diff --git a/website/docs/user-guide/docker.md b/website/docs/user-guide/docker.md index cf63f4f6eb..747e6b40ed 100644 --- a/website/docs/user-guide/docker.md +++ b/website/docs/user-guide/docker.md @@ -802,6 +802,16 @@ docker run -d \ `docker exec hermes ` automatically drops to UID 10000 too — see [`docker exec` automatically drops to the `hermes` user](#docker-exec-automatically-drops-to-the-hermes-user) for details and the per-invocation opt-out. +### "Permission denied" on every `docker exec` (install dir locked to 0700) + +Images built before late August 2026 had a bug where writing a credential file directly under `/opt/hermes` restricted that directory to `0700`, locking the `hermes` user (UID 10000) out of the install tree. Every new `docker exec` then fails with `Permission denied`. + +Pulling a newer image and recreating the container fixes it permanently (the install dir ships as `0755` and current releases no longer restrict it). If you need to recover a running container in place without recreating it: + +```sh +docker exec -u root hermes chmod 0755 /opt/hermes +``` + ### Browser tools not working Playwright needs shared memory. Add `--shm-size=1g` to your Docker run command: