fix(docker): refuse root gateway runs in official image

This commit is contained in:
LeonSGP43 2026-05-03 20:56:08 +08:00 committed by Teknium
parent afbcca0f06
commit 84287b0de8
4 changed files with 81 additions and 0 deletions

View file

@ -14,6 +14,9 @@
# keys; exposing it on LAN without auth is unsafe. If you want remote
# access, use an SSH tunnel or put it behind a reverse proxy that
# adds authentication — do NOT pass --insecure --host 0.0.0.0.
# - If you override entrypoint, keep /opt/hermes/docker/entrypoint.sh in
# the command chain. It drops root to the hermes user before gateway
# files such as gateway.lock are created.
# - The gateway's API server is off unless you uncomment API_SERVER_KEY
# and API_SERVER_HOST. See docs/user-guide/api-server.md before doing
# this on an internet-facing host.