mirror of
https://github.com/nesquena/hermes-webui.git
synced 2026-05-22 10:20:14 +00:00
nesquena-hermes
57c71e89f3
Three independent operational hardening fixes salvaged from PR #1686 (@binhpt310) after the parent PR was deferred over a separate sibling-repo build-context concern unrelated to these fixes: 1. start.sh's .env loader now filters readonly bash vars (UID, GID, EUID, EGID, PPID) before `source`-ing. docker-compose.yml's macOS instructions document `echo "UID=$(id -u)" >> .env` to set host UID/GID for bind-mount permission fixing — that .env was crashing start.sh with `UID: readonly variable` when `set -a; source ...; set +a` tried to assign to those names. Replaced with `source <(grep -vE '^[[:space:]]*(export[[:space:]]+)?(UID|GID|EUID|EGID|PPID)=' "${REPO_ROOT}/.env")`. The bootstrap regression guard at tests/test_bootstrap_dotenv.py:181 still passes — both `source` and `.env` are still on the modified line. 2. start.sh now defensively re-execs as the unprivileged hermeswebui user when invoked as root. Fires only when EUID==0 AND a hermeswebui user actually exists AND sudo is on PATH — so it's a no-op on host machines without the container user setup. The production image's entrypoint (docker_init.bash) already drops to hermeswebui before invoking start.sh, so this is a no-op on the canonical container path; it only matters for `sudo ./start.sh` or accidental root shells inside the container during interactive debugging. 3. Dockerfile installs xz-utils + git apt packages. xz-utils is required to decompress .tar.xz archives (e.g. Node.js distribution tarballs); git is needed for `git describe` (powers WEBUI_VERSION resolution at api/updates.py:_detect_webui_version) and any clone-based agent install path. Both are tiny apt packages on top of python:3.12-slim with no measurable image-size impact. What's NOT in this commit (deferred from #1686): - Pre-baking hermes-agent source into the image via `COPY hermes-agent-desktop/hermes-agent /opt/hermes/` plus a build-context flip to `..`. Requires a sibling-repo layout that breaks the canonical `git clone hermes-webui && cd hermes-webui && docker compose build` flow. The right shape is a build arg gating the COPY behind --build-arg WITH_AGENT_SOURCE=1; left to a separate PR. - Pre-installing Node.js 22 LTS system-wide. Real motivation but worth evaluating the fix shape (full Node bake vs. opt-in vs. layer cache) separately from these three operational fixes. Tests: tests/test_docker_env_readonly_vars.py — 11 tests (4 source-grep on the start.sh filter pattern + 5 behavioral that actually run bash against synthetic .env files containing readonly vars + 2 Dockerfile package-presence tests). All 11 pass. Behavioral tests skip if bash is not on PATH. Full suite: 5028 → 5036 passing (+8 net new after pytest collection counted some behavioral tests under skip), 0 regressions, 147.84s. Closes the operational-hardening portion of #1686. Co-authored-by: binhpt310 <binhpt310@users.noreply.github.com>
90 lines
3.0 KiB
Docker
90 lines
3.0 KiB
Docker
FROM python:3.12-slim
|
|
|
|
LABEL maintainer="nesquena"
|
|
LABEL description="Hermes Web UI — browser interface for Hermes Agent"
|
|
|
|
# Install system packages
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Make use of apt-cacher-ng if available
|
|
RUN if [ "A${BUILD_APT_PROXY:-}" != "A" ]; then \
|
|
echo "Using APT proxy: ${BUILD_APT_PROXY}"; \
|
|
printf 'Acquire::http::Proxy "%s";\n' "$BUILD_APT_PROXY" > /etc/apt/apt.conf.d/01proxy; \
|
|
fi \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates wget gnupg \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& apt-get clean
|
|
|
|
RUN apt-get update -y --fix-missing --no-install-recommends \
|
|
&& apt-get install -y --no-install-recommends \
|
|
apt-utils \
|
|
locales \
|
|
ca-certificates \
|
|
curl \
|
|
rsync \
|
|
openssh-client \
|
|
git \
|
|
xz-utils \
|
|
&& apt-get upgrade -y \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# UTF-8
|
|
RUN localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8
|
|
ENV LANG=en_US.utf8
|
|
ENV LC_ALL=C
|
|
|
|
# Set environment variables
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONIOENCODING=utf-8
|
|
|
|
WORKDIR /apptoo
|
|
|
|
# Create the unprivileged runtime user. The entrypoint starts as root only for
|
|
# UID/GID alignment and filesystem preparation, then execs the server as this user.
|
|
RUN groupadd -g 1024 hermeswebui \
|
|
&& useradd -u 1024 -d /home/hermeswebui -g hermeswebui -G users -s /bin/bash -m hermeswebui \
|
|
&& mkdir -p /app /uv_cache \
|
|
&& chown -R hermeswebui:hermeswebui /home/hermeswebui /app /uv_cache
|
|
|
|
COPY --chmod=555 docker_init.bash /hermeswebui_init.bash
|
|
|
|
RUN touch /.within_container
|
|
|
|
# Remove APT proxy configuration and clean up APT downloaded files
|
|
RUN rm -rf /var/lib/apt/lists/* /etc/apt/apt.conf.d/01proxy \
|
|
&& apt-get clean
|
|
|
|
USER root
|
|
|
|
# Pre-install uv system-wide so the container doesn't need internet access at runtime.
|
|
# Installing as root places uv in /usr/local/bin, available to all users.
|
|
# The init script will skip the download when uv is already on PATH.
|
|
RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
|
|
|
|
COPY --chown=root:root . /apptoo
|
|
|
|
# Bake the git version tag into the image so the settings badge works even
|
|
# when .git is not present (it is excluded by .dockerignore).
|
|
# CI passes: --build-arg HERMES_VERSION=$(git describe --tags --always)
|
|
# Local builds that omit the arg get "unknown" as the fallback.
|
|
ARG HERMES_VERSION=unknown
|
|
RUN echo "__version__ = '${HERMES_VERSION}'" > /apptoo/api/_version.py
|
|
|
|
# Default to binding all interfaces (required for container networking)
|
|
ENV HERMES_WEBUI_HOST=0.0.0.0
|
|
ENV HERMES_WEBUI_PORT=8787
|
|
|
|
EXPOSE 8787
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -f http://localhost:8787/health || exit 1
|
|
|
|
# docker_init.bash performs root-only bind-mount setup, then drops to hermeswebui
|
|
# before starting the WebUI server. The production image does not ship sudo.
|
|
USER root
|
|
CMD ["/hermeswebui_init.bash"]
|
|
|