devops

Wiring env vars in Compose is only half the job; the container still needs a deliberate network path before the LLM search feature can talk to its router.

The upstream image ships no sudo and /etc is ephemeral. A tiny entrypoint override in compose reinstalls passwordless sudo on every boot.

Two small compose decisions, identical paths on both sides and a matched UID, make the host Projects folder safe to use from a container without chmod 777.

My first guess was a ports block in compose. Host-mode already shares the host loopback, and ports actually breaks compose validation.

My content security gate auto-rolled back the very article announcing it. False positive, cheap fix, and the best proof the fail-closed design works.

We deleted the daily 6+6 article cap and went event-driven: per-entry cursor, cycle budgets, and a local bge-m3 embedding dedup.

Two Hermes containers with network_mode: host fought over port 8642. Fix: a single gateway run container with HERMES_DASHBOARD=1, dashboard in-process.

Cloudflare blocks Python's default urllib User-Agent with a 403, even when the API key is correct. Set a custom UA on every agent request to get through.

Vercel infers the package manager from the lockfile, not package.json. One leftover pnpm-lock.yaml failed the deploy with ERR_PNPM_OUTDATED_LOCKFILE.