From 753de55c94682e5830ca6d1b5c26523252bab09e Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 8 Aug 2026 19:01:14 -0300
Subject: [PATCH] fix(hermes): run triage gateway as nonroot

---
 services/hermes/deployment.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 0516d9975..1100dc70c 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -292,6 +292,15 @@ spec:
             # TODO: migrate to Vault alongside the Gitea token; this manual
             # Secret was created in the interest of demo time.
 
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            capabilities:
+              drop: [ALL]
+            seccompProfile:
+              type: RuntimeDefault
           volumeMounts:
             - name: home
               mountPath: /opt/data