From b564011317173252513c2aee6fbf780ebe88876c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 3 Jun 2026 09:04:27 +0000
Subject: [PATCH 1/2] Initial plan


From 88bc79e95a528fe195f4ea2f2d811f43f13aab26 Mon Sep 17 00:00:00 2001
From: Lanski <19168735+Pol-Lanski@users.noreply.github.com>
Date: Wed, 3 Jun 2026 16:03:02 +0700
Subject: [PATCH 2/2] Use s6-setuidgid instead of gosu

---
 entrypoint.sh | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index 0027e93..0f0bc33 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -27,6 +27,22 @@ PROFILE
     chmod 0644 /etc/profile.d/hermes-venv.sh
 }
 
+# Drop root privileges using the mechanism bundled by the upstream Hermes image.
+# Recent upstream images removed gosu and use s6-overlay's s6-setuidgid instead.
+drop_to_hermes() {
+    if command -v s6-setuidgid >/dev/null 2>&1; then
+        exec env HOME="$HERMES_HOME/home" USER=hermes LOGNAME=hermes s6-setuidgid hermes "$0" "$@"
+    fi
+
+    if [ -x /command/s6-setuidgid ]; then
+        exec env HOME="$HERMES_HOME/home" USER=hermes LOGNAME=hermes /command/s6-setuidgid hermes "$0" "$@"
+    fi
+
+    echo "Error: s6-setuidgid not found; cannot drop root privileges." >&2
+    echo "The upstream Hermes image should provide s6-setuidgid via s6-overlay." >&2
+    exit 127
+}
+
 # --- Root preflight and privilege drop ---
 # Upstream Hermes starts the official image as root only long enough to repair
 # the mounted data volume and then re-enters as the non-root `hermes` user.
@@ -67,7 +83,7 @@ if [ "$(id -u)" = "0" ]; then
     fi
 
     echo "Dropping root privileges"
-    exec env HOME="$HERMES_HOME/home" USER=hermes LOGNAME=hermes gosu hermes "$0" "$@"
+    drop_to_hermes "$@"
 fi
 
 # If this script is PID 1 after the privilege drop, insert tini while still