permissions error running docker

[arthurvaverko]

I'm trying to run webui for my locally installed Hermes agent

docker run --name hermes-webui -d \
  -e WANTED_UID=$(id -u) -e WANTED_GID=$(id -g) \
  -v ~/.hermes:/home/hermeswebui/.hermes \
  -e HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui \
  -v ~/workspace:/workspace \
  -p 127.0.0.1:8787:8787 \
  ghcr.io/nesquena/hermes-webui:latest

ands the logs show me

chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/99/9d75f360dc066ecfb26dce319b7dacbb810832': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/52/e08cb2cb583643ed2f43bd6959cd5a256b1fba': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/0a/8a2d025242dd2fd159e2e41398e2454eabffc5': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/d3/7178ab90968031b0a3653e6b59c05e2bc66717': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/d4/f60840b3a744ad64f2c82425757b310133ff3f': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/a7/b4f654264b5ee78bb4f0acc11eadc2949a01b5': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/dc/6bc6453315431987caab84688b6198e16d09d1': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/dc/c2a76b2d5db6ff664e8fe6042545b35f17a362': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/b6/a50cb88953d1e7fac8c3edc9294805d4e1f1ba': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/b6/f2ff5136e5c818d4f12634d30da7cb15eedd4f': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/d5/ef7fa48b66d0d3eb88990474039e2eae4fbf13': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/b0/99032877af3f5db5e3f0e5f97346259f6ba149': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/a1/444abae6b00ca9e606b527965ce87ca9cacea1': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/a1/04e9d179e72212aa0b96d20002eb51cdbb7b2c': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/e6/53f71e1ea7d2f62cd4c1858df693219a7a8a8b': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/f8/715e9f4fd2888e84e6c3b9e77f98c3b0d0eadf': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/2d/e5c3dc374ebb471646092a74690de6e206453f': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/4a/a47880716681e74c69da7d748a7eecb550e782': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/4a/3b822aa2341a0a689b385d824998fc79a4a25d': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/24/6c26d48ba15449e6b3f12e19e17f6283481e8f': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/23/b68c342c6275544ba6032561d4c662a4ba5fd3': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/8d/e358dbafbe25ffcc328d24e5849b973ea61100': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/15/94608b4bd81e4d947117324b9916c0f3ee2894': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/8c/792c1bc7871ce440e66845bf1e30800f7502e4': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/49/e9aa38b7537d61b0e700d57b8e83154691c45f': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/2e/b8d73053db4627c4c8432bc7740ca61b5b627d': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/2b/961b80ea66c9e81c1d17dc2276f1c3df3d42da': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/47/d6f905ab5c98d65707af574aa59993d2461670': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/47/cb20d4e3a6a4fb8aab66aa7127dd6aa0948664': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/8b/59853ecf088dcaa334462f6db9ba4b9ec40ab7': Permission denied
chown: changing ownership of '/home/hermeswebui/.hermes/hermes-agent/.git/objects/14/6dd3eedb35ae39e3735240738cec15b4872bbd': Permission denied
!! ERROR: Failed to set owner of /home/hermeswebui
!! Exiting script (ID: 1)

here is an output of ls -lha

arthurvaverko@Arthur-Mac app-dashboard-tiles-white % ls -lha ~/.hermes/hermes-agent/.git/objects/
total 0
drwxr-xr-x@ 76 arthurvaverko  staff   2.4K May 13 16:01 .
drwxr-xr-x@ 13 arthurvaverko  staff   416B May 13 14:32 ..
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 00
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 07
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 08
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 0a
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 13
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 14
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 15
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 16
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 18
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 19
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 1b
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 1c
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 1f
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 23
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 24
drwxr-xr-x@  5 arthurvaverko  staff   160B May 13 16:01 28
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 2b
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 2d
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 2e
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 31
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 32
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 34
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 35
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 43
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 47
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 49
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 4a
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 4e
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 50
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 52
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 54
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 5e
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 60
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 61
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 62
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 68
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 69
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 75
drwxr-xr-x@  5 arthurvaverko  staff   160B May 13 16:01 7c
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 82
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 89
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 8b
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 8c
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 8d
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 93
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 96
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 99
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 9a
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 9d
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 9f
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 a1
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 a6
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 a7
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 b0
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 b5
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 b6
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 b9
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 be
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 c1
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 ca
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 d1
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 d3
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 d4
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 d5
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 d8
drwxr-xr-x@  4 arthurvaverko  staff   128B May 13 16:01 dc
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 de
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 e5
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 e6
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 f3
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 16:01 f8
drwxr-xr-x@  3 arthurvaverko  staff    96B May 13 14:08 fb
drwxr-xr-x@  2 arthurvaverko  staff    64B May 13 13:06 info
drwxr-xr-x@  5 arthurvaverko  staff   160B May 13 13:06 pack

any one can help ?

