Bubblewrap
Bubblewrap terminal backend for Linux: every terminal and execute_code command runs in its own bwrap sandbox on this machine at the host's own paths, with a read-only root, a writable working directory (per profile: restricted, workspace or network), the dot entries of the home directory (credential stores always) and the Hermes home hidden, private temp and process directories, agent and docker sockets masked, and per-command memory, CPU and process limits (`hermes config set terminal.backend bubblewrap`).
Good to know before installing
No Python dependencies and no network calls of its own: it runs your commands through the `bwrap` and `prlimit` binaries you install (bubblewrap, util-linux), and under the default `network` profile those commands share the host network. It reads no credentials. File tools (read_file, write_file, patch, search_files) still run on the host and are not confined, and because the working directory is a real host directory Hermes keeps its dangerous-command prompts, as for the local backend.
From the plugin's catalog listing.
How to install
- Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
hermes plugins install bubblewrap - Said no? Turn it on later:
hermes plugins enable bubblewrap - Restart Hermes so it loads the plugin.
Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide (opens in a new tab).
- Category
- Coding & developer tools
- Maintained by
- NousResearch (Official)
- Needs
- No API keys declared
- Works on
- linux
- Needs Hermes
- 0.22.2 or newer
- Version
- 1.2.1
- In the catalog
- 2026-10-21, updated 2026-10-23
- GitHub stars
- 515
Full setup & settings ↗Source code ↗
More in coding & developer tools
All coding & developer tools plugins
New Hermes Agent updates every day on X. Follow @HermesWatcher