Prerequisites

Raspberry Pi 5 (8 GB) with the official 27W USB-C power supply
microSD card (64 GB Class 10 minimum) — or NVMe via the official M.2 HAT (recommended for sustained operation)
An Anthropic API key
A Tailscale account (free tier is fine)
A laptop on the same network for the initial flash

Steps

Flash Raspberry Pi OS Bookworm
Use Raspberry Pi Imager. Pick Raspberry Pi OS (64-bit) Bookworm. In the customisation menu set hostname, enable SSH with public-key auth, set your wifi credentials. Eject, insert into the Pi, power on, wait for it to come up.
```
# On your laptop, after the Pi boots:
ssh pi@<pi-hostname>.local
sudo apt update && sudo apt full-upgrade -y
sudo reboot
```
Install Tailscale
Tailscale is the standard way to access the Hermes dashboard without exposing it on a public IP. Free for personal use.
```
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Follow the auth URL, sign in, approve the device.
```

Install Docker

Hermes Agent runs in Docker. Use the convenience script.

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
newgrp docker
docker run hello-world  # verify it works

Pull Hermes Agent
The official image. Pin to a specific minor version, not latest.
```
mkdir -p ~/hermes && cd ~/hermes
docker pull nousresearch/hermes-agent:2026.4.4
```

Configure Hermes

Hermes wants three things: an LLM API key, a sandbox config, and a credential vault. We'll do all three with environment variables for the simplest setup.

cat > docker-compose.yml <<'EOF'
services:
  hermes:
    image: nousresearch/hermes-agent:2026.4.4
    container_name: hermes
    restart: unless-stopped
    environment:
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
      HERMES_BIND_ADDR: 127.0.0.1:8765
      HERMES_BROWSER_TOOL: "false"  # disable on Pi 5 — too heavy
      HERMES_LOG_PROMPTS: "false"
    volumes:
      - ./data:/data
    ports:
      - "127.0.0.1:8765:8765"
EOF

# Set your API key (do NOT commit the .env file)
echo "ANTHROPIC_API_KEY=sk-ant-..." > .env
chmod 600 .env

Start Hermes

Launch the container with Docker Compose. Verify it's running.

docker compose up -d
docker compose logs -f hermes
# Ctrl-C to detach. Container keeps running.

Access the dashboard
Hermes binds to localhost on the Pi, but you'll access it from your laptop via Tailscale. The Pi's Tailscale IP is shown by `tailscale ip`. Open that IP on port 8765 from your laptop.
```
tailscale ip -4
# Returns 100.x.y.z

# On your laptop, open http://100.x.y.z:8765 in a browser.
# (You can also configure Tailscale Funnel if you want
#  HTTPS without certificates, see Tailscale docs.)
```
First conversation
The dashboard should now show the Hermes UI. Ask it something simple. Verify the response and check the audit log shows the call. If it works, you're done.

Troubleshooting

docker: command not found after install script: Log out and back in (or run `newgrp docker`). The convenience script adds your user to the docker group but the current shell doesn't pick it up until session restart.
Hermes container exits immediately: Check `docker compose logs hermes`. Most common: missing or invalid ANTHROPIC_API_KEY in .env. Less common: port 8765 already in use.
Dashboard slow / hangs: On a Pi 5 (8 GB) with browser tool enabled, the Chromium container will saturate RAM. Confirm HERMES_BROWSER_TOOL=false in the compose file. If it is, check `docker stats` for memory pressure on other containers.
Tailscale unreachable from laptop: Ensure your laptop is also signed into Tailscale and the device is approved in the Tailscale admin console. ACLs default-allow within a tailnet but corporate Tailscale tenants may have restrictive ACLs.

Where to go from here

Add a local LLM fallback with Ollama + Mistral 7B Q4 — useful when Claude is rate-limited and for cost-sensitive subtasks. Or upgrade hardware to a generic Intel mini PC for browser automation support.