workspace-template-hermes (sha-ac26ab3)

Published 2026-10-25 08:55:28 +00:00 by hongming

Pull the image from the command line:

docker pull git.moleculesai.app/molecule-ai/workspace-template-hermes:sha-ac26ab3

Digest

sha256:59e514fd5bfa8222c03d25e40c9d1fbcad6cf346f5bb5006de4ea31aeb7a256d

For more information on the Container registry, see the documentation.

Molecule AI workspace template — hermes runtime

Image Layers

# debian.sh --arch 'amd64' out/ 'trixie' '@1792531975'

ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

ENV LANG=C.UTF-8

RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates netbase tzdata ; apt-get dist-clean # buildkit

ENV GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D

ENV PYTHON_VERSION=3.11.17

ENV PYTHON_SHA256=bfb74ad39efae27cda510f134ab408e00f9992c56851cfc0b1cdb5646da11599

RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends dpkg-dev g++ gcc gnupg libbluetooth-dev libbz2-dev libc6-dev libdb-dev libffi-dev libgdbm-dev liblzma-dev libncursesw5-dev libreadline-dev libsqlite3-dev libssl-dev make tk-dev uuid-dev wget xz-utils zlib1g-dev ; wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; wget -O python.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc"; GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$GPG_KEY"; gpg --batch --verify python.tar.xz.asc python.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME" python.tar.xz.asc; mkdir -p /usr/src/python; tar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; rm python.tar.xz; cd /usr/src/python; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; ./configure --build="$gnuArch" --enable-loadable-sqlite-extensions --enable-optimizations --enable-option-checking=fatal --enable-shared $(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') --with-ensurepip ; nproc="$(nproc)"; EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; LDFLAGS="$(dpkg-buildflags --get LDFLAGS)"; LDFLAGS="${LDFLAGS:-} -Wl,--strip-all"; make -j "$nproc" "EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" "LDFLAGS=${LDFLAGS:-}" ; rm python; make -j "$nproc" "EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" "LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\$\$ORIGIN/../lib'" python ; make install; cd /; rm -rf /usr/src/python; find /usr/local -depth $ \( -type d -a \( -name test -o -name tests -o -name idle_test $ \) -o $ -type f -a \( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' $ \) \) -exec rm -rf '{}' + ; ldconfig; apt-mark auto '.*' > /dev/null; apt-mark manual $savedAptMark; find /usr/local -type f -executable -not $ -name '*tkinter*' $ -exec ldd '{}' ';' | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' | sort -u | xargs -rt dpkg-query --search | awk 'sub(":$", "", $1) { print $1 }' | sort -u | xargs -r apt-mark manual ; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; apt-get dist-clean; export PYTHONDONTWRITEBYTECODE=1; python3 --version; pip3 install --disable-pip-version-check --no-cache-dir --no-compile 'setuptools==79.0.1' 'wheel==0.46.3' ; pip3 --version # buildkit

RUN /bin/sh -c set -eux; for src in idle3 pip3 pydoc3 python3 python3-config; do dst="$(echo "$src" | tr -d 3)"; [ -s "/usr/local/bin/$src" ]; [ ! -e "/usr/local/bin/$dst" ]; ln -svT "$src" "/usr/local/bin/$dst"; done # buildkit

CMD ["python3"]

RUN /bin/sh -c apt-get update && apt-get install -y --no-install-recommends curl ca-certificates git gosu xz-utils build-essential sudo util-linux docker.io && rm -rf /var/lib/apt/lists/* # buildkit

RUN /bin/sh -c apt-get update && apt-get install -y --no-install-recommends libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxi6 libxkbcommon0 libxrandr2 xvfb fonts-liberation fonts-noto-color-emoji fonts-wqy-zenhei fonts-ipafont-gothic fonts-tlwg-loma-otf fonts-freefont-ttf fonts-unifont && rm -rf /var/lib/apt/lists/* # buildkit

