From 8f52cb1c25f4965f373a14a9ff877c0a5c4624ee Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@nousresearch.com>
Date: Thu, 7 May 2026 14:24:25 +0000
Subject: [PATCH] fix(hermes-webui): add initContainer root chown for PVC uid
 perms

- Removes pod runAsNonRoot/runAsUser to allow init runAsUser: 0
- chowns PVC to 1000:1000 + g+rwX (fixes legacy root-owned files)
- webui can now mkdir/write state dir
- whoami log non-fatal; runtime non-root
---
 .../base/customer1/hermes-agent/deployment.yaml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index 0f3423b..1ea8944 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -14,10 +14,23 @@ spec:
         app: hermes-agent
     spec:
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000
+      initContainers:
+      - name: fix-webui-perms
+        image: busybox:1.36
+        securityContext:
+          runAsUser: 0
+        command:
+          - sh
+          - -c
+        args:
+          - |
+            chown -R 1000:1000 /data
+            chmod -R g+rwX,o-rwx /data
+        volumeMounts:
+          - name: hermes-data
+            mountPath: /data
       containers:
       - name: hermes-agent
         securityContext: