Question 1

What is the difference between running Hermes Agent IN Docker vs Docker as a terminal backend?

Accepted Answer

Running Hermes IN Docker means the agent process lives inside the container; it can execute commands and touch files you mount. This is the standard approach. Docker as a terminal backend (`terminal.backend: docker`) creates a new isolated container for each command, then destroys it. This is more secure but has higher overhead and loses state between commands. Choose IN Docker for most use cases; use Docker-backend only if you need maximum isolation for untrusted agent logic.

Question 2

How do I set up persistent memory so Hermes Agent remembers things after restart?

Accepted Answer

Mount a volume to `/opt/data` in the container. In docker-compose.yml, add `- ~/.hermes:/opt/data` under the `volumes` section. The Hermes Agent stores all memory, skills, and user interactions in `.hermes` on your host. When the container restarts, it reads from the same directory. Your agent's learned skills and memory survive updates, reboots, and container replacements.

Question 3

Is managed Hermes Agent Docker hosting more expensive than self-hosted on a VPS?

Accepted Answer

No, but it depends on your cost breakdown. A bare VPS costs $5-$20/month; managed Docker hosting on Opsily costs more because we handle SSL, backups, monitoring, and updates. If your time is worth something, managed hosting saves money. If you enjoy managing servers and reverse proxies, a cheap VPS is a fine choice. The real cost difference is your operational labor.

Question 4

How does privilege escalation and security scanning work with Hermes Agent Docker?

Accepted Answer

Hermes Agent runs as the non-root `hermes` user inside the container, so it cannot modify system files even if it tries. For command approval, integrate Tirith scanner: it scans each proposed terminal command before execution against your policies. You can auto-allow safe reads, require approval for code execution, and block dangerous categories entirely. Tirith prevents runaway agents from causing damage.

Question 5

Can I run multiple Hermes Agent profiles in one Docker container?

Accepted Answer

Yes. Define multiple profiles in `.hermes/config.yaml`, and they all run under the same container process, supervised by s6-overlay. Each profile gets its own dashboard tab, API endpoint, and messaging integrations. If one profile crashes, s6 restarts it without affecting others. This is more efficient than running separate containers per profile.

Question 6

What if I want to migrate my Hermes Agent from another host or from OpenClaw?

Accepted Answer

Use the `hermes claw migrate` command. It imports your OpenClaw setup (persona, memory, skills, and credentials) into Hermes Agent. On Opsily, we handle the migration for you: upload your export, and we import it to your managed instance. No data loss, no downtime.

Question 7

How often are Docker images updated, and do I need to rebuild the container?

Accepted Answer

Nous Research releases updates to the Hermes Agent Docker image regularly. On a self-hosted setup, you pull the latest image and restart the container (`docker compose pull && docker compose up -d`). On Opsily, we auto-deploy updates and handle the restart. Backups are created before any migration, so you can roll back if needed.

Question 8

How often are Hermes Agent Docker images updated, and how do I update via docker-compose?

Accepted Answer

Nous Research releases updates regularly. With docker-compose, run `docker compose pull` to fetch the latest Hermes Agent image, then `docker compose up -d` to restart the container with the new version. On Opsily, we automate this entirely: updates are applied without downtime, and backups are created before migration so you can roll back if needed.

Question 9

Do I need a reverse proxy like Caddy or Nginx?

Accepted Answer

Only if you want public HTTPS access. For local development or VPN-only access, you can bind directly to the ports and skip the proxy. For production, a reverse proxy is essential: it terminates HTTPS, auto-renews certificates (Caddy), hides internal port numbers, and simplifies DNS management. On Opsily, Caddy is pre-configured.

Question 10

What are the CPU and memory requirements for Hermes Agent in Docker?

Accepted Answer

Minimum: 1 vCPU and 1 GB RAM. Comfortable: 2 vCPU and 2 GB RAM. With browser automation (Playwright/Chromium), budget 4 GB. The docker-compose.yml template includes `mem_limit: 2g` and `cpus: 1` as safe defaults; adjust based on your tools and concurrency. Opsily plans scale automatically.

Question 11

Can I export my data and self-host Hermes Agent elsewhere?

Accepted Answer

Yes. Hermes Agent is open-source (MIT license) and runs anywhere Docker is available. Your data in `.hermes` (memory, skills, credentials) is portable. Download a backup from Opsily, extract it, and run the agent on your own server, another host, or locally. No vendor lock-in.

Hermes Agent Docker: Run AI Agents in Containers

Overview

Frequently Asked Questions

Ready to Deploy?