From 3c8b617471ee97260067dd72758d7ec762969cac Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@nousresearch.com>
Date: Thu, 7 May 2026 13:45:42 +0000
Subject: [PATCH] fix(hermes-webui): hermes-agent as root (runAsUser:0), webui
 as uid1000

Removed pod runAsUser/runAsNonRoot to allow hermes-agent root.
Hermes-agent: runAsUser:0 runAsGroup:0 (root).
Hermes-webui: runAsUser:1000 runAsGroup:1000 (non-root, matches WANTED_UID).
---
 apps/base/customer1/hermes-agent/deployment.yaml | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index adbb114..610b8b5 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -15,11 +15,7 @@ spec:
     spec:
       securityContext:
         fsGroup: 1000
-        
-     
-        securityContext:
-          runAsUser: 0
-          runAsGroup: 0   
+        runAsGroup: 1000
       containers:
       - name: hermes-agent
         securityContext:
@@ -31,7 +27,6 @@ spec:
           runAsGroup: 0
           seccompProfile:
             type: RuntimeDefault
-          runAsNonRoot: false
         image: nousresearch/hermes-agent:latest
         command: ["/bin/bash", "-c"]
         args:
@@ -157,11 +152,13 @@ spec:
             memory: 512Mi
             cpu: "500m"
         securityContext:
-          allowPrivilegeEscalation: true
+          allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
-          
+          runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 1000
           seccompProfile:
             type: RuntimeDefault
       volumes:
@@ -182,4 +179,4 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 25Gi
+      storage: 25Gi
\ No newline at end of file