What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Antihost offers VPS plans with one-click Hermes Agent, NVMe storage and a 14-day free trial.
To self-host a Hermes workspace on a VPS, connect to a Docker-enabled Linux server over SSH, create a persistent host directory, run the Hermes setup wizard with that directory mounted at /opt/data, and then start the gateway as a detached container with --restart unless-stopped. Your mounted directory is the persistence boundary: it holds configuration, API keys, sessions, skills, and memories while the container image remains replaceable. Keep that directory backed up, publish no ports unless you need the API, and protect any publicly reachable API with a key and network controls.
What do you need before installing Hermes on a VPS?
You need a Linux VPS or another Linux host with Docker Engine installed and its daemon running. You also need SSH access, because the installation consists of commands that create a directory, start containers, and inspect logs. Hermes documentation supports SSH as a remote terminal backend, and the Docker instructions favor an SSH session over a browser console for commands that are sensitive to quoting, line breaks, and mounted paths.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11As an Amazon Associate I earn from qualifying purchases.
- A Docker-capable Linux host: Verify that Docker Engine is installed and the daemon can answer requests.
- An SSH account: Use an account that can run Docker commands. Avoid changing users casually, because the account determines where
~resolves and which files your bind mount contains. - Persistent storage: Reserve a host directory for Hermes state and include it in your backup plan.
- A network decision: Decide whether Hermes will be used privately through its gateway integrations or whether another service must call its HTTP API.
- Credential material: Have the model or service API keys required by the setup wizard available, and decide which credentials, if any, terminal commands should receive.
Self-hosting moves operational work to you. Updates, image selection, backups, log review, monitoring, firewall rules, and uptime are not automatically handled by a VPS provider.
How do you verify Docker and open an SSH session?
Connect to the VPS first, then verify Docker before running the Hermes wizard. This separates a host problem from an application problem.
Popular on Amazon
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
ssh USER@YOUR_VPS_HOST
docker versionThe docker version command should return client and server information. If it reports that the daemon is unavailable, fix the Docker service or your account’s permission to access it before proceeding. Running the setup command while the daemon is unreachable will not create a usable workspace.
Use one consistent account for setup and gateway operation. If you run Docker through sudo, the shell’s $HOME may change to the superuser’s home directory. That can silently create or mount /root/.hermes instead of the directory you intended. Check the rendered path whenever you use elevated privileges.
How do you run the Hermes first-run setup wizard?
Create the persistent directory and launch the setup image interactively. The wizard asks for API keys and writes the resulting configuration into the mounted directory.
mkdir -p ~/.hermes
docker run -it --rm
-v ~/.hermes:/opt/data
nousresearch/hermes-agent setup- Create the directory.
mkdir -p ~/.hermescreates the host-side persistence location if it does not already exist. - Mount it into the container. The
-v ~/.hermes:/opt/dataoption makes the host directory available at Hermes’s expected data path. - Complete each wizard prompt. Enter the requested service credentials and finish normally. The interactive
-itflags provide the terminal input and output the wizard needs. - Let the temporary container exit.
--rmremoves that setup container after it finishes. Removing the container does not remove the mounted host data.
The image is stateless; the host directory is not. If setup appears to complete but the next container starts as if it were new, inspect the mount path and ownership before repeating the wizard.
Where does Hermes store API keys, sessions, and workspace data?
Hermes stores its user data in the host directory mounted to /opt/data. In the example above, that directory is ~/.hermes. The Docker guide describes this single directory as holding configuration, API keys, sessions, skills, and memories.
Recommended Free Tools
| Data | Persistence location | Operational implication |
|---|---|---|
| Configuration | Host ~/.hermes, mounted as /opt/data |
Back it up before changing settings or upgrading the image. |
| API keys | The same mounted directory | Treat the directory as sensitive; restrict host access and backup access. |
| Sessions | The same mounted directory | Replacing the image does not replace these files when the mount is unchanged. |
| Skills and memories | The same mounted directory | A missing or incorrectly mounted directory makes the workspace appear empty. |
Keep the mount identical for setup and for every gateway invocation. If you choose a different host path, substitute it consistently in both commands and in your backup procedures.
Also popular on Amazon
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
How do you keep Hermes running after you disconnect from SSH?
Start the gateway as a detached container with a restart policy. The gateway is the mode intended for integrations such as Telegram, Discord, Slack, and WhatsApp.
docker run -d
--name hermes
--restart unless-stopped
-v ~/.hermes:/opt/data
nousresearch/hermes-agent gateway runThe -d flag detaches the process from your SSH terminal. --restart unless-stopped asks Docker to bring the container back after a daemon restart or host reboot, unless you explicitly stopped it. --name hermes gives you a stable name for log and lifecycle commands.
Confirm that the container is running before closing the session:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →docker ps --filter name=hermesIf it exits, inspect its output rather than repeatedly starting new copies:
docker logs hermesDo not launch a second container with the same name while the first one exists. Stop and remove the failed container only after you have captured its logs and checked the mounted data.
