common/hermes
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(docker): refuse root gateway runs in official image

Browse Source
This commit is contained in:
LeonSGP43
2026-05-03 20:56:08 +08:00
committed by Teknium
parent afbcca0f06
commit 84287b0de8
4 changed files with 81 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
website/docs/user-guide/docker.md
View File

@@ -271,6 +271,10 @@ The entrypoint script (`docker/entrypoint.sh`) bootstraps the data volume on fir
- Optionally launches `hermes dashboard` as a background side-process when `HERMES_DASHBOARD=1` (see [Running the dashboard](#running-the-dashboard))
- Then runs `hermes` with whatever arguments you pass
:::warning
Do not override the image entrypoint unless you keep `/opt/hermes/docker/entrypoint.sh` in the command chain. The entrypoint drops root privileges to the `hermes` user before gateway state files are created. Starting `hermes gateway run` as root inside the official image is refused by default because it can leave root-owned files in `/opt/data` and break later dashboard or gateway starts. Set `HERMES_ALLOW_ROOT_GATEWAY=1` only when you intentionally accept that risk.
:::
## Upgrading
Pull the latest image and recreate the container. Your data directory is untouched.