--yolo switch removes approval prompts, which is safe to use precisely because the box is the boundary.
Prerequisites
- The
boxlitePython package and a machine with hardware virtualization — see Installation. - An API key for a provider Hermes supports.
- Room for the image: it is roughly 900 MB, and a 12 GB box disk measured 26% used after it unpacked. The first pull dominates start-up time.
Quick Example
One non-interactive prompt.-z takes the prompt and exits; --yolo skips the approval prompts that would otherwise block an unattended run.
exit=0 with the answer on stdout. Allow generously for the first run — pulling and unpacking the image took the bulk of the elapsed time.
What the image gives you
Checked from inside a running box:Parameters and Returns
Fromhermes --help inside the image:
Subcommands include
chat, model, secrets, egress, gateway, proxy, setup, and messaging integrations. hermes gateway run starts the messaging gateway in the foreground; gateway also has start / stop / status for supervised operation.
Running the gateway behind a forwarded port
For chat over Telegram, Discord, and similar, run the gateway instead of one-shot prompts and forward its port. The service must bind all interfaces — a forwarded port arrives at the guest’s network interface, not its loopback:hermes gateway setup before relying on it; the flags it needs depend on which messaging platform you connect.
Why --yolo belongs in a box
Hermes asks for approval before dangerous commands, which is the right default on a laptop and a blocker for anything unattended. --yolo removes those prompts. Inside a box that trade is sound: the agent can do whatever it wants to a disposable VM, and the host is untouched.
What that does not cover is the network. An agent with unrestricted egress can still send data out. Narrow it when the task is not fully trusted:
Secret the real key stays on the host and the box sees only a placeholder — see Secrets and hardening. Hermes also has its own hermes egress subcommand; the box-level allowlist and the agent-level control are independent, and the box-level one is the boundary you can rely on.
Troubleshooting
Related
- Preview a sandboxed web app — the general shape of forwarding a long-running service out of a box.
- Run Pi — a CLI you install into a box rather than a prebuilt image.
- Secrets and hardening — keeping the provider key outside the sandbox.

