From dfe32018b775d9701786c068ba72e1735269ad5f Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@nousresearch.com>
Date: Thu, 7 May 2026 14:12:57 +0000
Subject: [PATCH] fix(hermes-webui): hermes-agent main container non-root
 (UID/GID 1000)

- Aligns with webui sidecar on shared hermes-data PVC (/opt/data == /home/hermeswebui/.hermes)
- Previously root:root files blocked webui writes (whoami non-fatal)
- Pod securityContext: runAsNonRoot: true + runAsUser: 1000 for restricted:latest compliance
- fsGroup:1000 ensures volume g+rw
---
 apps/base/customer1/hermes-agent/deployment.yaml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/apps/base/customer1/hermes-agent/deployment.yaml b/apps/base/customer1/hermes-agent/deployment.yaml
index f7abcf7..0f3423b 100644
--- a/apps/base/customer1/hermes-agent/deployment.yaml
+++ b/apps/base/customer1/hermes-agent/deployment.yaml
@@ -14,8 +14,10 @@ spec:
         app: hermes-agent
     spec:
       securityContext:
-        fsGroup: 1000
+        runAsNonRoot: true
         runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
       containers:
       - name: hermes-agent
         securityContext:
@@ -23,8 +25,8 @@ spec:
           capabilities:
             drop:
             - ALL
-          runAsUser: 0
-          runAsGroup: 0
+          runAsUser: 1000
+          runAsGroup: 1000
           seccompProfile:
             type: RuntimeDefault
         image: nousresearch/hermes-agent:latest