hermes-admin/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases Wiki Activity

fix(docker): gate the remaining every-boot chown walks (cron, pairing)

Browse Source 
Whole-bug-class follow-up to the profiles/ gate: cron/, platforms/
pairing, and legacy pairing/ ran chown_hermes_tree unconditionally on
every boot with the identical warm-boot cost profile. Same
tree_has_non_hermes_owner gate; find evaluates the top directory first
and -quits on the first mismatch, so a mis-owned tree short-circuits in
O(1) while a clean tree pays one read-only walk instead of a full
chown -R inode rewrite.
This commit is contained in:
kshitijk4poor
2026-08-02 21:49:58 +05:30
committed by kshitij
parent f1da9d0d66
commit 4983c576b1
2 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docker/stage2-hook.sh
View File

@@ -288,8 +288,10 @@ fi
# Always reset ownership of $HERMES_HOME/cron on every boot for the same
# docker-exec/root-write reason as profiles/. The cron scheduler state
# (jobs.json) must stay readable by the unprivileged hermes runtime even
# after root-context maintenance commands or scheduler writes.
if [ -d "$HERMES_HOME/cron" ]; then
# after root-context maintenance commands or scheduler writes. Skip the
# recursive walk when the tree is already owned correctly (same warm-boot
# gate as profiles/).
if [ -d "$HERMES_HOME/cron" ] && tree_has_non_hermes_owner "$HERMES_HOME/cron"; then
chown_hermes_tree "$HERMES_HOME/cron"
fi
@@ -315,13 +317,14 @@ fi
# silently leaving the approved user unauthorized (#10270). The targeted
# data-volume chown above only runs when the top-level $HERMES_HOME is
# mis-owned, so warm boots skip it — this block makes a container restart
# self-heal. Tiny directory (a handful of small JSON files), so the cost
# is negligible.
if [ -d "$HERMES_HOME/platforms/pairing" ]; then
# self-heal. Tiny directory (a handful of small JSON files), so even the
# ownership pre-scan is negligible; gated for consistency with profiles/
# and cron/.
if [ -d "$HERMES_HOME/platforms/pairing" ] && tree_has_non_hermes_owner "$HERMES_HOME/platforms/pairing"; then
chown_hermes_tree "$HERMES_HOME/platforms/pairing"
fi
# Legacy location (pre-consolidated layout).
if [ -d "$HERMES_HOME/pairing" ]; then
if [ -d "$HERMES_HOME/pairing" ] && tree_has_non_hermes_owner "$HERMES_HOME/pairing"; then
chown_hermes_tree "$HERMES_HOME/pairing"
fi