Dockerfile

# ── Stage 1: Build Hermes Agent from source ──────────────────────────────
FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie AS uv_source
FROM tianon/gosu:1.19-trixie AS gosu_source

FROM debian:13.4
SHELL ["/bin/bash", "-c"]

ENV PYTHONUNBUFFERED=1
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright

# ── System dependencies ──────────────────────────────────────────────────
RUN echo "[build] Installing system deps..." && START=$(date +%s) \
  && apt-get update && apt-get install -y --no-install-recommends \
    build-essential python3 python3-pip python3-venv \
    git curl wget ca-certificates \
    ripgrep ffmpeg gcc python3-dev libffi-dev procps gnupg \
    git git-lfs \
    vim nano htop bash \
    tar gzip xz-utils bzip2 rsync \
    gettext-base openssh-client nginx \
  && rm -rf /var/lib/apt/lists/* \
  && pip3 install --no-cache-dir --break-system-packages huggingface_hub requests pyyaml \
  && echo "[build] System deps: $(($(date +%s) - START))s"

# Install Node.js 22 LTS (official binary). Debian 13's apt `nodejs` is v20.x with
# npm 9.2.0, which fails Hermes' `npm install` (EBADENGINE): @electron/rebuild@4.2.0
# requires node >=22.12.0 and react-router@8.3.0 requires node >=22.22.0 — the repo
# sets engine-strict=true, so we pin the latest 22.x (22.23.2) that satisfies both.
# The binary tarball is distro-agnostic and ships its own npm, avoiding apt lag.
RUN echo "[build] Installing Node.js 22 LTS..." && START=$(date +%s) \
  && curl -fsSL https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-x64.tar.xz -o /tmp/node.tar.xz \
  && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \
  && rm -f /tmp/node.tar.xz \
  && node --version && npm --version \
  && echo "[build] Node.js install: $(($(date +%s) - START))s"

# ── Install buzz CLI (Rust, build only the buzz-cli crate) ────────────────
# Provides the `buzz` binary needed by BUZZ_PRIVATE_KEY agent config.
RUN echo "[build] Installing Rust + building buzz-cli..." && START=$(date +%s) \
  && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal \
  && . "$HOME/.cargo/env" \
  && git clone --depth 1 https://github.com/block/buzz.git /tmp/buzz-src \
  && cd /tmp/buzz-src \
  && cargo build --release -p buzz-cli \
  && cp target/release/buzz /usr/local/bin/buzz \
  && chmod +x /usr/local/bin/buzz \
  && cd / && rm -rf /tmp/buzz-src \
  && echo "[build] buzz-cli: $(buzz --version 2>/dev/null || echo installed)" \
  && echo "[build] Rust+buzz build: $(($(date +%s) - START))s"

# ── Non-root user (uid 1000 — required for HF Spaces Dev Mode) ───────────
RUN useradd -u 1000 -m -d /opt/data hermes

COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/
COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/

# ── Clone and build Hermes Agent ─────────────────────────────────────────
RUN echo "[build] Cloning Hermes Agent..." && START=$(date +%s) \
  && git clone --depth 1 https://github.com/NousResearch/hermes-agent.git /opt/hermes \
  && echo "[build] Clone: $(($(date +%s) - START))s"

WORKDIR /opt/hermes

# ── Node dependencies + Playwright + Web Dashboard build ─────────────────
RUN echo "[build] Installing Node deps + Playwright..." && START=$(date +%s) \
  && npm install --prefer-offline --no-audit \
  && npx playwright install --with-deps chromium --only-shell \
  && if [ -d /opt/hermes/scripts/whatsapp-bridge ]; then \
       cd /opt/hermes/scripts/whatsapp-bridge && npm install --prefer-offline --no-audit && npm install https-proxy-agent; \
     fi \
  && echo "[build] Building web dashboard..." \
  && cd /opt/hermes/web && npm install --prefer-offline --no-audit && npm run build \
  && cd /opt/hermes && npm cache clean --force \
  && echo "[build] Node deps + web dashboard: $(($(date +%s) - START))s"

# ── Python dependencies ──────────────────────────────────────────────────
RUN chown -R hermes:hermes /opt/hermes
USER hermes

RUN echo "[build] Installing Python deps..." && START=$(date +%s) \
  && cd /opt/hermes \
  && UV_CACHE_DIR=/tmp/uv-cache uv venv \
  && UV_CACHE_DIR=/tmp/uv-cache uv pip install --no-cache-dir -e ".[all]" \
  && UV_CACHE_DIR=/tmp/uv-cache uv pip install --no-cache-dir huggingface_hub requests pyyaml "mem0ai>=2.0.10,<3" \
  && rm -rf /tmp/uv-cache \
  && echo "[build] Python deps: $(($(date +%s) - START))s"

USER root
RUN chmod +x /opt/hermes/docker/entrypoint.sh

# ── Prepare runtime dirs ────────────────────────────────────────────────
RUN mkdir -p /opt/data/cron /opt/data/sessions /opt/data/logs /opt/data/hooks \
             /opt/data/memories /opt/data/skills /opt/data/skins /opt/data/plans \
             /opt/data/workspace /opt/data/home \
  && chown -R 1000:1000 /opt/data

USER root

ARG CACHE_BUST=2026-07-18-wa-proxy-patch-v3
RUN echo "Build: ${CACHE_BUST}"
COPY --chown=root:root entrypoint.sh /opt/scripts/entrypoint.sh
RUN chmod +x /opt/scripts/entrypoint.sh

ENV HERMES_HOME=/opt/data
ENV PATH="/opt/hermes/.venv/bin:$PATH"

WORKDIR /app
COPY --link ./ /app

COPY nginx-proxy.conf /etc/nginx/proxy.conf
COPY nginx.conf /etc/nginx/nginx.conf

CMD ["/opt/scripts/entrypoint.sh"]