**Hermes Container Hardening** is the set of Docker security flags and resource limits that 📝Hermes Agent applies to every container when terminal commands run on the docker backend.
Container isolation is one of eight layers in the Hermes security model, which the docs describe as Docker and Modal sandboxing, plus the Singularity plugin, with hardened settings. On the Docker backend, defined in tools/environments/docker.py, each container drops all Linux capabilities and adds back only DAC_OVERRIDE, CHOWN and FOWNER, so root can write to bind-mounted directories and package managers can set file ownership. The no-new-privileges option blocks privilege escalation, a PID limit caps the process count, and /tmp and /var/tmp are size-limited tmpfs mounts, with /var/tmp mounted no-exec. The container filesystem itself stays writable so agents can install packages.
Resources and persistence are set under terminal in ~/.hermes/config.yaml, where memory defaults to 5 GB and disk to 50 GB. Persistent mode bind-mounts /workspace and /root from ~/.hermes/sandboxes/docker/; ephemeral mode uses tmpfs and loses everything on cleanup. An empty docker_forward_env allowlist keeps secrets out of the container, and any variable named there is readable by code inside it.
Because the container is the security boundary, Hermes skips its dangerous-command check on the Docker backend, as it does on Modal, Daytona, Vercel Sandbox and the Singularity and Sprites plugins, while the local and SSH backends keep it. The docs recommend a containerized or cloud 📝sandbox backend for production gateway deployments to isolate agent commands from the host.