Hermes Agent

Hermes Agent’s source installer brings in a large Python, Node.js, browser, and media toolchain. Use the official image instead: it contains the complete application and stores mutable state under /opt/data.

The official image uses s6-overlay. --init auto is required so its /init entrypoint becomes guest PID 1 rather than running as an ordinary child process. The image is approximately 900 MB compressed and can require several gigabytes of temporary free space during its first pull.

Set up Hermes Agent

Run setup

msb run -t --name hermes-setup --replace \
  --cpus 2 --memory 4G --root-disk 2G \
  --mount-named hermes-data:/opt/data \
  --init auto \
  nousresearch/hermes-agent:v2026.7.20 -- setup

msb run -t --name hermes-setup --replace `
  --cpus 2 --memory 4G --root-disk 2G `
  --mount-named hermes-data:/opt/data `
  --init auto `
  nousresearch/hermes-agent:v2026.7.20 -- setup

Follow the setup wizard to configure a model provider and any messaging integrations. Everything written to /opt/data survives sandbox replacement in the hermes-data volume.

Verify the installation

After setup exits, inspect the pinned image directly:

msb run --name hermes-version --replace \
  --entrypoint hermes \
  nousresearch/hermes-agent:v2026.7.20 -- --version

msb run --name hermes-version --replace `
  --entrypoint hermes `
  nousresearch/hermes-agent:v2026.7.20 -- --version

The tested image reports Hermes Agent v0.19.0 (2026.7.20).

Run the gateway API

Generate an API key in the host shell:

export HERMES_API_KEY="$(openssl rand -hex 32)"

$bytes = New-Object byte[] 32
$rng = [Security.Cryptography.RandomNumberGenerator]::Create()
$rng.GetBytes($bytes)
$rng.Dispose()
$env:HERMES_API_KEY = -join ($bytes | ForEach-Object { $_.ToString('x2') })

Recreate Hermes as a detached, supervised gateway:

msb run -d --name hermes-gateway --replace \
  --cpus 2 --memory 4G --root-disk 2G \
  -p 127.0.0.1:8642:8642 \
  -e API_SERVER_ENABLED=true \
  -e API_SERVER_HOST=0.0.0.0 \
  -e API_SERVER_KEY="$HERMES_API_KEY" \
  --mount-named hermes-data:/opt/data \
  --init auto \
  nousresearch/hermes-agent:v2026.7.20 -- gateway run

msb run -d --name hermes-gateway --replace `
  --cpus 2 --memory 4G --root-disk 2G `
  -p 127.0.0.1:8642:8642 `
  -e API_SERVER_ENABLED=true `
  -e API_SERVER_HOST=0.0.0.0 `
  -e "API_SERVER_KEY=$env:HERMES_API_KEY" `
  --mount-named hermes-data:/opt/data `
  --init auto `
  nousresearch/hermes-agent:v2026.7.20 -- gateway run

Port 8642 is published only on host loopback. Watch the supervised gateway start with:

msb logs -f hermes-gateway

Do not expose the API or dashboard on a public interface without a supported authentication provider and TLS. Hermes refuses several unsafe configurations, but host-level port exposure is still your responsibility.

Clean up

Remove the setup, version-check, and gateway sandboxes:

msb rm -f hermes-setup hermes-version hermes-gateway

Remove persisted Hermes state only when you no longer need it:

msb volume rm hermes-data

Clear the API key from the host shell:

unset HERMES_API_KEY

Remove-Item Env:HERMES_API_KEY

Keep hermes-data to preserve configuration, sessions, memories, skills, and credentials.

Reference

Hermes Agent Docker image guide

Agents

CI/CD

Docker

Sandbox Workflows

Automation & Tooling

Data & Observability

Set up Hermes Agent

Reference

​Set up Hermes Agent

​Reference

Set up Hermes Agent

Reference