hermes - 💡(How to fix) Fix v0.11.0 Dockerfile: final `USER hermes` breaks entrypoint UID remap, contradicts docs [2 comments, 3 participants]

The v0.11.0 Dockerfile (line 46) ends with USER hermes and never restores USER root. As a result, the container starts as the baked-in hermes user (UID 10000), and the entrypoint's UID-remap branch (entrypoint.sh:11) — gated on id -u == 0 — is silently skipped.

The user-guide docs (website/docs/user-guide/docker.md:256) state "The container runs as root by default." The Dockerfile contradicts this.

Symptom

mkdir: cannot create directory '/opt/data': Permission denied in a tight crash loop, when the host-side data dir is owned by anything other than UID 10000.

Repro

```yaml services: hermes: image: hermes:v2026.4.23 environment: - HERMES_UID=1002 - HERMES_GID=1002 volumes: - ./data:/opt/data # owned by host UID 1002 ```

Workaround

`user: "0:0"` in compose forces root start; entrypoint then drops to `HERMES_UID` correctly.

Fix

Add `USER root` after the venv install step in the Dockerfile, before `ENTRYPOINT`. The v0.10.0 Dockerfile had this; v0.11.0 lost it during the refactor that introduced the `web/` build layer.

Diff vs v0.10.0

v0.10.0 had `USER root` at line 41 specifically to enable runtime UID remap. v0.11.0's restructured layout puts `USER hermes` at line 46 with no subsequent `USER root`.