neoplanetz/hermes-desktop-docker repository overview

⁠Hermes Agent Desktop

A turnkey Ubuntu 24.04 + XFCE4 desktop with Hermes Agent (Nous Research) pre-installed for secure browser automation: a CDP-enabled Chrome runs on the :1 display and Hermes' /browser drives it, while you watch and steer over the web (NoVNC), VNC, or RDP. Runs with no extra privilege (docker compose up).

⁠Architecture

⁠See it in action

The bundled Chrome, driven over the Chrome DevTools Protocol (loopback-only), and the built-in Hermes dashboard — both watched and managed over NoVNC/RDP on the same desktop you connect to.

⁠What's Included

⁠Bundled Versions

⁠Supported Architectures

docker pull auto-selects the variant for your CPU via the multi-arch manifest.

⁠Quick start (Docker Compose)

1. Create compose.yaml:

services:
  hermes-desktop:
    image: neoplanetz/hermes-desktop-docker:latest
    container_name: hermes-desktop
    environment:
      - HERMES_USER=${HERMES_USER:-hermes}
      - HERMES_PASSWORD=${HERMES_PASSWORD:-hermes123}
    ports:
      - "127.0.0.1:6080:6080"   # NoVNC (web desktop)
      - "127.0.0.1:5901:5901"   # VNC
      - "127.0.0.1:3390:3389"   # RDP (host 3390 -> container 3389)
      - "127.0.0.1:9119:9119"   # Dashboard
    volumes:
      - hermes-home:/home/${HERMES_USER:-hermes}
    shm_size: "2gb"
    restart: unless-stopped
    init: true

volumes:
  hermes-home:
    name: hermes-home

2. Create .env (next to compose.yaml) and change the defaults before exposing any port:

cat > .env <<'EOF'
HERMES_USER=hermes
HERMES_PASSWORD=hermes123
EOF

3. Start:

docker compose up -d

4. Open the dashboard at http://localhost:9119⁠ and set a model + API key in the API Keys tab (Nous Portal recommended), or run hermes setup from the "Hermes Setup" desktop shortcut.

⁠Verify (cosign)

Releases are keyless-signed with an SBOM + SLSA provenance attestation:

IMAGE=neoplanetz/hermes-desktop-docker:latest
ID='^https://github\.com/Neoplanetz/hermes-agent-desktop-docker/\.github/workflows/release\.yml@refs/tags/v'
IS=https://token.actions.githubusercontent.com
cosign verify "$IMAGE" --certificate-identity-regexp "$ID" --certificate-oidc-issuer "$IS"

Full instructions (SBOM + provenance): see "Verifying the image" in the repo README.

⁠Compose parameters

⁠Update to a new image

docker compose pull        # fetch the new image
docker compose up -d       # recreate against it

⁠Alternative: docker run

docker run -d \
  --name hermes-desktop \
  -e HERMES_USER=hermes \
  -e HERMES_PASSWORD=hermes123 \
  -p 127.0.0.1:6080:6080 \
  -p 127.0.0.1:5901:5901 \
  -p 127.0.0.1:3390:3389 \
  -p 127.0.0.1:9119:9119 \
  -v hermes-home:/home/hermes \
  --shm-size=2g --init --restart unless-stopped \
  neoplanetz/hermes-desktop-docker:latest

⁠Access

All three remote-desktop paths converge on the same :1 desktop, so the agent's browser actions are visible no matter how you connect. Default credentials are hermes / hermes123 — change them before exposing any port beyond loopback.

⁠What the agent can do

• Browser automation (CDP) — a CDP-enabled Chrome autostarts on :1; Hermes /browser attaches over CDP (127.0.0.1:9222) so the agent reads and drives web pages while you watch. (Native computer_use desktop input is not supported under this VNC desktop — see the project README / docs/E2E-ACCEPTANCE.md.)
• Dashboard — Status, Chat (embedded TUI), Config, API Keys, Sessions, Skills, MCP, Logs, Cron, Channels.

⁠Configuration

• HERMES_USER / HERMES_PASSWORD — desktop account, used for VNC/RDP and the dashboard login.
• Per-user state persists in the hermes-home Docker volume (mounted at the user's home; ~/.hermes holds config, sessions, skills).
• Model/provider are unset by default — configure at runtime in the dashboard.

⁠Security

• The dashboard binds 0.0.0.0 inside the container but should be published to 127.0.0.1:9119 only (as shown above), and always requires login (scrypt-hashed password auth; no plaintext stored). LAN exposure is opt-in — change the port binding and use a strong HERMES_PASSWORD.
• The VNC password and dashboard auth material are generated at container start (mode 600, in-container only) — never baked into the image.

⁠Ports

⁠Links

• GitHub repository (source, issues, full README): https://github.com/Neoplanetz/hermes-agent-desktop-docker⁠
• Beginner's guide: 🇺🇸 English⁠ · 🇰🇷 한국어⁠ · 🇨🇳 中文⁠ · 🇯🇵 日本語⁠
• Hermes Agent (Nous Research): https://hermes-agent.nousresearch.com⁠
• License: MIT⁠ — covers this repo's packaging (Dockerfile, scripts, configs, docs); Hermes Agent keeps its own Nous Research license.