Hermes
54e0661396
The Dockerfile was switching to USER root for the final chown but never switched back to USER hermes. This caused ALL container processes to run as root (uid 0) instead of the hermes user (uid 10000). The entrypoint's gosu privilege drop only caught the main exec chain, leaving backgrounded subprocesses (dashboard PTY sessions, workers with start_new_session=True) running as root — creating files owned by root in ExoKortex and breaking Syncthing sync. Adding USER hermes at the end ensures the container runs unprivileged and ALL child processes inherit uid 10000 from the start.