{"id":21715,"date":"2026-07-09T15:45:30","date_gmt":"2026-07-09T14:45:30","guid":{"rendered":"https:\/\/innovatenews.site\/index.php\/2026\/07\/09\/i-moved-my-ai-coding-agent-into-its-own-container-and-now-i-dont-care-what-it\/"},"modified":"2026-07-09T15:45:51","modified_gmt":"2026-07-09T14:45:51","slug":"i-moved-my-ai-coding-agent-into-its-own-container-and-now-i-dont-care-what-it","status":"publish","type":"post","link":"https:\/\/innovatenews.site\/index.php\/2026\/07\/09\/i-moved-my-ai-coding-agent-into-its-own-container-and-now-i-dont-care-what-it\/","title":{"rendered":"I moved my AI coding agent into its own container, and now I don't care what it\u2026"},"content":{"rendered":"
\n

The topic I moved my AI coding agent into its own container, and now I don’t care what it\u2026<\/strong> is currently the subject of lively discussion \u2014 readers and analysts are keeping a close eye on developments.<\/p>\n

This is taking place in a dynamic environment: companies\u2019 decisions and competitors\u2019 reactions can quickly change the picture.<\/p>\n

An AI coding agent is a strange thing to run on the machine you actually use when you think about it. It reads your files, edits code, installs whatever dependencies it decides it needs, and runs shell commands with the same permissions as the user who started it. On a Proxmox box in a throwaway container that’s fine, but on the laptop with your SSH keys, your browser sessions, and half your working life on it, you’re handing a fair amount of trust to a model that will occasionally do something you didn’t ask for.<\/p>\n

I already have a way around that, though, because I’ve been running a Hermes Agent instance in a locked-down Linux container for a while now for completely unrelated tasks. I asked the agent I already had to spin up a new coding profile, dropped a MiniMax API key into the container, and now I message it over Discord to clone repos, scaffold projects, and build small apps, none of which ever touches my actual machine.<\/p>\n

The agents were never really trashing anything on my computer to begin with, but still, I wouldn’t really like to take the risk. I wasn’t exactly cleaning up a mess on my Mac every other day, but once the agent lives somewhere I can snapshot and roll back, I genuinely don’t really care what it does, which then changes how freely I’ll let it run. It can be a bit fiddly, and an unprivileged container isn’t a hard wall against actually hostile code, but it works, and it works the way I want it to.<\/p>\n

The setup is a Hermes Agent instance running inside an unprivileged LXC on my Proxmox server, the same locked-down container my other Hermes profile already lives in. Hermes has a few different execution backends it can use to actually run commands, including Docker, SSH, and serverless options like Modal, but I’m using the plain local shell inside the container. That means the LXC itself is the boundary, with nothing nested inside it doing the sandboxing, and the agent runs commands as a non-root user in a container that can only see what I put there.<\/p>\n

\"\"<\/figure>\n

What that user can touch is deliberately small: the repositories I’ve cloned in, the dependencies those projects need, and the credentials I’ve handed to that one profile. I can cap the CPU, memory, and disk from Proxmox, and because the container sits on copy-on-write storage, I can snapshot it before letting the agent loose and roll it straight back if it makes a hash of things.<\/p>\n

To be clear, an unprivileged LXC is a practical isolation layer for my own agent, not a security guarantee against something actively trying to break out, so I still treat the container as sensitive. The agent can read files, run commands, and use whatever credentials are available to the user it runs as, which is exactly why that user has almost nothing. The agent isn’t harmless, but anything it does is confined to a box I can throw away.<\/p>\n

Getting the coding side up and running also didn’t mean I had to set up a lot by hand. After all, Hermes organizes everything into profiles, and each profile is a separate agent home with its own config, secrets, skills, session history, and messaging bots under ~\/.hermes\/profiles\/. My personal-assistant profile and my coding profile don’t share memory, an API key, or a Telegram token, so a mistake in one can’t bleed into the other.<\/p>\n

To create the coding one, I asked the primary Hermes agent to make a new coding profile, then dropped my MiniMax key and new Discord bot token into the container for it to use. That was it, and it was ready pretty much immediately. Even setting it up this way would make me nervous to do on my Mac, but inside a container? The worst case scenario is that I just rollback the container to my last backup.<\/p>\n

The model behind the coding profile is MiniMax M3, MiniMax’s frontier coding and agentic model, which I’m using through a MiniMax subscription. My other Hermes profile runs a local model on my own hardware for personal-assistant chores, but M3 is a 428-billion-parameter model, so it was never going to sit on a local machine, and for coding work I’d rather point the profile at a hosted model and let the container be the thing I own. Hermes doesn’t care either way, as it treats the model as a swappable provider.<\/p>\n

\"\"<\/figure>\n

It helps that M3 is cheap to run, because I’m not asking it for frontier-level coding here anyway. The jobs I hand it are things like throwing together a basic Python script or pointing it at a Git repo to tell me what’s actually in there, and none of that needs the smartest model money can buy. That suits how I use it, since a lot of the time I’m sending these requests off from my phone while I’m out and about, and a cheap model that can clone a repo and poke around it is all I need in that situation.<\/p>\n

Control happens entirely over Discord, which is the same gateway my other profile uses. I message the bot the way I’d message a person, telling it to clone a particular repo or start a new project, and it runs the commands inside the container and reports back. I never open a terminal, nor do I have to ever SSH in for the everyday stuff. The container is always on, so the agent keeps working whether I’m at my desk or not. I can send a message asking it to look at a Git repo, then come back to the results when I get home.<\/p>\n

The first thing I asked it to build properly was a basic Markdown editor I could use in a browser. I sent that request over Discord, went to do something else, and a few minutes later it had scaffolded the project, installed what it needed, and started a dev server bound to 0.0.0.0 on the container’s address. Because it bound to all interfaces rather than just localhost, the editor was immediately reachable at the container’s IP and port from any browser on my network, including my phone.<\/p>\n

There was no reverse proxy to configure and no port forwarding to think about, because the container already sits on my LAN with its own address. It’s a small thing to build, and I’m not pretending a browser Markdown editor is a hard project, but I liked that I could quickly ask it to build something that is genuinely useful via a text message, and then get a running, network-accessible app without me needing to even remember to take a look at it until I got back home later that day. If the agent had done something strange along the way, the damage would have been confined to the container and nothing else.<\/p>\n

M3 is what I’m using now, but I’ve also got GLM 5.2 and DeepSeek V4 Pro on hand, and the profile setup means swapping between them is a configuration change I can do quite quickly. Hermes lists MiniMax and Z AI’s GLM as native providers alongside the usual OpenRouter and OpenAI-style endpoints, so setting up GLM with a profile is about as involved as changing the key. I haven’t got round to setting GLM up in Hermes yet, but there’s nothing standing in the way of it beyond me actually doing it.<\/p>\n

I can be as flexible as I want to be with it, and all three are open-weight models with very large context windows. Keeping an expensive coding profile on a frontier model while a lighter profile runs something cheaper is exactly the kind of split Hermes is built for, and profiles make it clean to run more than one at once. Honestly, the model is the least permanent part of the entire setup, as the container, profile structure, and Discord control stay the same no matter what model I actually set.<\/p>\n

Would I hand this thing my production tokens or let it run against anything that actually matters? No, and I don’t think an unprivileged LXC is where you’d want to draw that line if you did. But that isn’t what it’s for. It’s a cheap model doing light jobs, cloning repos and building small things while I get on with something else or send off a request from my phone, and for that, moving the whole setup off my machine and into a container removed a small part of what my concern would have been in the first place.<\/p>\n