From c84ef732f8903a2be445f939a9de5cdeda55395f Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Thu, 7 May 2026 01:28:39 +0000 Subject: [PATCH 1/6] fix hermes webui --- apps/base/customer1/hermes-agent/deployment.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml index 533f64c..cdfe4ca 100644 --- a/apps/base/customer1/hermes-agent/deployment.yaml +++ b/apps/base/customer1/hermes-agent/deployment.yaml @@ -15,7 +15,7 @@ spec: spec: securityContext: fsGroup: 1000 - runAsGroup: 1000 + initContainers: - name: create-webui-user image: busybox @@ -38,6 +38,8 @@ spec: capabilities: drop: - ALL + runAsUser: 0 + runAsGroup: 0 seccompProfile: type: RuntimeDefault image: nousresearch/hermes-agent:latest From d187eae3753a48a8d4e49c24bdb6172f6a1c8cb3 Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Thu, 7 May 2026 01:32:24 +0000 Subject: [PATCH 2/6] fix priv escalation --- apps/base/customer1/hermes-agent/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml index cdfe4ca..9b9157c 100644 --- a/apps/base/customer1/hermes-agent/deployment.yaml +++ b/apps/base/customer1/hermes-agent/deployment.yaml @@ -168,7 +168,7 @@ spec: memory: 512Mi cpu: "500m" securityContext: - allowPrivilegeEscalation: false + allowPrivilegeEscalation: true capabilities: drop: - ALL From d87f5963d3376cff0468471474cddb82f329f50d Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Thu, 7 May 2026 01:43:57 +0000 Subject: [PATCH 3/6] webui fix --- apps/base/customer1/hermes-agent/deployment.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml index 9b9157c..04620eb 100644 --- a/apps/base/customer1/hermes-agent/deployment.yaml +++ b/apps/base/customer1/hermes-agent/deployment.yaml @@ -173,8 +173,6 @@ spec: drop: - ALL - runAsUser: 1000 - runAsGroup: 1000 seccompProfile: type: RuntimeDefault volumes: From bdcaf9f8f62cbcab3e94916c56abb1e44fd445b8 Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Thu, 7 May 2026 02:16:48 +0000 Subject: [PATCH 4/6] fix webui --- .../customer1/hermes-agent/deployment.yaml | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml index 04620eb..08c6071 100644 --- a/apps/base/customer1/hermes-agent/deployment.yaml +++ b/apps/base/customer1/hermes-agent/deployment.yaml @@ -18,19 +18,39 @@ spec: initContainers: - name: create-webui-user - image: busybox + image: busybox:1.36 command: - sh - -c - | + set -e + echo "Creating users/groups for hermes-webui..." + + # Root + echo "root:x:0:0:root:/root:/bin/sh" >> /etc/passwd + echo "root:x:0:" >> /etc/group + + # Target user echo "hermeswebui:x:1000:1000::/home/hermeswebui:/bin/sh" >> /etc/passwd echo "hermeswebui:x:1000:" >> /etc/group + + # Internal sudo-enabled user the image expects + echo "hermeswebuitoo:x:1025:1025::/home/hermeswebuitoo:/bin/sh" >> /etc/passwd + echo "hermeswebuitoo:x:1025:" >> /etc/group + + # Sudoers + mkdir -p /etc/sudoers.d + echo 'hermeswebuitoo ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/hermeswebuitoo + chmod 0440 /etc/sudoers.d/hermeswebuitoo + + echo "✅ Users and sudoers created" securityContext: runAsUser: 0 runAsGroup: 0 volumeMounts: - name: webui-etc mountPath: /etc + containers: - name: hermes-agent securityContext: From bbc662cd85d273bf9c89660f7005f5a61a7397d4 Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Thu, 7 May 2026 02:22:18 +0000 Subject: [PATCH 5/6] plz --- apps/base/customer1/hermes-agent/deployment.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml index 08c6071..cc47d6f 100644 --- a/apps/base/customer1/hermes-agent/deployment.yaml +++ b/apps/base/customer1/hermes-agent/deployment.yaml @@ -202,8 +202,6 @@ spec: - name: hermes-data persistentVolumeClaim: claimName: hermes-agent-pvc - - name: webui-etc - emptyDir: {} --- apiVersion: v1 kind: PersistentVolumeClaim From b8be0c5315d700dec1c0bc0ee00e20373ced6501 Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Wed, 6 May 2026 22:51:14 -0400 Subject: [PATCH 6/6] Update kustomization.yaml --- infrastructure/gpus/staging/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/gpus/staging/kustomization.yaml b/infrastructure/gpus/staging/kustomization.yaml index b466923..37d0cdd 100644 --- a/infrastructure/gpus/staging/kustomization.yaml +++ b/infrastructure/gpus/staging/kustomization.yaml @@ -1,5 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base/vllm-servers/ + # - ../base/vllm-servers/ # - ../base/keda-gpu-scaling/