From 2ff889d297018f102df6b288b1e96abce24f69d2 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@nousresearch.com>
Date: Wed, 6 May 2026 19:56:22 +0000
Subject: [PATCH] fix(hermes-webui): fsGroup=1000 + PodSecurity compliance for
 PVC access

---
 apps/base/customer1/hermes-agent/deployment.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index 721fa52..7a67a6e 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -13,8 +13,18 @@ spec:
       labels:
         app: hermes-agent
     spec:
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
       containers:
       - name: hermes-agent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         image: nousresearch/hermes-agent:latest
         command: ["/bin/bash", "-c"]
         args:
@@ -121,6 +131,7 @@ spec:
             - ALL
           runAsNonRoot: true
           runAsUser: 1000
+          runAsGroup: 1000
           seccompProfile:
             type: RuntimeDefault
       volumes: