Container & Virtualization Inventory

Beyond installed software and services, the Hermes agent also inventories the workloads a machine hosts: Docker and Podman containers on Linux endpoints, and Hyper-V and VMware Workstation virtual machines on Windows endpoints. This gives you a fleet-wide picture of container runtimes, images, volumes, and registered VMs without logging in to each host.

Platform coverage#

The two areas are collected by different platform agents and appear as separate sections in the agent detail view:

Each section is shown only when it applies. On the agent detail view, the Containers and Virtualization entries appear under the Configuration group — the Virtualization section is surfaced only when a hypervisor is detected on the host. A machine that runs no containers and no hypervisor simply reports nothing for these areas.

Container inventory (Linux)#

On Linux endpoints, Hermes detects the Docker and Podman runtimes independently and, when a runtime is reachable, enumerates its containers, images, and volumes.

Runtime detection

For each runtime, the agent reports:

Detection is deliberately honest: an installed-but-unreachable runtime is reported as IsInstalled = true with an explanatory ErrorMessage rather than being silently dropped, so you can tell "no Docker here" apart from "Docker is here but the agent can't see it."

Rootless Podman

Podman is commonly run rootless, per user. In addition to the system (rootful) instance, Hermes discovers users with an active rootless Podman session and enumerates each user's containers, images, and volumes as well. Rootless items are labelled with the owning user so they are easy to distinguish in the list. If the rootful instance is not reachable but rootless sessions are found, the runtime is still reported as accessible so those workloads are not lost.

What's reported per container, image, and volume

Virtualization inventory (Windows)#

On Windows endpoints, Hermes detects locally installed hypervisors and enumerates all registered VMs regardless of power state — running and powered-off alike.

Hyper-V

Both the Hyper-V client optional feature and the Windows Server Hyper-V role are detected (they share the same management tooling). When present, Hermes reports the management module version and enumerates every VM with these fields:

If Hyper-V is installed but the VMs cannot be enumerated — usually a permissions issue — the host is still reported as having Hyper-V installed, together with an actionable status message explaining that the agent should be run with sufficient privileges (for example, by adding its service account to the Hyper-V Administrators group). VMs are never silently omitted.

VMware Workstation

VMware Workstation is detected via its registry install path / known install locations. Hermes then builds a complete list of VMs by combining:

• Running VMs — identified from the running virtual-machine processes on the host.
• All registered VMs — read from every user profile's VMware inventory, so powered-off machines are included too.

Each VM reports its name, power state (normalized to Running / Off), configuration path, and — where readable from the VM configuration — its assigned vCPU count and memory. If Workstation is installed but no VMs are readable, the host is reported as installed with a status message instead of an empty list.

Where to see it#

Open a machine from the Agents list and use the agent detail view's left-hand navigation:

• Configuration → Containers — the container runtimes found on the host, with their containers, images, and volumes (Linux hosts).
• Configuration → Virtualization — the hypervisors found on the host and their registered VMs (Windows hosts). This entry appears only when a hypervisor is detected.

Like the rest of inventory, these results are refreshed on the agent's regular status cadence, so the view reflects the last successful collection rather than a live query at open time.

Reading it over the API#

Container and virtualization data are part of an agent's full inventory. Fetch the complete inventory document and read the containerInventory and virtualizationInventory sections (each is null when it does not apply to that host):

# Fetch the full inventory for one agent, then inspect containers / VMs
$headers = @{ Authorization = "Bearer $token" }

$inv = Invoke-RestMethod `
  -Uri "https://athena.example.com:8443/api/agents/$agentId/inventory" `
  -Headers $headers `
  -SkipCertificateCheck

$inv.data.containerInventory.docker.containers
$inv.data.virtualizationInventory.hyperV.vms

Reading inventory requires the Helpdesk role or higher. For the full inventory surface, sub-routes, and refresh behaviour, see Inventory. For the PowerShell module used to script against the server, see the PowerShell Module reference.