Teknium 9ef1ae138a fix(docker): don't chown config.yaml after gosu drop (#15865) (#16096) ...

The chown/chmod block on config.yaml was added in b24d239ce to keep the
file readable by the hermes runtime user, but it sat in the post-gosu
'running as hermes' section of the entrypoint. That meant:

1. Default `docker run <image>` — container starts as root, entrypoint
   drops to hermes via gosu, then non-root hermes tries to chown the
   file to hermes. Works by coincidence because the file was just
   created by root during volume setup and gosu target == target owner.
2. `docker run -u $(id -u):$(id -g) <image>` (#15865) — container
   starts as the caller's UID. The root block is skipped entirely, we
   land in the hermes section as some arbitrary non-root user, and
   chown to 'hermes' fails with 'Operation not permitted'. Script
   aborts under `set -e`.

Move the chown/chmod into the root block (before the gosu exec) where
it actually has privilege, and guard with `2>/dev/null || true` so
rootless Podman (where even in-container root lacks host-side chown
rights) doesn't abort either.

Closes #15865

2026-04-26 08:27:39 -07:00

..

entrypoint.sh

fix(docker): don't chown config.yaml after gosu drop (#15865) (#16096)

2026-04-26 08:27:39 -07:00

SOUL.md

feat(docker): add Docker container for the agent (salvage #1841) (#3668)

2026-03-28 22:21:48 -07:00