{"repo":"NousResearch/hermes-agent","public_id":"21536","display_label":"Docker venv ownership fix for non-root users","summary":"These issues and pull requests address a bug where the Python virtual environment has incorrect ownership, preventing non-root container users from using or modifying it. The proposed fixes involve changing the venv directory ownership to the appropriate non-root user.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":24841,"merged_at":"2026-05-13T06:25:07+00:00"},"resolution":{"state":"resolved","by":"pr-24841"},"freshness":{"state":"verified","last_verified_at":"2026-05-13T06:25:07+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":21536,"pr_number":24841,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-05-13T06:25:07+00:00"}],"members":[{"kind":"issue","number":21536,"title":"[Bug]: Python venv ownership prevents non-root container usage, breaking security best practices","url":null,"state":"closed"},{"kind":"pr","number":21543,"title":"fix(docker): chown venv to hermes user for non-root container support","url":null,"state":"closed","close_reason":{"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":21755,"title":"fix(docker): chown virtualenv for non-root runtime","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#17674","number":17674},{"kind":"pr","value":"#21543","number":21543}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":24841,"title":"fix(docker): chown .venv to hermes so lazy_deps can install platform packages","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["Dockerfile","docker/entrypoint.sh"],"fix_hunks":[{"file":"Dockerfile","hunks":["@@ -94,9 +94,13 @@ RUN cd web && npm run build && \\\n # hermes_cli/main.py succeeds (see #18800). /opt/hermes/web is build-time\n # only (HERMES_WEB_DIST points at hermes_cli/web_dist) and is intentionally\n # not chowned here.\n+# The .venv MUST be hermes-writable so lazy_deps.py can install platform\n+# packages (discord.py, telegram, slack, etc.) at first gateway boot.\n+# Without this, `uv pip install` fails with EACCES and all messaging\n+# adapters silently fail to load.  See tools/lazy_deps.py.\n USER root\n RUN chmod -R a+rX /opt/hermes && \\\n-    chown -R hermes:hermes /opt/hermes/ui-tui /opt/hermes/node_modules\n+    chown -R hermes:hermes /opt/hermes/.venv /opt/hermes/ui-tui /opt/hermes/node_modules\n # Start as root so the entrypoint can usermod/groupmod + gosu.\n # If HERMES_UID is unset, the entrypoint drops to the default hermes user (10000).\n "]},{"file":"docker/entrypoint.sh","hunks":["@@ -39,6 +39,10 @@ if [ \"$(id -u)\" = \"0\" ]; then\n         # by the mapped user on the host side.\n         chown -R hermes:hermes \"$HERMES_HOME\" 2>/dev/null || \\\n             echo \"Warning: chown failed (rootless container?) — continuing anyway\"\n+        # The .venv must also be re-chowned when UID is remapped, otherwise\n+        # lazy_deps.py cannot install platform packages (discord.py, etc.).\n+        chown -R hermes:hermes \"$INSTALL_DIR/.venv\" 2>/dev/null || \\\n+            echo \"Warning: chown .venv failed (rootless container?) — continuing anyway\"\n     fi\n \n     # Ensure config.yaml is readable by the hermes runtime user even if it was\n"]}]}],"trust":{"default_tier":"verified","includes_suggested":false}}