sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(hermes-webui): hermes-agent as root (runAsUser:0), webui as uid1000

Browse source 
Removed pod runAsUser/runAsNonRoot to allow hermes-agent root.
Hermes-agent: runAsUser:0 runAsGroup:0 (root).
Hermes-webui: runAsUser:1000 runAsGroup:1000 (non-root, matches WANTED_UID).
This commit is contained in:
Hermes Agent 2026-05-07 13:45:42 +00:00
parent 7a76e088e4
commit 3c8b617471
1 changed files with 6 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
apps/base/customer1/hermes-agent/deployment.yaml
View file

@ -15,11 +15,7 @@ spec:
spec: spec:
securityContext: securityContext:
fsGroup: 1000 fsGroup: 1000
runAsGroup: 1000
securityContext:
runAsUser: 0
runAsGroup: 0
containers: containers:
- name: hermes-agent - name: hermes-agent
securityContext: securityContext:
@ -31,7 +27,6 @@ spec:
runAsGroup: 0 runAsGroup: 0
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
runAsNonRoot: false
image: nousresearch/hermes-agent:latest image: nousresearch/hermes-agent:latest
command: ["/bin/bash", "-c"] command: ["/bin/bash", "-c"]
args: args:
@ -157,11 +152,13 @@ spec:
memory: 512Mi memory: 512Mi
cpu: "500m" cpu: "500m"
securityContext: securityContext:
allowPrivilegeEscalation: true allowPrivilegeEscalation: false
capabilities: capabilities:
drop: drop:
- ALL - ALL
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
volumes: volumes: