Install

hermetic ships as a macOS desktop app. The hermetic CLI is bundled inside it.

Requirements

• A Mac with Apple silicon. There is no Intel or Linux build.
• For a real fleet: an AWS account and a Tailscale tailnet. Your first fleet lists exactly what each needs.

Install the app

1. Download macos-arm64-Hermetic.dmg from the latest release.

2. Open it and drag Hermetic.app into /Applications.

3. Clear the quarantine flag once:

   xattr -dr com.apple.quarantine /Applications/Hermetic.app

The build is unsigned. It has only an ad-hoc signature, so macOS quarantines it on first open and offers only “Move to Trash” until the flag is cleared.

Install the CLI

In the app’s menu, choose Install Command Line Tool…. It writes a shim at /usr/local/bin/hermetic that points at the binary inside the app, so the CLI stays at the same version as the app.

Check it:

hermetic --version

Updates

The app checks for a new release on launch and every six hours. It downloads a patch when you are one release behind and the full archive otherwise, and applies it on the next restart.

The update check is unauthenticated, so it only works once the esopian/hermetic repository is public. While it is private, update by downloading the newer DMG.