Migrating an AI Agent from Incus to Docker: A Security Retrospective

Why I moved my autonomous AI agent (Hermes) from an Incus container to a hardened Docker Compose stack — seccomp, read-only rootfs, dropped capabilities, network segmentation, and the tradeoffs I made along the way.