Bubblewrap
Bubblewrap terminal backend for Linux: every terminal and execute_code command runs in its own bwrap sandbox on this machine at the host's own paths, with a read-only root, a writable working directory (per profile: restricted, workspace or network), SSH keys, cloud credentials and the Hermes home hidden, private temp and process directories, agent and docker sockets masked, and per-command memory, CPU and process limits (`hermes config set terminal.backend bubblewrap`). Disclosure — no Python dependencies and no network calls of its own: it runs your commands through the `bwrap` and `prlimit` binaries you install (bubblewrap, util-linux), and under the default `network` profile those commands share the host network. It reads no credentials. File tools (read_file, write_file, patch, search_files) still run on the host and are not confined, and because the working directory is a real host directory Hermes keeps its dangerous-command prompts, as for the local backend.
Requires Hermes >=0.22.2. Platforms: linux. Version 1.0.0 at import.
hermes plugins install bubblewrap