Hermes Agent on a Personal Computer: Security, Sandboxing, Automation and Reliability Lessons from a Windows/Docker Practitioner Case Study
Frankie Mak - Independent Researcher and Technology Practitioner
MBA | Graduate Certificate in Cyber Security
Australia
Contact: frankiemak.research@gmail.com
Version 1.0 - Public Release | 24 September 2026
Overview
This repository contains a de-identified practitioner case study examining the deployment and hardening of the open-source Hermes Agent on a personal Windows computer. Personal deployment identifiers, credentials, private infrastructure details, and private conversation links have been intentionally excluded from the public artifacts.
The study focuses on OS-level isolation, Docker sandboxing, scheduled automation, Windows path translation, UTF-8 reliability, gateway and Telegram exposure, NAS read-only objectives, credential minimization, and reproducibility.
The report is an independent practitioner case study, not a claim of statistically generalizable experimental results or peer-reviewed findings.
Publication artifacts
- Full research report (Markdown)
- Full research report (PDF)
- Editable research report (DOCX)
- Public-release privacy checklist
- Proposed reproducibility and validation matrix
- Logical architecture diagram
- References
Core findings
The case indicates that security for personal AI agents is primarily an architectural problem. Containerization can reduce the blast radius of shell and file operations, but the effective boundary depends on what remains outside the container, which host paths are mounted, which credentials are exposed, and how network-facing adapters are authorized. Scheduled automation and messaging increase the importance of deterministic inputs, least privilege, observability, and recovery. Windows-specific path and encoding behavior can also become security-relevant when it changes file targets, data integrity, or delivery.
Evidence and limitations
The case narrative is based on retained technical conversation context plus public Hermes, Docker, and OWASP documentation and issue reports reviewed on 24 September 2026. The underlying private conversation pages were not treated as public source documents. The study is therefore evidence-bounded and architectural/methodological rather than a statistically generalizable experiment or forensic reconstruction.
Reproducibility
The repository includes a proposed test matrix. Actual results are explicitly labeled as observed practitioner outcomes and should not be treated as universal guarantees. Reproduction on another system should independently validate each control.
Citation and license
See CITATION.cff for machine-readable citation metadata. The written research content is licensed under CC BY 4.0.