How to limit an AI agent with Docker

Start with the access the agent needs

An agent can run commands, install tools and read files. A compromised dependency receives the access of the process that loads it. A container helps when its mounts, network and privileges are also restricted.

In the local Hermes installation used for this series, the agent received its own data volume. The user's home, SSH keys and Docker socket stayed outside. Desktop connected through a private channel. This was a validated desktop installation, not a penetration test.

Prepare the image and data

• Get the image from the official project. Check the version and pin its SHA-256 digest. A version tag can move; the digest identifies the content.
• Create a dedicated volume for configuration, history and work files. Do not mount the host root or your home directory.
• Check the effective user after startup. The validated Hermes agent ran with UID 1000. Its official startup adjusts ownership and permissions before it leaves the root user.
• Read the selected version's entrypoint before removing capabilities. If the profile prevents startup, document the required change. Do not use --privileged.

Apply limits at launch

Use --rm --init to manage the container lifecycle. Close the network with --network none. Do not publish ports with -p. Set memory, CPU and process limits. The validated agent used --memory 4g --cpus 4 --pids-limit 512.

Start with --cap-drop ALL and --security-opt no-new-privileges. Keep Docker's default seccomp profile. The Hermes image needed CHOWN, SETUID, SETGID and DAC_OVERRIDE during official startup. That exception belongs to that image. It is not a universal agent profile.

A container without a network cannot reach RN either. This series' network article explains a Unix channel with a fixed external destination. Opening the full network to enable a model changes the protection.

Check the denied access

• Check the process UID and the absence of the personal home and Docker socket.
• Try a local network address and an external address from the container. Both must fail under the closed network profile.
• Check the authorized RN channel with TLS and certificate verification. Do not disable verification to make the connection work.
• Close the interface and check that the agent stops. Open it again and check that data remains.

Understand what the container can still do

The agent can change its volume and use a credential stored in it. Docker shares the host kernel. A flaw in that layer can break isolation. For higher risk code or data that needs another boundary, assess a virtual machine or a separate computer.

RN centralizes model access. It does not make shell commands safe. Use a dedicated organization key and check policies before enabling conversations. This installation made no model calls. The user still needed to register a key.

Frequently asked questions