Skip to content

update hermes error #17516

Open
Open
update hermes error#17516
Labels
bugSomething isn't working

Description

@netbix
netbix
opened on Sep 25, 2026

✅ Have you read and understood the above guidelines?

yes

🔎 Did you run the script with verbose mode enabled?

Yes, verbose mode was enabled and the output is included below

📜 What is the name of the script you are using?

hermes

📂 What was the exact command used to execute the script?

update from LXC

🕒 When does the issue occur?

Update of an existing container

🖱️ Where did you run the command?

SSH into the container

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution is the container running?

Debian

🔢 Which version of that distribution?

13

🧱 Is this Proxmox host running arm64?

No

📈 Which Proxmox VE release are you on?

Proxmox VE 9

🔢 Exact Proxmox version and kernel

9.2.20

📝 Provide a clear and concise description of the issue.

update not work

🔄 Steps to reproduce the issue.

update

❌ Paste the full error output (if available).

✔️ Stopped Services
⏳ Updating Hermes Agent☤ Updating Hermes Agent...

→ Fleet: 1 running service(s) across profiles: default
→ Update channel: main
→ Fetching updates...
✗ Source update preparation failed: refusing to update /home/hermes/.hermes/hermes-agent: /home/hermes/.hermes/hermes-agent is owned by uid 1000, not the current uid 0; repair ownership before retrying
✖️ in line 51: exit code 1 (General error / Operation not permitted): while executing command setsid --wait bash -c '
set -a; source /etc/default/hermes; set +a
/home/hermes/.local/bin/hermes update --yes
'

--- Last 20 lines of log ---
[2026-09-26 01:42:51] [WARN] WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/).
[2026-09-26 01:42:51] [WARN] The following code is NOT maintained or audited by our repository.
[2026-09-26 01:42:51] [WARN] If you have any doubts or concerns, please review the installer code before proceeding:
[2026-09-26 01:42:51] → hermes update (https://hermes-agent.nousresearch.com/)
[2026-09-26 01:42:51] [INFO] Stopping Services
[2026-09-26 01:42:51] [OK] Stopped Services
[2026-09-26 01:42:51] [INFO] Updating Hermes Agent
[2026-09-26 01:43:19] [ERROR] in line 51: exit code 1 (General error / Operation not permitted): while executing command setsid --wait bash -c '
set -a; source /etc/default/hermes; set +a
/home/hermes/.local/bin/hermes update --yes
'

🖼️ Additional context (optional).

Image

Activity

  1. netbix
    added
    bugSomething isn't working
    on Sep 25, 2026

  2. MickLesk commented on Sep 26, 2026

    @MickLesk
    MickLesk
    on Sep 26, 2026
    Member

    @steveonjava

  3. netbix commented on Sep 26, 2026

    @netbix
    netbix
    on Sep 26, 2026
    Author

    Is it correct for the Hermes dashboard to be launched as root?

    Image

  4. netbix commented on Sep 26, 2026

    @netbix
    netbix
    on Sep 26, 2026
    Author

    Everything seems to be working, but in Hermes Desktop "Connect to Gateway," I see this:

    Image Image Image

  5. netbix commented on Sep 26, 2026

    @netbix
    netbix
    on Sep 26, 2026
    Author

    and every update performed by the client fails

  6. netbix commented on Sep 26, 2026

    @netbix
    netbix
    on Sep 26, 2026
    Author

    In a clean installation, the service is started with a normal user, not root.

    Image

  7. netbix commented on Sep 26, 2026

    @netbix
    netbix
    on Sep 26, 2026
    Author

    by adding:
    GATEWAY_HEALTH_URL=http://127.0.0.1:8642/health

    to /etc/default/hermes, I resolved this:

    Image

  8. netbix commented on Sep 26, 2026

    @netbix
    netbix
    on Sep 26, 2026
    Author

    I also fixed the issue with Telegram being disconnected:

    I added:

    hermes config set plugins.load_timeout_seconds 60

    to the config.yaml file.

