Dockerfile

# 2026-05-24 - Shaun L. Cloherty <s.cloherty@ieee.org>

FROM nousresearch/hermes-agent:main

# Copy bws binary from official Bitwarden Secrets Manager image
COPY --from=ghcr.io/bitwarden/bws /bin/bws /usr/local/bin/bws

# Install ddgs (DuckDuckGo Search) CLI
RUN uv pip install --python /opt/hermes/.venv/bin/python ddgs

# Copy entrypoint shim for BWS secret injection and lock cleanup helper
COPY docker/entrypoint-shim.sh /entrypoint-shim.sh
COPY docker/remove-gateway-locks.sh /usr/local/bin/remove-gateway-locks.sh
RUN chmod +x /entrypoint-shim.sh /usr/local/bin/remove-gateway-locks.sh

# Shadow upstream 02-reconcile-profiles to suppress gateway auto-start in
# chat containers via HERMES_NO_GATEWAY_AUTOSTART. The wrapper patches
# _read_prior_state → "stopped" before calling main(), registering s6 slots
# without auto-starting gateways in chat containers.
COPY docker/02-reconcile-profiles /etc/cont-init.d/02-reconcile-profiles
RUN chmod +x /etc/cont-init.d/02-reconcile-profiles