The v0.11.0 Dockerfile (line 46) ends with USER hermes and never restores USER root. As a result, the container starts as the baked-in hermes user (UID 10000), and the entrypoint's UID-remap branch (entrypoint.sh:11) — gated on id -u == 0 — is silently skipped.
The user-guide docs (website/docs/user-guide/docker.md:256) state "The container runs as root by default." The Dockerfile contradicts this.
Symptom
mkdir: cannot create directory '/opt/data': Permission denied in a tight crash loop, when the host-side data dir is owned by anything other than UID 10000.
Repro
```yaml
services:
hermes:
image: hermes:v2026.4.23
environment:
- HERMES_UID=1002
- HERMES_GID=1002
volumes:
- ./data:/opt/data # owned by host UID 1002
```
Workaround
`user: "0:0"` in compose forces root start; entrypoint then drops to `HERMES_UID` correctly.
Fix
Add `USER root` after the venv install step in the Dockerfile, before `ENTRYPOINT`. The v0.10.0 Dockerfile had this; v0.11.0 lost it during the refactor that introduced the `web/` build layer.
Diff vs v0.10.0
v0.10.0 had `USER root` at line 41 specifically to enable runtime UID remap. v0.11.0's restructured layout puts `USER hermes` at line 46 with no subsequent `USER root`.
The v0.11.0 Dockerfile (line 46) ends with
USER hermesand never restoresUSER root. As a result, the container starts as the baked-inhermesuser (UID 10000), and the entrypoint's UID-remap branch (entrypoint.sh:11) — gated onid -u == 0— is silently skipped.The user-guide docs (website/docs/user-guide/docker.md:256) state "The container runs as root by default." The Dockerfile contradicts this.
Symptom
mkdir: cannot create directory '/opt/data': Permission deniedin a tight crash loop, when the host-side data dir is owned by anything other than UID 10000.Repro
```yaml
services:
hermes:
image: hermes:v2026.4.23
environment:
- HERMES_UID=1002
- HERMES_GID=1002
volumes:
- ./data:/opt/data # owned by host UID 1002
```
Workaround
`user: "0:0"` in compose forces root start; entrypoint then drops to `HERMES_UID` correctly.
Fix
Add `USER root` after the venv install step in the Dockerfile, before `ENTRYPOINT`. The v0.10.0 Dockerfile had this; v0.11.0 lost it during the refactor that introduced the `web/` build layer.
Diff vs v0.10.0
v0.10.0 had `USER root` at line 41 specifically to enable runtime UID remap. v0.11.0's restructured layout puts `USER hermes` at line 46 with no subsequent `USER root`.