From 560f5b76cff7f626676094994c8319971cdb67ed Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@nousresearch.com>
Date: Thu, 7 May 2026 14:36:29 +0000
Subject: [PATCH] fix(hermes-webui): webui runAsUser: 0 to trigger image
 entrypoint chown/gosu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- WANTED_UID=1000 detects root → chowns volumes + gosu 1000 app (runtime non-root)
- Fixes whoami (root phase OK) + double-perm fix w/ init
- PodSecurity OK (per-container fields; pod no runAsNonRoot)
---
 apps/base/customer1/hermes-agent/deployment.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index 1ea8944..d53eea5 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -168,13 +168,11 @@ spec:
             memory: 512Mi
             cpu: "500m"
         securityContext:
-          allowPrivilegeEscalation: false
+          allowPrivilegeEscalation: true
           capabilities:
             drop:
             - ALL
-          runAsNonRoot: true
-          runAsUser: 1000
-          runAsGroup: 1000
+          runAsUser: 0
           seccompProfile:
             type: RuntimeDefault
       volumes: