How to self-host Hermes Agent: VPS setup, Docker, or its own computer

Docker container, or Hermes on its own computer?

Nous's Docker guide splits Docker into two jobs. Running Hermes in Docker puts the whole agent inside nousresearch/hermes-agent, with your config and keys on a host folder mounted at /opt/data. Docker as a terminal backend leaves Hermes on the host and only sandboxes the shell commands the agent runs. Same word, different blast radius.

Hivra is not affiliated with Nous Research. On Hivra Cloud, Hermes runs from Hivra's maintained image ghcr.io/ashneil12/vanilla-hermes-agent, not from the Nous release on Docker Hub. Hermes does not run on My cloud or My server (ownServer is false for Hermes in Hivra's launch contracts), so do not treat a bring-your-own Hetzner project as a Hermes path here. OpenClaw, Claude Code, Codex and Agent Zero can use your own server. Hermes cannot.

Before you start: do you actually want to self-host?

Self-hosting makes sense if you want the data on your disk, you are already comfortable with Linux, you have a compliance reason to run it yourself, or you want to change how the agent behaves at the edges. The project is open source, so that path is real.

Skip the VPS path if your time is expensive, you want to be chatting today, or you would rather spend the evening on the work the agent will do. Hivra starts a Hermes agent from the dashboard, with the computer and messaging gateway already wired, and chat in the browser. The rest of this guide is for people who still want the server under their own SSH key.

What you need before the VPS path: Ubuntu 24.04 LTS (fresh install preferred), SSH as a user who can sudo, an API key from at least one LLM provider, and a Telegram account if you want the gateway. A domain helps for a public web UI. It is optional for Telegram alone.

Server requirements

Minimum: 2 vCPU, 4 GB RAM, 20 GB SSD. That runs Hermes with Docker available for sandboxed commands. Hetzner's CX23 at €5.49/month excluding VAT is the community budget option many people quote. DigitalOcean's 4 GB Basic Droplet is dearer for the same floor. Hostinger KVM 2 with 8 GB RAM shows up in setup threads when people want more RAM on one server.

Recommended: 4 vCPU, 8 GB RAM, 40 GB SSD. Extra RAM matters if you run Ollama beside the agent, or you turn on the Docker terminal backend and browser tools at once. 4 GB is the hard floor: below it, complex tasks hit OOM. OS: Ubuntu 24.04 LTS. Nous's install docs target that. Debian 12 can work if you are happy fixing the gaps yourself.

Phase 1: server preparation

SSH into your VPS as root. Update the system:

Create a non-root user for Hermes. Running as root is a bad habit on a machine that will hold API keys:

Copy your SSH keys to the new user:

Switch to that user and stay there:

Turn the firewall on before you publish anything:

Phase 2: Docker installation

You need Docker either as the terminal backend or as the runtime for the official image. Install from Docker's own Ubuntu repo, not the distro package:

Add the hermes user to the docker group:

Check it:

If you see a permission error, log out and back in. newgrp docker only fixes the current shell.

Phase 3: install Hermes on the VPS

Nous's installation page gives a one-line source install for Linux, macOS and WSL2:

Reload your shell, then check the binary:

hermes doctor checks Docker, Python, dependencies and write access under ~/.hermes/. Fix what it flags before you go on.

Run the setup wizard:

It asks for the LLM provider and writes the first files under ~/.hermes/ (.env, config, memory). Keep those. If you already use Nous Portal, hermes setup --portal is the short path Nous documents for provider plus Tool Gateway in one go.

Running Hermes inside Docker instead

If you want the agent itself in a container, Nous's Docker guide starts with a host data directory and an interactive setup:

That writes keys into ~/.hermes/.env on the host. The image is meant to be stateless. Your config, sessions and memories live on the mounted volume, so a later docker pull does not wipe them.

For a gateway that stays up:

Port 8642 is the OpenAI-compatible API and health endpoint inside the official image. Skip publishing it if you only need Telegram or Discord. Nous's guide also documents HERMES_DASHBOARD=1 with port 9119 when you want the built-in dashboard beside the gateway. Tags on Docker Hub include latest / stable, main, and version pins. Use a digest when you need an exact deploy. Nous warns against pasting these commands into some browser-based VPS consoles, because characters like : can corrupt. Use SSH.

Compose is fine once the volume and image tag are clear. The failure mode people hit is docker compose down recreating a fresh volume and an empty agent. Named volumes and a quick check before recreate save that. For the pain points around browser libraries and updates, the older self-hosting notes still help. This page stays the install owner.

Phase 4: LLM provider and the Docker terminal backend

OpenRouter is a common starting point: one key, many models. Put the key in the env file with tight permissions:

Set a default model with hermes config set, then smoke-test:

If Hermes itself runs on the host and you want shell commands sandboxed, set the terminal backend (this is Docker-as-backend, not Hermes-in-Docker):

On a 4 GB VPS, watch free -h before you enable that backend and browser tools together. The sandbox needs headroom.

Phase 5: Telegram gateway setup

Create a bot with @BotFather, copy the token, and get your numeric user id from @userinfobot.

Without the allowlist, anyone who finds the bot can talk to it. Test with hermes gateway, send a message, then Ctrl+C. The longer Telegram walkthrough lives in how to set up Hermes Agent on Telegram.

Phase 6: run as a persistent service

On the host install path, a gateway in an SSH session dies when the session dies. Install the user service:

Follow logs with journalctl --user -u hermes-gateway -f. After a reboot, if the service never comes back, enable linger so the user service can run without a login:

On the container path, --restart unless-stopped (or the Compose equivalent) is the keep-alive. Inside the current official image, Nous says gateway run is supervised by s6-overlay so a crashed gateway restarts inside the same container. Older tini-based images behaved differently. Read the date on the Docker guide before you assume which one you pulled.

Common errors and fixes

Permission denied on Docker after adding the group: log out and back in, or newgrp docker.

hermes: command not found after install: source ~/.bashrc.

hermes doctor still unhappy: run the project's update path, then re-check. Missing Python packages usually mean the install did not finish.

Telegram silent: token whitespace, wrong numeric user id, or gateway logs with the real error.

OOM on tasks: stay at 4 GB or above.

API errors after a good start: check the provider dashboard for spend limits.

Empty memory after a Compose recreate: confirm the named volume still mounts at /opt/data before you celebrate the new container.

The self-hosting calculation

Server cost: a CX23-class VPS around €5.49/month excluding VAT. LLM API: often $5-50/month depending on how hard you push it. First setup: a few hours when it goes well. Upkeep: under an hour most months. At $50/hour, one painful evening of debugging already covers many months of Hivra's $9.99 plan (2 vCPU and 4 GB of RAM).

Self-hosting wins when you like Linux, you will keep the agent for a long stretch, and you care about holding the disk yourself. It loses when updates break at a bad time or when the infrastructure work crowds out the actual tasks. Hivra is the managed alternative: Hermes from Hivra's maintained build, on its own private computer, without a compose file for you to babysit. If you would rather skip the install, that is what it is for.