hermes - ✅(Solved) Fix default entrypoint.sh recursively chown's to 10000:10000 - good thing I never ran it on my host root [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#19788Fetched 2026-05-05 06:05:11
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Participants
Timeline (top)
labeled ×3cross-referenced ×1

Root Cause

It's not really a "bug" because it's done that way on purpose. It's not really a "security" issue because it's done that way on purpose. It's more like a loose cannon, shipping fully loaded, tamped, primed, and cocked. I kinda think it's insane and would much prefer a spawned ineffective invalid rather than an I'll-happily-chown-your-entire-tree for you without warning. BEWARE when running in what you Think is a safely "sandboxed" docker -- this thing can blow your leg off before it even runs the hermes-agent!

Fix Action

Fixed

PR fix notes

PR #19795: fix(docker): replace recursive chown with targeted per-directory chown

Description (problem / solution / changelog)

Fix #19788 — Avoid destructive recursive chown in Docker entrypoint

Problem

The docker/entrypoint.sh ran chown -R hermes:hermes "$HERMES_HOME" when ownership needed fixing. Since HERMES_HOME is typically a bind mount (-v /host/path:/opt/data), this recursively changed every file's owner on the host filesystem — including system files if the user naively mounted /.

Solution

Replace the recursive chown -R with targeted, non-recursive chown of only the specific subdirectories hermes actually writes to at runtime:

chown hermes:hermes "$HERMES_HOME"
for subdir in cron sessions logs hooks memories skills skins plans workspace home; do
    mkdir -p "$HERMES_HOME/$subdir"
    chown hermes:hermes "$HERMES_HOME/$subdir"
done

This preserves host-side file ownership while still ensuring hermes has write access to its working directories.

Testing

  • docker build completes successfully
  • Entrypoint correctly creates subdirectories
  • Ownership is set correctly when HERMES_UID differs from default

Related

  • Fixes #19788

Changed files

  • docker/entrypoint.sh (modified, +12/-2)
RAW_BUFFERClick to expand / collapse

It's not really a "bug" because it's done that way on purpose. It's not really a "security" issue because it's done that way on purpose. It's more like a loose cannon, shipping fully loaded, tamped, primed, and cocked. I kinda think it's insane and would much prefer a spawned ineffective invalid rather than an I'll-happily-chown-your-entire-tree for you without warning. BEWARE when running in what you Think is a safely "sandboxed" docker -- this thing can blow your leg off before it even runs the hermes-agent!

extent analysis

TL;DR

Be cautious when running the application in a Docker container, as it may have unintended consequences on the host system.

Guidance

  • The application appears to have elevated privileges, which can lead to unintended consequences, such as modifying the host system's file tree.
  • When running the application in a Docker container, ensure that the container is properly configured to prevent it from accessing sensitive areas of the host system.
  • Consider using Docker's built-in security features, such as user namespaces and mount flags, to restrict the container's privileges.
  • Test the application in a controlled environment before running it in production to understand its behavior and potential risks.

Notes

The issue lacks specific technical details, making it difficult to provide a more targeted solution. However, the warning suggests that the application's behavior is intentional, and caution is advised when running it in a Docker container.

Recommendation

Apply workaround: Use Docker's security features to restrict the container's privileges and prevent unintended consequences on the host system.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - ✅(Solved) Fix default entrypoint.sh recursively chown's to 10000:10000 - good thing I never ran it on my host root [1 pull requests, 1 participants]