How to Host Hermes Agent on a Linux VPS

For most Linux VPS deployments, install Hermes Agent with its official POSIX installer when it needs direct access to host tools. Choose Docker when you want an isolated, replaceable container. Linux x86_64 and aarch64 are Tier 1 targets for both approaches. Start with 1 GB RAM and 1 vCPU for light use; allocate 2–4 GB RAM and 2 vCPUs for browser automation or several concurrent tasks. Keep Hermes’ data directory private, expose only the ports you actually need, and run the gateway with a restart policy or a dedicated service account.

Antihost offers VPS plans with one-click Hermes Agent, NVMe storage and a 14-day free trial.

Choose native installation or Docker first

Hermes Agent supports Linux x86_64 and aarch64 as Tier 1 platforms. The two supported deployment styles solve different operational problems: a native install integrates with the VPS user account and host tools, while Docker isolates Hermes in a container that can be replaced without moving its persistent data.

#	Preview	Product	Price
1		TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for...	$13.98	Buy on Amazon
2		Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen...	$17.99	Buy on Amazon
3		New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord	$8.99	Buy on Amazon
4		BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees	$199.99	Buy on Amazon
5		Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide...	$19.98	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

If this is a single-purpose VPS and Hermes needs local command-line tools, native installation is usually the shortest path. If your team already operates containers, Docker makes rollback and replacement more predictable.

Prepare the Linux VPS

Use SSH, not a browser console

Connect with SSH for installation and administration. Browser-based consoles can corrupt characters in volume mounts, environment variables, and API keys, which is especially risky when copying Docker commands. Use a normal SSH client, keep the terminal session open until setup finishes, and verify every command before pressing Enter.

#1 Best Overall

Sale

TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black

• [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
• [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
• [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
• [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
• [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

$13.98

Buy on Amazon

Choose a service account

Do not run a long-lived native gateway as root. Create a dedicated unprivileged Linux user when practical, and run the installer while logged in as that user. The installation documentation explicitly says to run the source installer as the intended service user. That account should own its home directory, the Hermes tool store, configuration, launcher, and persistent data.

When a Linux user service must continue after logout, enable lingering for that account:

sudo loginctl enable-linger SERVICE_USER

Replace SERVICE_USER with the actual account name. This is separate from SSH session persistence: lingering allows the user service manager to remain active after the user disconnects.

Size memory, CPU, and disk

These figures come from the Hermes Docker setup documentation. Browser automation is the most memory-intensive feature named there. If you expect multiple simultaneous conversations, file processing, or browser sessions, select the recommended tier rather than the minimum and monitor swap and available disk space.

Install Hermes natively with the POSIX installer

Run the installer as the account that will operate Hermes. The official command downloads the current installer, creates a launcher in ~/.local/bin, prepares the default ~/.hermes data directory, and bootstraps the runtimes Hermes needs.

1. Connect as the intended service user over SSH.

2. Run the official installer:

   curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

3. Reload the shell path and confirm the command is available:

   ×Worth Installing

   Windows Errors? Fix Them Before They Spread

   Outbyte PC Repair · freeRepair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFix My PC Now →
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

   export PATH="$HOME/.local/bin:$PATH"
   source ~/.bashrc
   hermes doctor

4. Select a model provider and complete the interactive setup:

   Rank #2

   Sale

   

   Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)

   • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
   • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
   • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
   • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
   • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

   $17.99

   Buy on Amazon

   hermes model
   hermes setup

The installer checks out Hermes under ~/.hermes/hermes-agent/ and exposes the hermes wrapper through ~/.local/bin. It bootstraps uv and uses its package manager to prepare pinned Python, Node.js, npm, ripgrep, and FFmpeg components. Browser and computer-use dependencies are optional; omit them on a small VPS with the installer flags below when you do not need those capabilities.

Useful unattended-install options

• --non-interactive runs installation without prompts, which is useful for provisioning scripts.
• --skip-browser omits browser automation dependencies and reduces initial resource and disk use.
• --skip-computer-use omits computer-use tooling when the VPS will only handle text, messaging, or API work.

After hermes doctor reports a healthy installation, use hermes model to select or change the provider. The setup wizard writes provider credentials to the persistent Hermes data directory. Treat that directory as secret material: it can contain API keys, sessions, skills, memories, and configuration.

Configure messaging and gateway operation

Use the installed CLI’s gateway setup flow for Telegram, Discord, Slack, WhatsApp, or another supported integration:

hermes gateway setup

Follow the prompts for each channel you actually intend to use. A chat-platform deployment may not need the OpenAI-compatible API port at all; avoid opening it until an external API client or dashboard requires it.

