the host filesystem is readable, so keep secrets in the hidden paths.
• There’s no seccomp filter, so it’s not a defence against kernel exploits.
• Network is all or nothing: the network profile has no egress filtering.
• Background processes aren’t available, and Python state doesn’t carry over between execute_code calls.

For stronger isolation or a non-Linux machine, the Docker, SSH or cloud sandbox backends are the alternatives.

My verdict

If you run Hermes on Linux with the local backend, switch to bubblewrap with the workspace profile and a project folder as the working directory. It’s an easy safety upgrade with no Docker needed. That’s the simple case for Hermes Agent bubblewrap.

About Julian Goldie

I’m Julian Goldie — founder of Goldie Agency and the AI Profit Boardroom. I test new AI agents almost every day for 432K+ YouTube subscribers and run Hermes, OpenClaw, OpenCode, Claude and Codex side by side in my own Agent OS. Claim your free strategy session or join the AI Profit Boardroom.

Want another angle? Read the AI Profit Boardroom guide to Hermes Agent Bubblewrap.

FAQ: hermes agent bubblewrap

What is Hermes Agent bubblewrap?

It’s an official Hermes plugin that runs every terminal and execute_code command in its own bubblewrap (bwrap) sandbox on your Linux machine.

Is the bubblewrap plugin official?

Yes. Its README says it is built and supported by Nous Research, and the plugin catalog lists it in the official tier.

Does bubblewrap work on Mac or Windows?

No. It’s Linux only. On other systems, use the Docker, SSH or cloud sandbox backends.

Is bubblewrap the same as Docker?

No. The README says it is not a container: it uses your host paths read-only, with no image or daemon. Docker runs commands inside a container.

How do I turn on the bubblewrap backend?

Install bubblewrap, run hermes plugins install bubblewrap, then hermes config set terminal.backend bubblewrap. hermes doctor checks the setup.

Can sandboxed commands reach the internet?

Under the default network profile, yes, with no egress filtering. The restricted and workspace profiles have no network.

Related reading

• Hermes Agent Sandbox
• Hermes Agent Docker
• Hermes Vault

Last updated November 2026. This page is a living guide to hermes agent bubblewrap — the facts here move fast and it is updated as they do.