Hermes Agent

the problem

An agent that can call tools and run shell commands is genuinely useful and genuinely dangerous. I wanted one reachable from anywhere, but with its ability to do damage bounded by design rather than by hope.

architecture

A Telegram bot is the gateway — the only way in. Messages reach a Python agent that plans and calls tools. The agent core runs inside a rootless Docker container supervised by systemd on a hardened Linux host, so the process has no path to root on the machine it runs on.

engineering decisions

• → Rootless Docker over a normal daemon

  The agent can execute shell commands, so a container breakout must not hand an attacker root on the host. Running rootless removes that ceiling entirely.

• → systemd for lifecycle, not a process manager in the app

  Supervision, restart-on-failure, and boot ordering are the operating system's job. Keeping them out of the agent code leaves it a single-responsibility program.

• → A single, narrow gateway

  Exposing exactly one Telegram entry point keeps the attack surface small and the auth model simple, instead of standing up a web service to defend.

reliability & security

The whole point is a controlled blast radius: an agent with shell access deserves one. Rootless containers, OS-level supervision, and a hardened host mean a compromised tool call is contained, not catastrophic.

constraints

Self-hosted on my homelab, maintained by one person. The design favors mechanisms that stay correct while unattended over anything that needs babysitting.