RUN /bin/sh -c curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /usr/share/keyrings/githubcli-archive-keyring.gpg && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list && apt-get update && apt-get install -y --no-install-recommends gh && rm -rf /var/lib/apt/lists/* && gh --version # buildkit

RUN /bin/sh -c useradd -u 1000 -m -s /bin/bash agent # buildkit

RUN /bin/sh -c set -eux; printf 'agent ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/agent-t4; chmod 0440 /etc/sudoers.d/agent-t4; visudo -cf /etc/sudoers.d/agent-t4; groupadd -f docker; groupadd -g 988 -f docker-host || true; usermod -aG docker agent; usermod -aG docker-host agent || true; id agent # buildkit

ARG RUNTIME_VERSION=0.4.92

ARG MOLECULE_RUNTIME_INDEX=https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/

WORKDIR /app

COPY requirements.txt . # buildkit

COPY scripts/prepare_runtime_requirements.py /usr/local/bin/prepare-runtime-requirements.py # buildkit

RUN |2 RUNTIME_VERSION=0.4.92 MOLECULE_RUNTIME_INDEX=https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/ /bin/sh -c set -eu; runtime_project="molecules-workspace-runtime"; runtime_requirement="$(python3 /usr/local/bin/prepare-runtime-requirements.py --requirements requirements.txt --output /tmp/template-requirements.txt --runtime-version "$RUNTIME_VERSION")"; case "$runtime_requirement" in "$runtime_project"*) ;; *) exit 1 ;; esac; rm -rf /tmp/molecule-runtime; mkdir /tmp/molecule-runtime; pip download --isolated --only-binary=:all: --no-deps --index-url "$MOLECULE_RUNTIME_INDEX" --dest /tmp/molecule-runtime "$runtime_requirement"; wheel_count="$(find /tmp/molecule-runtime -maxdepth 1 -type f -name '*.whl' | wc -l)"; test "$wheel_count" -eq 1; runtime_wheel="$(find /tmp/molecule-runtime -maxdepth 1 -type f -name 'molecules_workspace_runtime-*.whl')"; test -n "$runtime_wheel"; pip install --isolated --no-cache-dir "$runtime_wheel" -r /tmp/template-requirements.txt; rm -rf /tmp/molecule-runtime /tmp/template-requirements.txt # buildkit

COPY adapter.py . # buildkit

COPY __init__.py . # buildkit

COPY executor.py . # buildkit

COPY hermes_plugins/ /app/hermes_plugins/ # buildkit

COPY scripts/ /app/scripts/ # buildkit

COPY start.sh /usr/local/bin/start.sh # buildkit

COPY scripts/mcp-reconcile-watch.sh /usr/local/bin/mcp-reconcile-watch.sh # buildkit

RUN |2 RUNTIME_VERSION=0.4.92 MOLECULE_RUNTIME_INDEX=https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/ /bin/sh -c chmod +x /usr/local/bin/start.sh /usr/local/bin/mcp-reconcile-watch.sh # buildkit

COPY scripts/molecule-askpass /usr/local/bin/molecule-askpass # buildkit

RUN |2 RUNTIME_VERSION=0.4.92 MOLECULE_RUNTIME_INDEX=https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/ /bin/sh -c chmod +x /usr/local/bin/molecule-askpass # buildkit

COPY scripts/hermes-node-path.sh /etc/profile.d/hermes-node-path.sh # buildkit

ARG HERMES_COMMIT=bf0203a794a07aac3ff764972ab9087baa4e4f4e

ARG HERMES_INSTALL_SH_SHA256=99cb3691d55019c6973a7acb775a915648666cc24e483ca827a1cdbb3531a674

COPY --chown=agent:agent vendor/hermes-agent/install.sh /tmp/hermes-install.sh # buildkit

