Bug Description

Hi,

I am running Hermes Agent v0.11.0 (2026.4.23) in cli mode from the official docker image with terminal.backend: docker via Docker-out-of-Docker (DooD), ie -v /var/run/docker.sock:/var/run/docker.sock. When agent requested 'execute_code' tool:

{
          "id": "8KVHV7w4AYD2HA9YJ9C2CcnW6ZvzZ3Iw",
          "call_id": "8KVHV7w4AYD2HA9YJ9C2CcnW6ZvzZ3Iw",
          "response_item_id": "fc_8KVHV7w4AYD2HA9YJ9C2CcnW6ZvzZ3Iw",
          "type": "function",
          "function": {
            "name": "execute_code",
            "arguments": "{\"code\":\"import spacy\\nimport textwrap....\"}"
          }
        }
      ]
}

it encounters the following error response:

    {
      "role": "tool",
      "content": "{\"error\": \"Tool execution failed: RuntimeError: Docker command is available but 'docker version' failed. Check your Docker installation.\"}",
      "tool_call_id": "8KVHV7w4AYD2HA9YJ9C2CcnW6ZvzZ3Iw"
    },

To debug the issue, I attached to the running docker container (hermes cli) as hermes user and ran docker version command which failed:

hermes@6c4adb7e4beb:/opt/hermes$ docker version
Client:
 Version:           26.1.5+dfsg1
 API version:       1.45
 Go version:        go1.24.4
 Git commit:        a72d7cd
 Built:             Sun Mar  8 15:28:39 2026
 OS/Arch:           linux/amd64
 Context:           default
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.45/version": dial unix /var/run/docker.sock: connect: permission denied

When I re-attached to the running docker container as root user and ran docker version command, it executed successfully:

 docker exec -it hermes-cli /bin/bash
root@6b3d839cfee3:/opt/hermes# pwd
/opt/hermes
root@6b3d839cfee3:/opt/hermes# docker version
Client:
 Version:           26.1.5+dfsg1
 API version:       1.45
 Go version:        go1.24.4
 Git commit:        a72d7cd
 Built:             Sun Mar  8 15:28:39 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          27.2.1
  API version:      1.47 (minimum version 1.24)
  Go version:       go1.22.7
  Git commit:       8b539b8
  Built:            Fri Sep  6 12:08:10 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.22
  GitCommit:        7f7fdf5fed64eb6a7caf99b3e12efcf9d60e311c
 runc:
  Version:          1.1.14
  GitCommit:        v1.1.14-0-g2c9f560
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Steps to Reproduce

1. docker pull nousresearch/hermes-agent:latest
2. run basic setup is necessary, set terminal.backend = docker
3. docker run -it --rm --name hermes-cli -v /var/run/docker.sock:/var/run/docker.sock -v ~/docker/volumes/hermes/:/opt/data -e AGENT_BROWSER_EXECUTABLE_PATH=/opt/hermes/.playwright/chromium_headless_shell-1217/chrome-headless-shell-linux64/chrome-headless-shell nousresearch/hermes-agent
4. prompt the agent to "Use spaCy to extract entities from https://arxiv.org/html/2604.21896v1 paper"

Expected Behavior

Agent creates a python script and executes the script in an isolated docker runtime and returns results.

Actual Behavior

Encountered "Tool execution failed: RuntimeError: Docker command is available but 'docker version' failed. Check your Docker installation." error.

Affected Component

CLI (interactive chat)

Messaging Platform (if gateway-related)

No response

Debug Report

Report     https://paste.rs/mt8K5
  agent.log  https://paste.rs/DTNEu

Operating System

Docker

Python Version

No response

Hermes Version

v0.11.0 (2026.4.23)

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

hermes user does not belong to docker group and therefore lacks the permission to start a docker container.

Proposed Fix (optional)

I suspect we need to add hermes user to docker group but since the GID in the docker container needs to match host machine's docker GID, is it possible to pass host machine's docker GID as an env variable and add (both the docker group and user to the docker group) in the entry script?

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR