hermes - 💡(How to fix) Fix Docker terminal: honor `--network=none` (currently no config knob)

Summary

The Docker terminal backend (terminal.backend: docker) does not expose a configuration knob to invoke the container with --network=none (or any other network isolation). This makes it impossible for higher-trust orchestration around Hermes to enforce network-airgap policy on a per-task basis.

Use case

Wrapping Hermes in an orchestration layer that needs to enforce "this task runs without outbound network access" (sandboxed lab work, sensitive-data drafting, deterministic test harnesses) cannot rely on Hermes terminal config — the container always has Docker's default bridge network.

Evidence

Verified on Hermes Agent v0.13.0 (2026.5.7):

1. hermes config show terminal section:

◆ Terminal
  Backend:      docker
  Working dir:  .
  Timeout:      180s
  Docker image: nikolaik/python-nodejs:python3.11-nodejs20

No network field exposed.

2. Source inspection: no --network flag is passed in the terminal/docker invocation path under ~/.hermes/hermes-agent/ (greps for network|--network|net= in terminal/docker/container contexts return nothing relevant).

3. Runtime probe (load-bearing): from inside the container, with no explicit network config from the wrapper:

python3 -c "import urllib.request; r = urllib.request.urlopen('https://example.com', timeout=5); print(r.status)"
# → 200

Confirms outbound HTTPS is reachable; the policy intent of "airgap this task" cannot be enforced.

Proposed change

Either:

• (a) A terminal config knob (e.g., terminal.docker.network: none) that translates into docker run --network=none, OR
• (b) A per-invocation flag on hermes -z (e.g., hermes -z --network=none PROMPT) that the orchestration wrapper could conditionally pass.

(a) is preferred for declarative configuration; (b) is preferred for per-task flexibility. Both would be ideal.

Why filing

The current limitation is documented in the upstream-blockers section of an orchestration wrapper around Hermes; the wrapper falls back to a stderr WARNING ("policy hint only; not enforced") at every invocation. A real network-isolation knob would let the wrapper enforce its policy instead of just warning about it.