how to self-host Agent Zero for VPS

Wetin Agent Zero be, and where danger dey hide

Agent Zero na open-source agent framework wey Docker-first. One main agent fit spawn subordinate agents, and each one go run inside its own isolated Docker container. Each agent fit run code, drive browser, and run shell commands. You go control everything from Web UI. E dey work well and e dey fun to use, and e fit run for small hardware like six-dollar VPS.

The danger dey for Web UI. Na the control panel for system wey dey run commands and write files, so if Web UI open and no get authentication, na easy way for person to get remote access. Many setup guides dey lead person straight to trap: the standard docker run dey publish the interface for port 50001 for every network interface. For public VPS, this mean say anyone for internet fit reach am as soon as container start. Fixing that na the first thing you must do, no be the last thing.

Wetin you need

You need VPS wey Docker don install, API key for language model or local model wey you wan use, and at least 2 gigabytes of RAM. Agent Zero dey run anywhere Docker dey run, from small VPS go up to GPU server. If Docker new to you, the Docker basics guide go explain the commands wey follow below.

Install with Docker, bound to loopback

The quick start wey dem document na single docker run. The important change from the copy-paste version wey you go see elsewhere na the address wey you go publish. No publish to every interface for port 50001. Publish to loopback:

docker run -d --name agent-zero \
  -p 127.0.0.1:5080:80 \
  -v a0_usr:/a0/usr \
  agent0ai/agent-zero

-p 127.0.0.1:5080:80 dey bind the Web UI to the server loopback address only, so internet no fit reach am. Reach am from your own machine through SSH tunnel:

ssh -L 5080:127.0.0.1:5080 you@your-vps

Then open http://127.0.0.1:5080 locally, and configure your model provider for UI. For permanent multi-user setup, put am behind VPN or authenticating reverse proxy, but no ever publish the raw UI to open internet.

Where the other guides stop, and why you should not

If you search how to install Agent Zero, you go see plenty guides, including ones from hosting companies, wey go help you get Web UI running for port 50001 and dem go stop there. Na there the risk start, no be where e end. Two things dey finish the job. First, keep the UI private, like we talk before. Second, put default-deny firewall for front of the box so say one stray container or mistake for future no go expose port wey you forget:

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw enable

Follow the firewall basics for full picture, and watch out for IPv6 gap, because service for :: fit reach through IPv6 even when your IPv4 rules tight.

Container isolation protect agents, no be your server

Agent Zero design dey work well for one kind isolation: subordinate agents dey run for separate containers, so dem dey walled off from each other. That one dey worth am. But person fit misread am as "e dey sandboxed, so I safe" and stop there. Container isolation dey protect agents from each other. E no dey do anything to protect your server from internet, or to stop exposed Web UI from give control to stranger. Those ones na your job, for host.

Secrets, users, and the host

Keep the model API key and any other credentials for Agent Zero config or environment file wey only correct account fit read. Keep dem out of your shell history and out of any repository. Administer the box as unprivileged user instead of root, as we talk for least-privilege users, and move SSH to key-only authentication, like for SSH hardening. Then follow the checklist below so nothing go miss:

If you dey compare agents, na the same security posture wey OpenClaw hardening guide and the OpenHands guide dey use: keep the control surface private, run as unprivileged user, use firewall by default, and treat the host as one wey dey run code wey e no write. For side-by-side view of all five agents, see the best self-hosted AI agents in 2026.

The concepts wey dey under any of these dey for building your own AI agent on a VPS, and Dify na another self-hostable platform wey worth comparing.

FAQ

Is Agent Zero safe to self-host?

E safe, if you keep its Web UI private and harden the host. Agent Zero dey run code, a browser, and a shell, and e dey controlled from Web UI wey dey publish for port 50001 by default, so the danger na exposed interface, no be the framework itself. Bind the UI to loopback and reach am through SSH or VPN, put default-deny firewall for front, and run am as unprivileged user.

Does Agent Zero expose a Web UI to the internet by default?

The standard docker run dey publish the interface for port 50001 for every network interface, wey for public VPS mean say e dey reachable from internet as soon as container start. Change the published address to 127.0.0.1 so the UI go listen for loopback only, then reach am through SSH tunnel or VPN.

Can Agent Zero run on a small VPS?

Yes. Agent Zero dey run anywhere Docker dey run, including small, cheap VPS, though heavy tasks and big local models need more memory. If you point am to self-hosted model instead of hosted API, size the box for the model, no be just for Agent Zero.

How is Agent Zero different from OpenClaw or Hermes?

Dem overlap but dem get different aim. Agent Zero na Docker-first framework wey build around one main agent wey dey spawn subordinate agents for isolated containers, wey you dey control from Web UI. OpenClaw and Hermes na personal assistants wey you dey reach through chat apps. The security posture na the same for all of dem: keep the control surface private and harden the host.