# Build agents without exposing the desktop to dependencies

Pin the source, inspect the package graph and build without a network in Docker. Isolation remains necessary after the app is built.

Rota Nacional · 2026-11-04T22:53:28Z · 2026-11-04T22:53:28Z

## Separate download, installation, build and execution

A package can run code during installation or build. Downloading official source and building it in the user's terminal still exposes that terminal's files and credentials. Establish the first boundary before those steps.

For Hermes Desktop light, we used a work container. Source inputs were read only. A named output directory received dependencies and artifacts. No model key, personal home, SSH session or Docker socket entered that environment.


## Record provenance before installation

- Select an exact revision from the official repository. Record the commit, version, license and downloaded archive hash.
- Check that the interface version matches the agent version. This series used base v0.22.6, commit f0d94882e89ab8d4098b5bb2f166adfb9ee0a0ab. This records a tested base. It does not recommend keeping that version without updates.
- Read installation commands and project scripts. Preserve the original lockfile before changing package managers.
- Pin the compiler image by digest too. Mount only required files and limit memory, CPU, processes and duration.

## Inspect the graph and disable automatic scripts

The applied workflow imported the lockfile into pnpm and kept an exact list of changes. Socket analyzed all 1,181 package versions before installation. Security alerts led to specific dependency updates recorded in the patch and frozen lockfile.

Installation kept ignoreScripts enabled. Required Electron and native terminal steps then ran explicitly inside the container. A guard refusal needs cause analysis. Changing commands to evade the check removes the control.

Package analysis can find known risks. It does not prove the absence of malicious code. Download integrity, script review and restricted access remain necessary.


## Close the network before the final build

Prepare Electron, its headers and packaging tools first. Verify the downloads. Then run the final build with --network none. Do not mount the shared package store at this stage if the build already has all required files.

A compromised process can still change its output artifacts. Record package hashes, preserve the source of changes and run the app in a restricted environment too. A build without a network reduces available channels. It does not certify the output.


## Check the package you will open

The first Hermes package in this installation failed to preload local Electron files. The build had passed. The Vite options modulePreload: false and cssCodeSplit: false fixed startup. Navigation and settings were then checked in the real interface.

The package records source: local and dirty: true because it includes changes. Record exclusions too. Here they included the optional HUD key helper and a model conversation. A dedicated RN key still needed to be registered through the app.


## Frequently asked questions

Does a hash prove the package is safe?

The hash identifies the checked bytes. It does not assess behavior. A compromised source can also distribute an archive with a consistent hash.

Can I run the app outside isolation after building it?

That gives the app the user's normal access. In this installation, the Docker build and Bubblewrap execution address different stages of risk.


- [Official Hermes v0.22.6 build](https://github.com/NousResearch/hermes-agent/blob/v0.22.6/apps/desktop/BUILDING.md)
- [Frozen pnpm installation](https://pnpm.io/cli/install)
- [Socket documentation](https://docs.socket.dev/)
- [Vite build options](https://vite.dev/config/build-options.html)

[Check the RN integration](https://rota-nacional.ia.br/en/docs/)

Use the compatible protected route with the organization's configured policy. You do not need to add the same policy and usage billing to each client.
- [Use with an agent](https://rota-nacional.ia.br/llms.txt)

[Build agents without exposing the desktop to dependencies](https://rota-nacional.ia.br/en/articles/isolated-agent-builds-dependencies/)