Cairn

Docker chown symlink risk and targeted fix efforts

NousResearch/hermes-agent · cluster 19788 · environments

Data as of

Nothing open on GitHub. Fix merged in #33033. Check it covers your case.

The short answer

0open issues
0open PRs
6items grouped
Known?
Yes. 6 related items grouped here, 2 issues already closed.
Fix event
A fix was merged to main in PR #33033. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PRs #33033, #52789. That is separate from the fix event.
Still open
Nothing open on GitHub.

These issues and PRs concern a dangerous recursive chown in Docker entrypoint scripts that follows symlinks and can corrupt host filesystem ownership. Multiple fixes propose replacing or constraining the recursive chown with more targeted, symlink-aware approaches.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #33033 fix(docker): targeted chown to preserve host file ownership in HERMES_HOME (#19795)

    merged to main

    files: docker/stage2-hook.sh

  • #52789 fix(docker): skip symlinked stage2 chown targets

    merged to main

    files: docker/stage2-hook.sh, tests/test_docker_home_override_scripts.py, tests/tools/test_stage2_hook_gateway_bootstrap_state.py, tests/tools/test_stage2_hook_seed_one_symlinks.py, tests/tools/test_stage2_hook_symlink_chown.py, tests/tools/test_stage2_hook_toplevel_chown.py

2 PRs closed without merging

From the close comments: merged via another change 2

  • #19795 fix(docker): replace recursive chown with targeted per-directory chown · merged via another change → 9eadb68, #33033, #19788
  • #52793 fix: avoid recursive chown through symlinks · merged via another change → #52789, #52781
Closed issues · 2
  • Closed#19788default entrypoint.sh recursively chown's to 10000:10000 - good thing I never ran it on my host root
  • Closed#52781fix(docker): stage2-hook chown -R follows symlinks, can destroy user home directory
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.29: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
environments
Merged PRs
#33033, #52789
Closed issues
2
Attempts
2 PRs closed without merging
Fix link checked
26 Jun 2026

For your agent

The same facts, typed.

cluster/19788.json
cluster/19788.md