From bfa8daa7db7a576764bc2fcadb788ddec11e1e91 Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@proton.me>
Date: Fri, 8 May 2026 01:44:55 +0000
Subject: [PATCH] sec context

---
 .../customer1/hermes-agent/deployment.yaml     | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index 1b747ff..aa87681 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -12,10 +12,26 @@ spec:
     metadata:
       labels:
         app: hermes-agent
-    spec: 
+    spec:
+      initContainers:
+        - name: fix-volume-permissions
+          image: busybox:latest
+          # Run a quick chown to give user 10000 and group 10000 full ownership
+          command: ["sh", "-c", "chown -R 10000:10000 /opt/data"]
+          securityContext:
+            runAsUser: 0             # Must run as root to change permissions
+            runAsNonRoot: false
+          volumeMounts:
+          - name: hermes-data
+            mountPath: /opt/data
       containers:
       - name: hermes-agent
         image: nousresearch/hermes-agent:latest
+        securityContext:
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            allowPrivilegeEscalation: true 
         ports:
         -  containerPort: 8642 
         command: ["/bin/bash", "-c"]