How to Run Agent Zero Safely on VPS

Wetin Agent Zero be, and where the danger dey

Agent Zero na open-source, Docker-first agent framework. One primary agent fit spawn subordinate agents. Each one dey run inside im own isolated Docker container. Each one fit execute code, control browser, and run shell commands. You fit control everything from Web UI. E capable and genuinely fun to use. E fit run for hardware as small as six-dollar VPS. If na the multi-agent structure you want, instead of the framework, two Claude Code sessions for the same box fit message each other directly. That one smaller to run and secure.

The danger na the Web UI. E be control panel for system wey dey run commands and write files. So, if Web UI dey exposed and no authentication dey, e become remote foothold into that exact system. And na here be the trap wey most setup guides dey lead you enter directly: the standard docker run publishes the interface for port 50001 on every network interface. For public VPS, this mean say the whole internet fit reach am immediately the container start. Fix this first. No leave am till the end.

Wetin you need

You need one VPS wey get Docker installed, API key for one language model or local model wey you fit point am to, plus few gigabytes of RAM to start. Agent Zero dey run anywhere wey Docker dey run, from small VPS reach GPU server. If Docker new for you, Docker basics guide explain the things wey the commands below assume.

Docker install, wey bind to loopback

The documented quick start na one docker run. The important change from the copy-paste version wey you go see for other places na the address wey you publish. No publish am to every interface for port 50001. Publish am to loopback:

docker run -d --name agent-zero \
  -p 127.0.0.1:5080:80 \
  -v a0_usr:/a0/usr \
  agent0ai/agent-zero

-p 127.0.0.1:5080:80 bind the Web UI only to the server loopback address, so internet no fit reach am. Reach am from your own machine through SSH tunnel:

ssh -L 5080:127.0.0.1:5080 you@your-vps

Then open http://127.0.0.1:5080 locally, and configure your model provider for the UI. For permanent multi-user setup, put am behind VPN or reverse proxy wey require authentication instead. But never publish the raw UI to open internet. You suppose carry this habit go every other tool for the box wey interface dey control sensitive thing. Na so self-hosted open-kritt scanner too suppose dey reached, through tunnel go its UI instead of published port.

Other guides dey stop for here, but you no suppose stop

Search for how to install Agent Zero and you go find plenty guides, including guides from hosting companies, wey go help you reach working Web UI for port 50001, then dem stop there. Na exactly for this point the risk dey start; e no be where e end. Two things go complete the work. First, keep the UI private, as we don explain above. Second, put a default-deny firewall in front of the machine, so stray container or future mistake no fit expose port wey you forget:

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw enable

Follow firewall basics to see the full picture, and pay attention to the IPv6 gap, because service for :: fit still reachable through IPv6 even when your IPv4 rules look tight.

Container isolation dey protect the agents, no be your server

Agent Zero design good well for one kind isolation: subordinate agents dey run inside separate containers, so dem dey separated from one another. This one useful. But e easy to read am as “e dey sandboxed, so I dey safe” and stop there. Container isolation dey protect the agents from one another. E no protect your server from the internet, and e no stop exposed Web UI from giving stranger control. Na your responsibility be that, for the host. Decide from the beginning wetin agent fit do when nobody dey watch am. Na the same kind decision dey behind Claude Code permission modes, where unattended server need tighter setting than laptop wey dey in front of you.

Secrets, users, and the host

Keep Agent Zero model API key and any other credentials for Agent Zero config or an environment file wey na only the correct account fit read. No put dem for shell history or any repository. The same rule apply to anything else for the box wey dey protect secrets. For example, hardening pass for Vaultwarden depend on the admin token and backup file, no be the encryption wey the app already dey handle well. Administer the box with unprivileged user instead of root, as least-privilege users explain. Change SSH to key-only authentication, as SSH hardening show. Then follow the checklist below so nothing miss.

If you dey compare agents, na this same security posture OpenClaw hardening guide and the OpenHands guide dey use: keep the control surface private, run with unprivileged user, enable firewall by default, and treat the host as system wey dey run code wey you no write. For side-by-side view of all five agents, see the best self-hosted AI agents for 2026.

The concepts behind all these dey for building your own AI agent on a VPS, and Dify na another self-hostable platform wey worth comparing.

FAQ

Agent Zero safe to self-host?

E safe, if you keep im Web UI private and harden the host. Agent Zero dey run code, browser, and shell, and na Web UI wey publish for port 50001 by default dey control am. So, na exposed interface be the danger, no be the framework by itself. Bind the UI to loopback and reach am through SSH or VPN. Put default-deny firewall for front. Run am as unprivileged user.

Agent Zero dey expose Web UI to internet by default?

The standard docker run dey publish the interface for port 50001 on every network interface. For public VPS, this mean say internet fit reach am as soon as container start. Change the published address to 127.0.0.1 so the UI go listen for loopback only. Then reach am through SSH tunnel or VPN.

Agent Zero fit run for small VPS?

Yes. Agent Zero fit run anywhere wey Docker fit run, including small and cheap VPS, although heavier tasks and bigger local models need more memory. If you point am to self-hosted model instead of hosted API, size the machine for the model, no be only for Agent Zero.

How Agent Zero different from OpenClaw or Hermes?

Dem overlap, but dem get different focus. Agent Zero na Docker-first framework wey build around primary agent wey dey start subordinate agents inside isolated containers, and Web UI dey control am. OpenClaw and Hermes na personal assistants wey you reach through chat apps. Security posture na the same for all of dem: keep the control surface private and harden the host.