How to run the Hermes AI agent in Docker on Windows 11 with an admin dashboard

Local AI on Windows series  ·  View all parts
← Part 2: Hermes AI agent on Ubuntu via Hyper-V  ·  Part 3 of 3

Hermes is a local AI agent from NousResearch that can answer questions, execute tasks, and write files — all running on your own hardware. This guide walks you through setting it up in Docker on Windows 11, with two containers: one for the agent itself and one for the admin dashboard and chat interface.

No cloud dependency, no system-wide installation. When you’re done testing, one command removes everything.

Prerequisites

• Docker Desktop installed and running on Windows 11
• PowerShell (no admin rights needed)
• An API key for a supported LLM provider — DeepSeek, OpenAI, or similar
• About 10 minutes

How the setup works

The final result is two permanently running containers and two types of temporary containers. Here is what each one does:

Container	Role	Lifetime	Port
hermes-agent	Gateway — runs the AI brain, connects to the LLM, handles all requests	Permanent	8642 internal → 8643 host
hermes-dashboard	Serves the web UI (admin panel + chat) over the private network	Permanent	9120
Setup wizard	Runs once to write your config, then removes itself	Temporary	—
CLI chat	Optional terminal chat session against the running gateway	Temporary	—

All containers share the same config folder on your Windows machine, mounted as a volume. Anything Hermes writes to /opt/data/ inside the container appears directly in that folder on your PC — even after the containers stop.

Step 1: Create the config folder

Each Hermes instance stores its settings in a local folder. Create a dedicated folder for this installation:

mkdir C:\Users\YourUsername\hermes-data

Replace YourUsername with your actual Windows username throughout this guide. You can find your username by running echo $env:USERNAME in PowerShell.

Step 2: Run the setup wizard

This command starts an interactive configuration wizard. It asks for your LLM provider, API key, and a few preferences. When it’s done, it writes the config to your folder and the container removes itself automatically.

docker run -it --rm -v C:\Users\YourUsername\hermes-data:/opt/data nousresearch/hermes-agent:latest setup

When prompted for a terminal backend, select none — this is the safe option for a first setup and works on all systems.

Step 3: Start the gateway container

The gateway is the core of the agent. It loads your config, connects to the LLM, and handles all requests. Run it in the background with a unique name and port:

docker run -d --name hermes-agent -v C:\Users\YourUsername\hermes-data:/opt/data -p 8643:8642 nousresearch/hermes-agent:latest gateway run

Verify it started correctly:

docker ps

You should see hermes-agent listed with status Up.

Step 4: Create a custom Docker network

By default, Docker containers cannot find each other by name. A user-defined bridge network fixes this — it lets the dashboard container reach the gateway using its container name instead of an IP address.

docker network create hermes-net
docker network connect hermes-net hermes-agent

Step 5: Start the dashboard container

The dashboard serves the web interface on port 9120. It connects to the gateway over the private network using its container name, and mounts the same config folder so both containers share the same state.

docker run -d --name hermes-dashboard --network hermes-net -p 9120:9119 -v \
C:\Users\YourUsername\hermes-data:/opt/data \
-e GATEWAY_HEALTH_URL=http://hermes-agent:8642 \
-e HERMES_DASHBOARD_BASIC_AUTH_USERNAME=admin \
-e HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=your_password \
nousresearch/hermes-agent:latest dashboard --host 0.0.0.0

Note: The --insecure flag was removed in the June 2026 security update. The dashboard now requires authentication when bound to 0.0.0.0. The example above uses Basic Authentication with a username and password — replace admin and your_password with your own credentials. If you’re only accessing the dashboard from localhost, you can bind to 127.0.0.1 instead and use an SSH tunnel.

Step 6: Open the dashboard and start chatting

Open your browser and go to:

http://localhost:9120

You’ll see the Hermes dashboard with the admin panel (shown in green) and the chat interface. Type a question and the agent will respond using the LLM you configured in the setup wizard.