How do you expose the Hermes API securely?
The API server is optional. Leave it disabled and publish no port when integrations can use the gateway without an HTTP endpoint. If another application must call the API, enable it explicitly, bind it beyond the container loopback, publish the port, and provide an API key.
Also popular on Amazon
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
docker run -d
--name hermes
--restart unless-stopped
-v ~/.hermes:/opt/data
-p 8642:8642
-e API_SERVER_ENABLED=true
-e API_SERVER_HOST=0.0.0.0
-e API_SERVER_KEY="$(openssl rand -hex 32)"
-e API_SERVER_CORS_ORIGINS='*'
nousresearch/hermes-agent gateway runWhat each API setting does
API_SERVER_ENABLED=trueturns the API server on. Without it, publishing a port does not constitute a complete API setup.API_SERVER_HOST=0.0.0.0makes the service listen on interfaces beyond the container’s loopback. Use this only when a published or proxied endpoint is required.-p 8642:8642maps the host’s port 8642 to the container’s port 8642. Omit the mapping for a private, container-only service.API_SERVER_KEYsupplies the bearer credential. The documented minimum is eight characters; the example generates a longer random hexadecimal value with OpenSSL.API_SERVER_CORS_ORIGINS='*'permits requests from any browser origin. Treat that wildcard as a deliberate exposure choice, not a harmless default, and narrow it when your calling application has a known origin.
The Hermes documentation warns that opening any port on an internet-facing machine is a security risk. Put a firewall policy around the published port, restrict source addresses where possible, and consider a reverse proxy that terminates TLS and applies additional access controls. Never publish the API merely to test whether the gateway works.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Which Hermes terminal backend should you use?
The backend determines where commands execute and how much isolation separates them from the VPS host. Hermes supports local, Docker, SSH, Modal, Daytona, and Singularity backends.
| Backend | Execution location | Isolation | Best fit | Main trade-off |
|---|---|---|---|---|
| Local | Directly on the host running Hermes | None | Tasks that intentionally need host-level access | Commands share the host environment and its permissions. |
| Docker | Containers on the VPS | Docker namespaces and hardening controls | General-purpose isolated task execution | Requires Docker configuration, images, mounts, and resource policy. |
| SSH | A remote server reached over SSH | Remote-machine boundary | Keeping command execution off the Hermes VPS | Depends on another host, account, keys, and network reachability. |
| Modal, Daytona, or Singularity | Provider- or platform-managed environment | Depends on that platform’s boundary | Workloads already standardized on one of those systems | Adds platform-specific configuration and operational dependencies. |
Docker is the usual VPS choice when you want commands isolated from the host while keeping execution nearby. Local execution has the least setup but no isolation. SSH is useful when the workspace should orchestrate a separate machine. The right choice depends on where files and commands must live, not on the gateway container alone.
How should you handle mounts, users, and forwarded credentials?
Bind mounts make host files available to containers, but ownership and credential scope need explicit decisions. Hermes’s configuration reference includes persistent containers, volume mounts, environment-variable forwarding, Docker resource controls, and an option to run a container as the host user.
Prevent root-owned files
A container process commonly runs as root unless configured otherwise. When it writes through a bind mount, resulting files can become root-owned on the VPS. Use the host-user option documented for the Docker backend when you need files created with the host account’s ownership, and verify the rendered UID and GID before applying it to a production workspace.
Mount only what a task needs
A broad host mount gives commands a broad ability to read or alter the VPS. Prefer a dedicated Hermes directory and narrowly scoped additional mounts. Keep secrets out of directories that do not require them.
Also popular on Amazon
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Forward credentials selectively
Environment-variable forwarding can make credentials available inside a task, but every forwarded secret expands the impact of a compromised or misbehaving command. Forward only credentials that the command genuinely needs, and remove them when the task no longer depends on them.
Control resource use
Docker resource controls can limit how much CPU, memory, or other capacity a task consumes. Set limits according to the workload and the VPS capacity rather than assuming the container should have unrestricted access.
How do backups and upgrades work with a stateless Hermes image?
Back up the host directory that is mounted at /opt/data, not just the container. The image can be replaced; the directory contains the state that must survive replacement.
- Back up before change. Make a recoverable copy of
~/.hermesbefore an image upgrade or significant configuration edit. - Protect the backup. It contains API keys, sessions, skills, memories, and configuration, so apply access controls appropriate to sensitive credentials.
- Choose an image policy. The documentation distinguishes
latest/stable,main, and versioned tags. A versioned tag or digest gives you a reproducible image reference; moving tags follow whatever image is currently published under that name. - Keep the mount unchanged. When replacing the container, attach the same host directory to
/opt/dataso the new image sees the existing workspace. - Observe the replacement. After an upgrade, check the container status and logs, then verify the integrations or API path you actually use.
Self-hosting means you also own patch scheduling, health checks, retention policy, and recovery testing. A backup that has never been restored is only an assumption, so periodically verify that your chosen backup process can produce a readable copy of the workspace.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do if setup or the gateway fails?
