fix: add missing USER hermes at end of Dockerfile #55

Hermes · 2026-07-07T19:25:36Z

Hermes commented

2026-07-07 19:25:36 +00:00

Problem

The Hermes Dockerfile switches to USER root for the final RUN chown but never switches back to USER hermes. This causes ALL container processes to run as root (uid 0) instead of hermes (uid 10000).

Background subprocesses spawned by the dashboard (with start_new_session=True) escape the entrypoint's gosu hermes privilege drop and remain root — creating root-owned files in ExoKortex that break Syncthing sync.

Fix

Add USER hermes at the end of the Dockerfile, after VOLUME. The container now runs unprivileged from the start — every child process inherits uid 10000.

Changes

ai/hermes/Dockerfile: add missing USER hermes at end of file

## Problem The Hermes Dockerfile switches to `USER root` for the final `RUN chown` but never switches back to `USER hermes`. This causes ALL container processes to run as root (uid 0) instead of hermes (uid 10000). Background subprocesses spawned by the dashboard (with `start_new_session=True`) escape the entrypoint's `gosu hermes` privilege drop and remain root — creating root-owned files in ExoKortex that break Syncthing sync. ## Fix Add `USER hermes` at the end of the Dockerfile, after `VOLUME`. The container now runs unprivileged from the start — every child process inherits uid 10000. ## Changes - `ai/hermes/Dockerfile`: add missing `USER hermes` at end of file

Hermes added 3 commits 2026-07-07 19:25:38 +00:00

Local change dump 2571930efa

fix: add missing USER hermes at end of Dockerfile 54e0661396

The Dockerfile was switching to USER root for the final chown but never
switched back to USER hermes. This caused ALL container processes to run
as root (uid 0) instead of the hermes user (uid 10000).

The entrypoint's gosu privilege drop only caught the main exec chain,
leaving backgrounded subprocesses (dashboard PTY sessions, workers with
start_new_session=True) running as root — creating files owned by root
in ExoKortex and breaking Syncthing sync.

Adding USER hermes at the end ensures the container runs unprivileged
and ALL child processes inherit uid 10000 from the start.

Merge remote-tracking branch 'origin/master' into local_changes

Build Hermes agent / build (pull_request) Has been cancelled

Details

Build ollama (gfx906) / build (pull_request) Has been cancelled

Details

dab1ecfdd7

# Conflicts:
#	ai/compose.yml

gortium merged commit 2d2787f404 into master

2026-07-07 19:41:31 +00:00

gortium referenced this issue from a commit

2026-07-07 19:41:34 +00:00

Merge pull request 'fix: add missing USER hermes at end of Dockerfile' (#55) from local_changes into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: gortium/compose#55