# NousResearch/hermes-agent · Docker cold-start sandbox escape fixes

## Open now

- 1 issue, 2 PRs open on GitHub.
- #54354: \[Bug\]: Docker backend: first tool call before image is pulled runs on host (returns local paths)
- PR #54743: fix(file-tools): anchor docker cold-start paths in container
- PR #61882: fix(security): fail closed when terminal config bridge is unavailable

These members address a security vulnerability where tool calls made before a Docker image is fully pulled could execute on the host instead of inside the container, returning local paths. The fixes include blocking the config race condition, anchoring paths in the container, and failing closed when the terminal config bridge is unavailable.

## TL;DR

- 4 member(s): 1 open issue(s), 0 closed issue(s), 2 open PR(s), 0 merged PR(s), 1 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.50`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #54354: \[Bug\]: Docker backend: first tool call before image is pulled runs on host (returns local paths)

## Prior & competing PRs

- **#54743: fix(file-tools): anchor docker cold-start paths in container**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `e9ce25037`, `#54354`
  - files: `tests/tools/test_file_tools_docker_coldstart.py`, `tools/file_tools.py`
- **#54982: fix(security): block Docker cold-start sandbox escape via config race**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#61882`
- **#61882: fix(security): fail closed when terminal config bridge is unavailable**. open
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `a980956cfae2988ab553e10b9ed86161e57fe729`, `dc77f2c87f11c4929e151e65396b8f321a1d6a14`
  - files: `hermes_cli/config.py`, `tests/tools/test_browser_camofox_private_page_guard.py`, `tests/tools/test_browser_ssrf_local.py`, `tests/tools/test_docker_cold_start_guard.py`, `tests/tools/test_docker_session_isolation.py`, `tests/tools/test_env_probe.py`, `tests/tools/test_file_tools.py`, `tests/tools/test_terminal_degraded_mode.py`, `tests/tools/test_terminal_env_bridge.py`, `tools/browser_camofox.py`, `tools/browser_tool.py`, `tools/credential_files.py`, `tools/env_probe.py`, `tools/file_tools.py`, `tools/image_generation_tool.py`, `tools/image_source.py`, `tools/skills_tool.py`, `tools/terminal_tool.py`, `tools/vision_tools.py`

## Fix status

- No merged fix on record.
- Subsystem: `agent`