    Image

  9. steveonjava commented on Sep 26, 2026

    @steveonjava
    steveonjava
    on Sep 26, 2026
    Contributor

    @netbix Thanks for the feedback. This was broken by a hermes-agent fix checked in on September 24th:
    NousResearch/hermes-agent@501ab5e

    Fixing this is not that easy. The reason why the ProxmoxVE hermes-agent script runs setup and update as root is that they both require interactive privileged escalation via sudo. This breaks automation since the script we execute wants an interactive password. However, they explicitly added a guard upstream that does not allow the update to be called by root.

    My recommendation short-term is to run hermes update as the hermes user manually. I will work on a more elaborate fix for this, but it will take some time to get right.

    The other feedback on desktop is great as well.

  10. dacog commented on Sep 27, 2026

    @dacog
    dacog
    on Sep 27, 2026

    Same error here (Debian 13 LXC, PVE 9). I found the root cause (at least in my case) and a working recovery, in case it helps others and the maintainers.

    Root cause

    The update function runs hermes update as root, but /etc/default/hermes sets HOME=/home/hermes. So every update run as root has been writing into the hermes user's home and leaving root-owned files behind. On my instance that was ~120k files across .hermes/installs, .hermes/hermes-agent, .hermes/cache, .hermes/tools, .hermes/profiles, .npm, etc.

    Older Hermes versions seem to not have checked for this, so it went unnoticed. Recent Hermes refuses to update a source tree owned by a different uid, hence:

    refusing to update /home/hermes/.hermes/hermes-agent: ... is owned by uid 1000, not the current uid 0

    After the failed run the install is also left broken. In my case installs/<id>/facts.json was root:root 0600, so the hermes user couldn't read it and every command failed with:

    hermes: cannot read dependency environment: .../facts.json; run `hermes pm repair`
✗ pm-runtime: invalid package install stamp — reinstall this application

    Recovery (no reinstall needed)

    # on the PVE host: snapshot first
pct snapshot <CTID> pre-hermes-fix

# inside the CT, as root: give the home back to the service user
chown -R hermes:hermes /home/hermes

# as the hermes user
su - hermes
hermes pm repair
hermes doctor

# the crashed root run can also leave a stale git lock behind
find ~/.hermes/hermes-agent/.git -name '*.lock' -delete

hermes update

    Then restart the gateways (hermes gateway restart, or <profile> gateway restart per profile) and, as root, systemctl restart hermes-dashboard.

    After this my agents went back to a working state and the telegram gateway worked again. :)

    Suggested fix for the script (I have not tested this, it's only an idea)

    I got everything back to work again manually and run hermes update as the hermes user. What follows is an idea but I have not had time to confirm it works.

    Run the update as the service user instead of root, e.g.:

    runuser -u hermes -- bash -lc 'hermes update --yes'

    and optionally chown -R hermes:hermes /home/hermes beforehand to heal existing installs.

    I hope this helps.

  11. steveonjava commented on Sep 27, 2026

    @steveonjava
    steveonjava
    on Sep 27, 2026
    Contributor

    Thanks for the detailed repair instructions, @dacog. That looks correct from my memory. The failed install will leave permissions issues, so fixing permissions is the right fix (the update script normally does this as the last step). The lock file is also a good catch on a failed update.

    For the script fix, running as the hermes user will work fine, except when it requires sudo to do root operations. This doesn't happen every update, but does frequently enough that it requires that command to be run interactively. I am working on a scoped sudoers rule to make it run non-interactively, but for security reasons it requires the gateways to be down (which update normally does) and has to fail closed so the rule doesn't accidentally get left behind leaving a security hole.

  12. netbix commented on Oct 10, 2026

    @netbix
    netbix
    on Oct 10, 2026
    Author

    Any updates on the problem?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions