From 22964a16a862f1ff5bba807092d4a97cdecc989d Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@nousresearch.com>
Date: Thu, 7 May 2026 13:14:01 +0000
Subject: [PATCH] fix(hermes-webui): remove root initContainer and custom /etc
 mount to fix read-only fs + sudo error

- Removed initContainer running as root (violates PodSecurity restricted:latest)
- Removed shared emptyDir /etc mount (no longer needed)
- Rely on fsGroup:1000 + runAsUser:1000 for volume ownership and container UID
- Added runAsNonRoot: true to podSecurityContext and both containers for policy compliance

Pod will now start, webui runs as UID 1000 == WANTED_UID, init.bash skips chown/sudo.
---
 .../customer1/hermes-agent/deployment.yaml    | 26 +++++--------------
 1 file changed, 6 insertions(+), 20 deletions(-)

diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index 533f64c..cdaba76 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -16,21 +16,8 @@ spec:
       securityContext:
         fsGroup: 1000
         runAsGroup: 1000
-      initContainers:
-      - name: create-webui-user
-        image: busybox
-        command:
-          - sh
-          - -c
-          - |
-            echo "hermeswebui:x:1000:1000::/home/hermeswebui:/bin/sh" >> /etc/passwd
-            echo "hermeswebui:x:1000:" >> /etc/group
-        securityContext:
-          runAsUser: 0
-          runAsGroup: 0
-        volumeMounts:
-        - name: webui-etc
-          mountPath: /etc
+        runAsNonRoot: true
+
       containers:
       - name: hermes-agent
         securityContext:
@@ -40,6 +27,7 @@ spec:
             - ALL
           seccompProfile:
             type: RuntimeDefault
+          runAsNonRoot: true
         image: nousresearch/hermes-agent:latest
         command: ["/bin/bash", "-c"]
         args:
@@ -156,8 +144,7 @@ spec:
         volumeMounts:
         - name: hermes-data
           mountPath: /home/hermeswebui/.hermes
-        - name: webui-etc
-          mountPath: /etc
+
         resources:
           requests:
             memory: 256Mi
@@ -170,7 +157,7 @@ spec:
           capabilities:
             drop:
             - ALL
-          
+          runAsNonRoot: true
           runAsUser: 1000
           runAsGroup: 1000
           seccompProfile:
@@ -182,8 +169,7 @@ spec:
       - name: hermes-data
         persistentVolumeClaim:
           claimName: hermes-agent-pvc
-      - name: webui-etc
-        emptyDir: {}
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim