fix

apps/base/customer1/hermes-agent/deployment.yaml

@@ -128,7 +128,7 @@ spec:
           - name: HERMES_WEBUI_STATE_DIR
             value: "/home/hermeswebui/.hermes/webui"
           - name: WANTED_UID
-            value: "1024"
+            value: "10000"
           - name: WANTED_GID
             value: "1000"
         
@@ -148,7 +148,7 @@ spec:
         
         securityContext:
           
-          runAsUser: 1024
+          runAsUser: 10000
           runAsGroup: 1000
           runAsNonRoot: false
           allowPrivilegeEscalation: true

apps/base/customer1/hermes-agent/kustomization.yaml

@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - deployment.yaml
+  - new-deployment.yaml
   - hermes-secret.yaml
   - configmap.yaml
   - rays-hermes-secret.yaml

apps/base/customer1/hermes-agent/new_deployment.yaml

@@ -0,0 +1,120 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hermes-agent
+  namespace: customer1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hermes-agent
+  template:
+    metadata:
+      labels:
+        app: hermes-agent
+    spec:
+      # 1. Pod-level security context to ensure volumes inherit the right group
+      securityContext:
+        fsGroup: 10000
+
+      # 2. Define our shared bridge volumes
+      volumes:
+      - name: hermes-home
+        persistentVolumeClaim:
+          claimName: hermes-agent-pvc
+      - name: hermes-agent-src
+        emptyDir: {}
+      - name: hermes-workspace
+        emptyDir: {}
+
+      initContainers:
+      # 3. K8s workaround: Copy the agent source code into the shared emptyDir
+      - name: copy-agent-source
+        image: nousresearch/hermes-agent:latest
+        command: 
+        - "sh"
+        - "-c"
+        - "cp -a /opt/hermes/. /shared-src/ && chown -R 10000:10000 /shared-src /shared-home"
+        securityContext:
+          runAsUser: 0 # Run as root briefly to copy and fix permissions
+          runAsNonRoot: false
+        volumeMounts:
+        - name: hermes-agent-src
+          mountPath: /shared-src
+        - name: hermes-home
+          mountPath: /shared-home
+
+      containers:
+      # ==========================================
+      # CONTAINER 1: HERMES AGENT
+      # ==========================================
+      - name: hermes-agent
+        image: nousresearch/hermes-agent:latest
+        command: ["gateway", "run"]
+        ports:
+        - containerPort: 8642
+        
+        env:
+        - name: HERMES_HOME
+          value: "/home/hermes/.hermes"
+        - name: HERMES_UID
+          value: "10000"
+        - name: HERMES_GID
+          value: "10000"
+          
+        # (Add your API Key secrets here just like your original deployment)
+        
+        volumeMounts:
+        - name: hermes-home
+          mountPath: /home/hermes/.hermes
+        - name: hermes-agent-src
+          mountPath: /opt/hermes
+
+        securityContext:
+          runAsUser: 10000
+          runAsGroup: 10000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+
+      # ==========================================
+      # CONTAINER 2: HERMES WEBUI
+      # ==========================================
+      - name: hermes-webui
+        image: ghcr.io/nesquena/hermes-webui:latest
+        ports:
+        - containerPort: 8787
+        
+        env:
+        - name: HERMES_WEBUI_HOST
+          value: "0.0.0.0"
+        - name: HERMES_WEBUI_PORT
+          value: "8787"
+        - name: HERMES_WEBUI_STATE_DIR
+          value: "/home/hermeswebui/.hermes/webui"
+        - name: WANTED_UID
+          value: "10000"
+        - name: WANTED_GID
+          value: "10000"
+          
+        volumeMounts:
+        - name: hermes-home
+          mountPath: /home/hermeswebui/.hermes
+        # This is where the WebUI looks for the agent source code to run `uv pip install`
+        - name: hermes-agent-src
+          mountPath: /home/hermeswebui/.hermes/hermes-agent
+        - name: hermes-workspace
+          mountPath: /workspace
+
+        resources:
+          requests:
+            memory: 500Mi
+            cpu: "100m"
+          limits:
+            memory: 1Gi
+            cpu: "500m"
+
+        securityContext:
+          runAsUser: 10000
+          runAsGroup: 10000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false