From 54e06613960446e593c170581cc263d3999538bc Mon Sep 17 00:00:00 2001 From: Hermes Date: Tue, 7 Jul 2026 14:58:44 -0400 Subject: [PATCH] fix: add missing USER hermes at end of Dockerfile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Dockerfile was switching to USER root for the final chown but never switched back to USER hermes. This caused ALL container processes to run as root (uid 0) instead of the hermes user (uid 10000). The entrypoint's gosu privilege drop only caught the main exec chain, leaving backgrounded subprocesses (dashboard PTY sessions, workers with start_new_session=True) running as root — creating files owned by root in ExoKortex and breaking Syncthing sync. Adding USER hermes at the end ensures the container runs unprivileged and ALL child processes inherit uid 10000 from the start. --- ai/hermes/Dockerfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ai/hermes/Dockerfile b/ai/hermes/Dockerfile index 8459749..8cf1e6d 100644 --- a/ai/hermes/Dockerfile +++ b/ai/hermes/Dockerfile @@ -75,3 +75,8 @@ USER root RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py VOLUME [ "/opt/data" ] + +# Switch to the hermes user so the container runs unprivileged. +# All child processes inherit this user — no more orphan root processes +# that escape gosu privilege drops in the entrypoint. +USER hermes