Step 7: Interactive CLI chat (optional)

If you prefer a terminal-based chat session, you can start a temporary container that connects to the running gateway:

docker run -it --rm --network hermes-net -v C:\Users\YourUsername\hermes-data:/opt/data -e GATEWAY_HEALTH_URL=http://hermes-agent:8642 nousresearch/hermes-agent:latest

After startup you’ll see a prompt (>) where you can type your questions directly. Exit with exit or Ctrl+C. The gateway container keeps running in the background, so your next CLI session connects to it immediately.

Step 8: Finding files written by the agent

When you ask Hermes to save something — a summary, a script, a list — it writes the file to /opt/data/ inside the container. Because of the volume mount, that file appears directly on your Windows machine at:

C:\Users\YourUsername\hermes-data

Via File Explorer:

1. Press Windows key + E to open File Explorer
2. Navigate to C:\Users\YourUsername\hermes-data
3. Sort by date modified — the newest file will be at the top

Via PowerShell:

cd C:\Users\YourUsername\hermes-data
dir

To read a file directly in the terminal:

Get-Content .\filename.txt

You can also inspect the folder from inside the container without stopping it:

docker exec hermes-agent ls -la /opt/data

The volume is always in sync — no extra Docker commands needed to access your files. Even if you remove both containers, the files in hermes-data remain on your machine.

Step 9: Stop and clean up

When you’re done, stop and remove the containers and network:

docker stop hermes-agent hermes-dashboard
docker rm hermes-agent hermes-dashboard
docker network rm hermes-net

If you also want to delete the config folder and all files Hermes wrote:

Remove-Item -Recurse -Force C:\Users\YourUsername\hermes-data

Leave the folder in place if you want to reuse the same configuration next time — just re-run steps 3 through 5 and everything picks up where it left off.

Why this works

• Unique container names and ports prevent conflicts if you already have other Docker containers running
• User-defined bridge network (hermes-net) lets the dashboard reach the gateway by container name (hermes-agent) without hardcoding an IP address
• Volume mount (-v) keeps all config and output files on your Windows machine — containers are disposable, your data is not
• --insecure flag disables HTTPS for the dashboard, which is fine because it only accepts connections from localhost
• CLI chat container is stateless — it uses the running gateway and the shared config folder, then disappears cleanly when you exit

Frequently asked questions

Does Hermes need an internet connection?

Only to reach your chosen LLM provider. The agent, the dashboard, and your files all run locally — but the model itself lives at DeepSeek, OpenAI, or whichever provider you configured. If you point Hermes at a fully local model, you can run it offline.

Why two containers instead of one?

Separation of concerns. The gateway is the long-running brain; the dashboard is just a web front end that talks to it. Splitting them means you can restart the UI without touching the agent, and you can skip the dashboard entirely if you only want CLI chat.

Why isn’t --insecure used in this guide?

The --insecure flag was deprecated and removed by Nous Research in June 2026. The official method now uses Basic Authentication via environment variables (HERMES_DASHBOARD_BASIC_AUTH_USERNAME and HERMES_DASHBOARD_BASIC_AUTH_PASSWORD). This guide has been updated to reflect the current secure standard.

Will I lose my data if I remove the containers?

No. Everything Hermes writes lives in the volume-mounted folder on your Windows machine. Removing the containers leaves hermes-data untouched — your config and any files the agent created stay until you delete them yourself.

Conclusion

Two permanent containers, one config folder, and a browser tab — that’s the core Hermes setup. The gateway handles the AI logic, the dashboard handles the web interface, and the volume mount ensures your files outlive the containers.

If you also used the CLI chat in step 7, that was a third container — but a temporary one that removes itself the moment you exit. The two that matter long-term are the gateway and the dashboard.

When you want to reset, one cleanup command removes all containers and the network. Your files in hermes-data stay until you explicitly delete them.

Featured image by Rubaitul Azad on Unsplash.