Run Hermes in Docker

Docker separates the image from your persistent state. The image is stateless; configuration and sessions remain in the host directory mounted at /opt/data. The following sequence performs setup once, then starts the gateway as a background container.

Create persistent state and run setup

1. Create the host directory:

   mkdir -p ~/.hermes

2. Run the setup wizard interactively with the data mount:

   docker run -it --rm 
     -v ~/.hermes:/opt/data 
     nousresearch/hermes-agent setup

3. Complete provider and messaging prompts. Because ~/.hermes is mounted, the resulting credentials and configuration remain on the VPS after the temporary setup container exits.

   ×

   Quick wins for a faster PC:

   Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

   Rank #3

   

   New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord

   • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
   • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
   • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
   • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
   • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

   $8.99

   Buy on Amazon

Start the gateway and API server

Run the gateway detached and make Docker restart it after a reboot or an unexpected exit:

docker run -d 
  --name hermes 
  --restart unless-stopped 
  -v ~/.hermes:/opt/data 
  -p 8642:8642 
  nousresearch/hermes-agent gateway run

Port 8642 serves the OpenAI-compatible API and health endpoint. It is optional when Hermes is used only through chat platforms. If no outside client needs the API, omit the -p 8642:8642 mapping and keep the service internal to Docker.

Enable the dashboard only when needed

To run the dashboard, publish port 9119 and set the dashboard environment flag:

docker run -d 
  --name hermes 
  --restart unless-stopped 
  -v ~/.hermes:/opt/data 
  -p 8642:8642 
  -p 9119:9119 
  -e HERMES_DASHBOARD=1 
  nousresearch/hermes-agent gateway run

The dashboard binds to 0.0.0.0 inside the container by default. A non-loopback bind requires an authentication provider. Publishing 9119 directly to the public internet without authentication turns the dashboard into an exposed control surface; place it behind an authenticated reverse proxy or restrict it with a firewall and private network.

Configure credentials without leaking them

Whether native or containerized, complete model-provider configuration through hermes model and the setup wizard or through the Hermes configuration supported by your provider. Configure chat integrations with hermes gateway setup. Keep secrets in the persistent data directory rather than embedding them in shell history, public compose files, or world-readable scripts.

For an API-enabled deployment, generate a long random server key. The Docker documentation gives this example:

openssl rand -hex 32

Store the resulting value as the API server key in Hermes configuration, and require clients to present it. Do not paste keys into screenshots, issue trackers, or public shell transcripts. Restrict filesystem permissions on ~/.hermes (or the host directory mounted to /opt/data) so only the Hermes service account and approved administrators can read it.

Rank #4

BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees

• Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
• Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
• All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
• Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
• Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

$199.99

Buy on Amazon

Keep the gateway running after disconnecting

Docker restart policy

The Docker command above uses --restart unless-stopped. Docker starts the gateway again after a host reboot and retries it after an unplanned exit, while still respecting an explicit stop. Check its state and recent output with:

docker ps --filter name=hermes
docker logs --tail 100 hermes

If the container repeatedly exits, inspect the last log lines before changing ports or deleting data. Recreate the container only after confirming that the persistent mount points to the same host directory.

Native user service

For a native deployment, use Hermes’ gateway/service configuration from the installed CLI and run it under the dedicated unprivileged account. Enable user-service lingering when the service must survive logout:

sudo loginctl enable-linger SERVICE_USER

Keep the service’s working directory, environment, launcher path, and ~/.hermes ownership aligned with that account. Running setup as one user and starting the gateway as another commonly produces missing configuration, permission errors, or a gateway that cannot see the selected model credentials.

Secure a public VPS

Consider every API or dashboard listener a security boundary, not a convenience port. Apply this checklist before assigning a public address:

• Administer the VPS over SSH and keep the operating system, Docker engine, and packages updated.
• Run native Hermes as a dedicated unprivileged user wherever possible.
• Publish only ports required by a real client. Chat-only use generally needs no public API port.
• Bind API and dashboard services privately when possible. Otherwise, restrict source addresses with a firewall or place them behind a reverse proxy that enforces authentication and TLS.
• Set a strong API_SERVER_KEY (or the equivalent Hermes API-key setting) whenever the API server is enabled; generate it with openssl rand -hex 32.
• Do not expose the dashboard on a non-loopback interface without an authentication provider.
• Protect the native ~/.hermes directory or Docker bind mount. It can contain provider keys, login sessions, memories, skills, and operational configuration.
• Do not make the data tree world-readable, and do not mount it into unrelated containers or web-server document roots.

