The chown -R hermes:hermes was running as non-root user 'hermes' since USER hermes was set earlier. The new upstream base image (v0.12.0+) has tools/ owned by root, so the chown fails. Previous base image happened to have tools/ owned by hermes, making the chown a silent no-op.