The nousresearch/hermes-agent:latest image creates its venv as root. Running 'uv pip install' as USER hermes fails with Permission denied on the site-packages directory. Fix: keep USER root while modifying the venv, then switch back to USER hermes for runtime.