Back up and upgrade safely

What to back up

Back up the entire native ~/.hermes directory, or the host directory mounted to Docker’s /opt/data. A partial backup can omit sessions, memories, skills, or provider configuration needed to reproduce the service. Protect backup copies with the same care as the live directory because they contain credentials.

Upgrade a native installation

Use the update and service workflow provided by the installed Hermes CLI. Run updates as the same service user that owns the installation and data, then check the gateway logs and run hermes doctor if behavior changes.

Best Value

Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide Walkthroughs

$19.98

Buy on Amazon

Upgrade a Docker installation

Docker installations do not support hermes update. Pull a new image, stop and remove the old container, then recreate it with the identical data mount and required port, environment, and restart options:

docker pull nousresearch/hermes-agent
docker stop hermes
docker rm hermes
docker run -d 
  --name hermes 
  --restart unless-stopped 
  -v ~/.hermes:/opt/data 
  -p 8642:8642 
  nousresearch/hermes-agent gateway run

If the dashboard was enabled, include -p 9119:9119 and -e HERMES_DASHBOARD=1 again. The image replacement does not erase configuration or sessions because those live in the host-mounted directory. Record the image tag you deployed so a failed upgrade can be rolled back to the previous image while retaining the same data directory.

Troubleshoot common deployment failures

hermes: command not found

The launcher is in ~/.local/bin. Run export PATH="$HOME/.local/bin:$PATH", source your shell profile, and confirm that the command resolves. If the command works only in one SSH session, add the path to the service user’s shell configuration rather than to an administrator’s profile.

The gateway loses settings after a Docker restart

Inspect the container definition and verify that the same host directory is mounted to /opt/data. Starting a replacement container without -v ~/.hermes:/opt/data creates an effectively fresh instance. Do not delete the host directory while diagnosing the problem.

The API or dashboard cannot be reached

First check that the container is running and that the expected -p mapping exists. Then check the VPS firewall, cloud security group, and any reverse proxy. Remember that port 8642 is optional and port 9119 is published only in the dashboard command. A service bound privately will not be reachable from the public internet by design.

Browser automation crashes or the VPS becomes sluggish

Browser automation needs at least 2 GB RAM and is the most memory-hungry documented feature. Move from the 1 GB minimum to 2–4 GB, use two CPU cores, or reinstall without browser support with --skip-browser if that capability is unnecessary. Check available disk space as browser assets and logs accumulate.

Credentials work during setup but not in the service

Verify that setup and gateway execution use the same Linux user for native deployments, or the same mounted /opt/data directory for Docker. Check ownership and permissions on ~/.hermes, then restart the service after correcting them. Never solve a permission issue by making the entire data tree world-readable.

Deployment checklist

1. Choose native for direct host-tool access or Docker for isolated, replaceable containers.
2. Select at least 1 GB RAM/1 vCPU for light use; choose 2–4 GB RAM/2 vCPUs for browser automation or heavier concurrency, with at least 2 GB RAM for browser work.
3. Connect through SSH and use a dedicated unprivileged service account.
4. Install natively with the official POSIX command, or mount a persistent host directory to Docker’s /opt/data.
5. Run hermes doctor, choose a provider with hermes model, and complete hermes setup or the Docker setup container.
6. Configure messaging through hermes gateway setup.
7. Use a restart policy or a lingering user service so the gateway survives logout and reboot.
8. Expose port 8642 only for clients that need the OpenAI-compatible API; expose 9119 only for an authenticated dashboard.
9. Generate and protect an API key, lock down the data directory, and restrict firewall access.
10. Back up ~/.hermes or its Docker host equivalent before upgrades.

Bottom line

A dedicated Linux VPS can host Hermes Agent reliably with either supported Tier 1 method. Native installation is the most direct choice for host integration; Docker is the cleaner choice for isolation and image-based replacement. Whichever path you select, persistence depends on the Hermes data directory, uptime depends on a real service or restart policy, and security depends on treating API and dashboard exposure—and the credentials stored in that data directory—as production secrets.

Quick Recap

SaleBestseller No. 1

TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black

$13.98

SaleBestseller No. 2

Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)

$17.99

Bestseller No. 3

New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord

[Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable

$8.99

Bestseller No. 4

BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees

$199.99

Bestseller No. 5

Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide Walkthroughs

$19.98

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.