USER agent

WORKDIR /home/agent

RUN |4 RUNTIME_VERSION=0.4.92 MOLECULE_RUNTIME_INDEX=https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/ HERMES_COMMIT=bf0203a794a07aac3ff764972ab9087baa4e4f4e HERMES_INSTALL_SH_SHA256=99cb3691d55019c6973a7acb775a915648666cc24e483ca827a1cdbb3531a674 /bin/sh -c set -eu; echo "${HERMES_INSTALL_SH_SHA256} /tmp/hermes-install.sh" | sha256sum -c -; bash /tmp/hermes-install.sh --skip-setup --commit "${HERMES_COMMIT}"; rm -f /tmp/hermes-install.sh # buildkit

RUN |4 RUNTIME_VERSION=0.4.92 MOLECULE_RUNTIME_INDEX=https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/ HERMES_COMMIT=bf0203a794a07aac3ff764972ab9087baa4e4f4e HERMES_INSTALL_SH_SHA256=99cb3691d55019c6973a7acb775a915648666cc24e483ca827a1cdbb3531a674 /bin/sh -c set -eu; actual="$(git -C /home/agent/.hermes/hermes-agent rev-parse HEAD)"; if [ "$actual" != "${HERMES_COMMIT}" ]; then echo "FATAL: hermes checkout is at $actual, expected ${HERMES_COMMIT}." >&2; echo " install.sh ignored --commit; the image would ship unpinned upstream main." >&2; exit 1; fi; echo "hermes checkout pinned at $actual" # buildkit

ENV PATH=/home/agent/.local/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HERMES_RUNTIME_DIR=/home/agent/.hermes/tools HERMES_DISABLE_LAZY_INSTALLS=1

ARG HERMES_PYPI_FLOOR=0.22.5

ARG HERMES_PLATFORM_MOLECULE_A2A_REF=f08bc9dff29d12c5f11800faa98404f507cd5dc5

USER root

WORKDIR /app

RUN |6 RUNTIME_VERSION=0.4.92 MOLECULE_RUNTIME_INDEX=https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/ HERMES_COMMIT=bf0203a794a07aac3ff764972ab9087baa4e4f4e HERMES_INSTALL_SH_SHA256=99cb3691d55019c6973a7acb775a915648666cc24e483ca827a1cdbb3531a674 HERMES_PYPI_FLOOR=0.22.5 HERMES_PLATFORM_MOLECULE_A2A_REF=f08bc9dff29d12c5f11800faa98404f507cd5dc5 /bin/sh -c set -eu; set -- /home/agent/.hermes/tools/python-*/bin/python3; layout() { gosu agent env HOME=/home/agent "$1" -I /app/scripts/hermes-pm-layout.py /home/agent/.hermes/hermes-agent "$2"; }; store_python="$(layout "$1" store-python)"; agent_python="$(layout "$1" env-python)"; source_snapshot="$(layout "$1" source-snapshot)"; printf 'HERMES_STORE_PYTHON=%s\nHERMES_AGENT_PYTHON=%s\nHERMES_SOURCE_SNAPSHOT=%s\n' "$store_python" "$agent_python" "$source_snapshot" > /etc/hermes-pm-layout.env; cat /etc/hermes-pm-layout.env # buildkit

ENV ADAPTER_MODULE=adapter HERMES_API_BASE=http://127.0.0.1:8642/v1 API_SERVER_ENABLED=true API_SERVER_HOST=127.0.0.1 API_SERVER_PORT=8642 MOLECULE_A2A_PLATFORM_ENABLED=true MOLECULE_A2A_PLATFORM_HOST=127.0.0.1 MOLECULE_A2A_PLATFORM_PORT=8645 MOLECULE_A2A_CALLBACK_HOST=127.0.0.1 MOLECULE_A2A_CALLBACK_PORT=8646

ENTRYPOINT ["/usr/local/bin/start.sh"]

Key	Value
org.opencontainers.image.description	Molecule AI workspace template — hermes runtime
org.opencontainers.image.revision	ac26ab348689ae257205cda2778ef5ca41878a31
org.opencontainers.image.source	https://git.moleculesai.app/molecule-ai/molecule-ai-workspace-template-hermes