Skip to content

Use s6-setuidgid for Hermes privilege drop #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pol-Lanski merged 2 commits into from
Jun 4, 2026
Merged

Use s6-setuidgid for Hermes privilege drop #17

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b564011
Initial plan
Copilot Jun 3, 2026
88bc79e
Use s6-setuidgid instead of gosu
Pol-Lanski Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,22 @@ PROFILE
chmod 0644 /etc/profile.d/hermes-venv.sh
}

# Drop root privileges using the mechanism bundled by the upstream Hermes image.
# Recent upstream images removed gosu and use s6-overlay's s6-setuidgid instead.
drop_to_hermes() {
if command -v s6-setuidgid >/dev/null 2>&1; then
exec env HOME="$HERMES_HOME/home" USER=hermes LOGNAME=hermes s6-setuidgid hermes "$0" "$@"
fi

if [ -x /command/s6-setuidgid ]; then
exec env HOME="$HERMES_HOME/home" USER=hermes LOGNAME=hermes /command/s6-setuidgid hermes "$0" "$@"
fi

echo "Error: s6-setuidgid not found; cannot drop root privileges." >&2
echo "The upstream Hermes image should provide s6-setuidgid via s6-overlay." >&2
exit 127
}

# --- Root preflight and privilege drop ---
# Upstream Hermes starts the official image as root only long enough to repair
# the mounted data volume and then re-enters as the non-root `hermes` user.
Expand Down Expand Up @@ -67,7 +83,7 @@ if [ "$(id -u)" = "0" ]; then
fi

echo "Dropping root privileges"
exec env HOME="$HERMES_HOME/home" USER=hermes LOGNAME=hermes gosu hermes "$0" "$@"
drop_to_hermes "$@"
fi

# If this script is PID 1 after the privilege drop, insert tini while still
Expand Down
Loading