[nesquena-hermes]

Summary

This is a Docker Desktop UID-mapping problem, not a hermes-webui bug — the symptom matches the macOS / VirtioFS bind-mount case documented at docs/docker.md:24-95. The container init runs as root, tries to chown -R hermeswebui:hermeswebui /home/hermeswebui so the runtime user can write to your ~/.hermes bind mount, and Docker Desktop on macOS denies the chown because the host filesystem will not let the in-container root reassign ownership of host-owned files.

Code reference

docker_init.bash:211:

chown -R "${WANTED_UID}:${WANTED_GID}" /home/hermeswebui || error_exit "Failed to set owner of /home/hermeswebui"

That error_exit is exactly the line your log ends on. The chown loop above it walked into .hermes/hermes-agent/.git/objects/... and tripped on Permission denied for each pack object owned by your host macOS user (arthurvaverko:staff, uid 501).

Diagnosis / fix

Three things wrong with the run command, in priority order:

1. WANTED_UID=$(id -u) returns 501 on macOS, but id -g returns 20 (staff), and the chown loop is trying to map every file in your ~/.hermes to 501:20 inside a container where group 20 may already be in use (dialout, etc.). The init script tries to groupmod -o -g 20 hermeswebui — that succeeds, but the chown then fails on files Docker Desktop will not let it touch through VirtioFS.

   Fix: pass WANTED_GID explicitly to avoid the staff/dialout collision:

   docker run --name hermes-webui -d \
     -e WANTED_UID=$(id -u) -e WANTED_GID=1024 \
     ...

   …and on macOS prefer gRPC-FUSE over VirtioFS in Docker Desktop → Settings → General → File sharing implementation (docs/docker.md:67 calls this out specifically — different implementations preserve UIDs across host/container differently).

2. Do not bind-mount your real ~/.hermes. The two-container compose file ships specifically to avoid this — it uses a named Docker volume for hermes-agent source. Bind-mounting ~/.hermes from a macOS host that owns the files as uid 501 means the container init has to rewrite ownership of every file in the mount on every start, which is both slow and prone to exactly this failure. docs/docker.md:146 explains why named volumes solve the UID problem by construction.

3. The chown is recursive over .git/objects/ which is the largest chunk of files in hermes-agent. If you must bind-mount, exclude the agent checkout from the WebUI mount — either drop the -v ~/.hermes:/home/hermeswebui/.hermes mount entirely and let the container use its embedded agent copy, or put hermes-agent on a separate Docker named volume (-v hermes-agent-src:/home/hermeswebui/.hermes/hermes-agent) so the container init never needs to chown your host-owned git objects.

Recommended path

For a single-machine macOS dev setup the cleanest run is:

docker run --name hermes-webui -d \
  -e WANTED_UID=$(id -u) -e WANTED_GID=1024 \
  -v hermes-data:/home/hermeswebui/.hermes \
  -v ~/workspace:/workspace \
  -p 127.0.0.1:8787:8787 \
  ghcr.io/nesquena/hermes-webui:latest

That uses a named Docker volume for .hermes (container owns it, no host-side permission setup needed). If you specifically need your host ~/.hermes config visible inside the container, the documented multi-container flow at docs/docker.md:108-146 is the supported path — the WebUI bind-mounting a host .hermes directly is not.

Related closed issues for context: #1399 (cannot connect to host .hermes via Docker), #645 (multi-container UID/GID alignment), #357 (Docker 容器启动异常 — same chown failure mode). The pattern is consistent: macOS Docker Desktop + bind-mounting a host-owned directory + the runtime chown step do not coexist cleanly.