Work through the failure in order: Docker, path, permissions, container logs, and then network exposure. This prevents an API symptom from hiding a storage or startup error.
Docker is unavailable
- Run
docker versionagain and confirm that both client and server information appear. - Check that the Docker daemon is running and that the SSH account is authorized to use it.
The workspace appears empty after a restart
- Confirm that the gateway uses the same host path that the setup wizard used.
- Check that
~/.hermesexists and is readable and writable by the user or container UID. - If Docker was invoked with
sudo, check whether~resolved to/rootand created a second, empty directory.
The gateway exits immediately
- Inspect
docker logs hermesfor configuration, credential, permission, or startup errors. - Check for an existing container named
hermesbefore attempting another run. - Verify that the mounted directory contains the files created by the setup wizard.
The API cannot be reached
- Confirm that
API_SERVER_ENABLEDis set totrue. - Check that the server is bound to the interface you intend to expose and that the host-to-container port mapping is present.
- Verify the client is sending the configured API key and that the key meets the documented minimum length.
- Review the VPS firewall and any reverse-proxy policy. A listening process is not proof that the network path permits traffic.
Files are owned by root
Inspect ownership on the bind-mounted directory and review the Docker backend’s host-user option. Correct the execution identity before allowing more tasks to write into the workspace; changing permissions blindly can make sensitive files readable to unintended accounts.
Also popular on Amazon
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
How do you choose between a private gateway and a public API deployment?
Use the smallest exposure that satisfies the integration. A private gateway keeps the service available to its configured connectors without creating a general-purpose internet endpoint. A public API is appropriate only when an external caller truly needs it and you can enforce authentication and network policy.
| Deployment choice | Execution location | Exposure | Persistence requirement | Maintenance burden |
|---|---|---|---|---|
| Gateway only | Hermes container on the VPS | No published API port | Back up the host directory mounted at /opt/data |
Updates, logs, monitoring, and integration uptime remain your responsibility. |
| Gateway plus private API | Hermes container on the VPS | Reachable only through a private network or controlled proxy | Same host directory and backup plan | Add key management, private routing, and proxy or firewall rules. |
| Gateway plus public API | Hermes container on the VPS | Internet-reachable published port | Same host directory and backup plan | Add continuous patching, key rotation, TLS and access controls, firewall review, and monitoring. |
| Remote-command backend | Commands execute on another server over SSH | Gateway exposure can remain private | Workspace state stays on the Hermes host; remote files need their own policy | Maintain a second machine, SSH credentials, and its security posture. |
What security checklist should you apply before going live?
- Use SSH for administration and keep the VPS operating system and Docker installation patched.
- Do not publish port 8642 unless the API is enabled and required.
- Use a long, randomly generated API key whenever the API listens beyond loopback.
- Restrict the API port with a firewall or private network where possible.
- Place a reverse proxy in front of a public endpoint when you need TLS termination, source filtering, or additional authentication controls.
- Protect
~/.hermesand every backup because the directory contains credentials and session data. - Forward only the environment variables a task needs.
- Use Docker isolation rather than local execution when commands should not have direct host access.
- Review bind mounts and container-user settings so a task cannot write more of the VPS than intended.
- Monitor container logs and establish a response plan for an exited gateway or failed integration.
What is the complete setup sequence?
For a straightforward private deployment, the process is:
- SSH to the Linux VPS.
- Run
docker versionand resolve daemon or permission errors. - Create
~/.hermes. - Run the interactive setup container with
~/.hermes:/opt/datamounted. - Enter the requested API keys and let the setup container finish.
- Start
gateway rundetached with--restart unless-stoppedand the same mount. - Check the container status and logs.
- Back up
~/.hermesbefore future configuration changes or image upgrades. - Only if required, recreate the gateway with API-server variables, a published port, an API key, and firewall or proxy controls.
This arrangement keeps the replaceable container separate from the persistent workspace and leaves network exposure as an explicit decision rather than an accidental side effect.
Frequently Asked Questions
Can I move the Hermes workspace to another disk later?
Yes. Stop the gateway, copy the complete workspace directory to the new disk, and use the new host path in the volume mount for subsequent containers. Preserve the directory contents and permissions; mounting an empty destination will look like a new workspace.
Free tools Windows power users keep installed
One-click scans. No signup required.
Does the API server have to be enabled for chat integrations?
No. The gateway mode is intended for integrations, while the API server is an optional interface for applications that need HTTP access. Keep the API disabled when your integration does not require it.
What happens when the VPS reboots?
Docker can start the gateway again because the container uses the unless-stopped restart policy. This depends on Docker itself starting successfully and the host directory remaining available at the same path.
Should I use a moving image tag or a versioned tag?
A moving tag such as latest or stable follows the publisher’s current image for that tag. A versioned tag or digest is preferable when you need to reproduce a known deployment and schedule upgrades deliberately.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
