Skip to main content
Hermes bundles its own Python runtime, tooling, and a supervised process tree, so there is nothing to install: point a box at the published image and it is ready. Its --yolo switch removes approval prompts, which is safe to use precisely because the box is the boundary.

Prerequisites

  • The boxlite Python package and a machine with hardware virtualization — see Installation.
  • An API key for a provider Hermes supports.
  • Room for the image: it is roughly 900 MB, and a 12 GB box disk measured 26% used after it unpacked. The first pull dominates start-up time.

Quick Example

One non-interactive prompt. -z takes the prompt and exits; --yolo skips the approval prompts that would otherwise block an unattended run.
Verified inside a box on macOS (Apple Silicon) against an Anthropic-compatible endpoint: the prompt returned exit=0 with the answer on stdout. Allow generously for the first run — pulling and unpacking the image took the bulk of the elapsed time.

What the image gives you

Checked from inside a running box:

Parameters and Returns

From hermes --help inside the image: Subcommands include chat, model, secrets, egress, gateway, proxy, setup, and messaging integrations. hermes gateway run starts the messaging gateway in the foreground; gateway also has start / stop / status for supervised operation.

Running the gateway behind a forwarded port

For chat over Telegram, Discord, and similar, run the gateway instead of one-shot prompts and forward its port. The service must bind all interfaces — a forwarded port arrives at the guest’s network interface, not its loopback:
Configure the gateway with hermes gateway setup before relying on it; the flags it needs depend on which messaging platform you connect.

Why --yolo belongs in a box

Hermes asks for approval before dangerous commands, which is the right default on a laptop and a blocker for anything unattended. --yolo removes those prompts. Inside a box that trade is sound: the agent can do whatever it wants to a disposable VM, and the host is untouched. What that does not cover is the network. An agent with unrestricted egress can still send data out. Narrow it when the task is not fully trusted:
With Secret the real key stays on the host and the box sees only a placeholder — see Secrets and hardening. Hermes also has its own hermes egress subcommand; the box-level allowlist and the agent-level control are independent, and the box-level one is the boundary you can rely on.

Troubleshooting