— maintainer

[nesquena-hermes]

@arthurvaverko thanks for the report. The chown: Permission denied on ~/.hermes/hermes-agent/.git/objects/... happens because git pack files on the host have mode 0444 (read-only by design), and the container's entrypoint.sh recursively chowns the mounted ~/.hermes to hermeswebui:hermeswebui so the in-container user can read/write its state. On those read-only pack files the chown fails — git refuses to make pack files writable for safety, but chown needs the parent's write bit, not the file's.

Direction for a fix

Two reasonable shapes — pick whichever lands first:

Option A — exclude the agent's .git subtree from the recursive chown. Inside entrypoint.sh (or wherever the chown happens), skip find ~/.hermes -path '*/hermes-agent/.git/objects/*' -prune (and similar pack-file dirs). The container only needs read access to those files, not ownership.

Option B — ignore chown failures non-fatally on read-only files. Use chown -h ... 2>/dev/null || true for the parts of the tree that may contain git internals. Less surgical than A, but a one-line change.

Either way the container should not require write ownership over agent-side git pack files. Option A is the right long-term answer; Option B is the right hotfix.

What we need from you to confirm the fix

If you can run with -e HERMES_WEBUI_SKIP_CHOWN=1 (if/when we ship that escape hatch) or rebuild from a branch with the fix, confirm:

1. Container starts cleanly (no Permission denied spam in logs).
2. ~/.hermes/sessions/ and ~/.hermes/webui/ are writable by the container user.
3. The agent's git status still works inside ~/.hermes/hermes-agent (read access preserved).

Labeling docker + needinfo and putting on Milestone 3 (Platform expansion). If a contributor wants to pick this up, the entrypoint script + a Dockerfile change is probably ≤20 LOC.

[arthurvaverko]

@nesquena-hermes thanks ! would be happy to verify the fix but i cannot seem to find a container with that build .. i saw that there is a PR on branch franksong2702:franksong2702/fix-docker-chown-git-objects
but i run using dokcer .. so i need a container on ghcr with this fix inside to test it

like this i mean ...

docker rm -f hermes-webui && docker run --name hermes-webui -d \
  -e WANTED_UID=$(id -u) -e WANTED_GID=$(id -g) \
  -v ~/.hermes:/home/hermeswebui/.hermes \
  -e HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui \
  -e HERMES_WEBUI_SKIP_CHOWN=1 \
  -v ~/workspace:/workspace \
  -p 127.0.0.1:8787:8787 \
  ghcr.io/nesquena/hermes-webui:<<<WHAT_TAG_SHOUL_I_USE>> ?? 

[nesquena-hermes]

@arthurvaverko thanks for the patience — the fix landed in the franksong2702/fix-docker-chown-git-objects branch you spotted, and it'll be in the next published ghcr.io/nesquena/hermes-webui:latest image once that PR merges.

Two ways to verify before the merge

1. Use the HERMES_WEBUI_SKIP_CHOWN=1 workaround on the current image — your repro command in the previous comment is on the right track. Add the env var:

docker rm -f hermes-webui && docker run --name hermes-webui -d \
  -e WANTED_UID=$(id -u) -e WANTED_GID=$(id -g) \
  -e HERMES_WEBUI_SKIP_CHOWN=1 \
  -v ~/.hermes:/home/hermeswebui/.hermes \
  -e HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui \
  -v ~/workspace:/workspace \
  -p 127.0.0.1:8787:8787 \
  ghcr.io/nesquena/hermes-webui:latest

If your host UID:GID already matches what the container expects, skipping chown should let the container start cleanly. Note that HERMES_WEBUI_SKIP_CHOWN is an escape hatch — it works because your host files are already owned correctly; the real fix is the targeted-chown change in the PR.

2. Build locally from the franksong2702 PR branch if you want to verify the actual fix:

git clone https://github.com/nesquena/hermes-webui /tmp/hermes-webui-pr
cd /tmp/hermes-webui-pr
git fetch origin pull/2238/head:pr-docker-chown && git checkout pr-docker-chown   # PR # may differ; check the open PRs list
docker build -t hermes-webui-pr-test .
docker run --name hermes-webui-pr-test -d ... hermes-webui-pr-test

Once it merges (likely later this week given the volume of PRs landing), pull ghcr.io/nesquena/hermes-webui:latest and you should get the fix automatically.

I'll comment again when the image is updated. Keeping needinfo off the table now — you've provided enough context; we're waiting on us, not on you.