fix(docker): add libolm-dev so matrix lazy-install can build python-olm by konsisumer · Pull Request #27795 · NousResearch/hermes-agent

konsisumer · 2026-05-18T05:59:24Z

What does this PR do?

Add libolm-dev to the Docker image's apt-get install layer so that python-olm (a transitive dependency of mautrix[encryption]) can build from source during the Matrix gateway's first-boot lazy-install.

Since #24515 (2026-05-12), the matrix extra was dropped from the [all] Docker build extra and replaced with a first-boot lazy-install via tools/lazy_deps.py. The lazy-install runs as the non-root hermes user after root privileges are dropped, so no system package can be installed at that point. Without libolm-dev already in the base image, python-olm (sdist-only, requires libolm headers to compile) fails silently, causing the ✗ matrix error: Invalid event type / No adapter available for matrix errors reported in #25495.

A comment in pyproject.toml is also updated to document that the Docker image ships libolm-dev to support this build path.

Related Issue

Fixes #25495

Type of Change

🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

Dockerfile: add libolm-dev to the apt-get install layer so python-olm can compile during lazy-install
pyproject.toml: update [all] policy comment to note that Docker ships libolm-dev for Matrix lazy-install builds

How to Test

Build the updated image: docker build -t hermes-test .
Run the gateway: docker run --rm -e MATRIX_HOMESERVER=... -e MATRIX_ACCESS_TOKEN=... hermes-test gateway run
Confirm the log shows Lazy install complete for feature 'platform.matrix' followed by Connecting to matrix... without the ✗ matrix error: Invalid event type error.
Alternatively: docker run --rm hermes-test /bin/bash -c "/opt/hermes/.venv/bin/python -c 'import olm; print(olm.__version__)'" — should print a version string instead of an ImportError.

Checklist

Code

I've read the Contributing Guide
My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
I searched for existing PRs to make sure this isn't a duplicate
My PR contains only changes related to this fix/feature (no unrelated commits)
I've run pytest tests/ -q and all tests pass
I've added tests for my changes — N/A (Dockerfile change, no unit tests applicable)
I've tested on my platform: Linux (Debian trixie / docker build context)

Documentation & Housekeeping

I've updated relevant documentation (README, docs/, docstrings) — N/A
I've updated cli-config.yaml.example if I added/changed config keys — N/A
I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
I've considered cross-platform impact (Windows, macOS) — N/A (Docker image is Linux-only)
I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

The only failing CI check (uv lock --check) is a systemic issue on main unrelated to this PR's changes, as confirmed by BoardJames-Bot's analysis — being addressed separately in #27837.

The matrix extra (mautrix[encryption]) was removed from the [all] Docker build extra in NousResearch#24515 and is instead lazy-installed on first gateway boot. python-olm, a transitive dependency, must be compiled from source because no pre-built wheel exists for linux/amd64; this compilation requires the libolm C library headers. Without libolm-dev in the image the lazy-install silently fails and the Matrix adapter never connects. Add libolm-dev to the apt-get install layer so that the lazy-install of mautrix[encryption] can succeed inside the container. Fixes NousResearch#25495

BoardJames-Bot · 2026-05-18T06:26:51Z

CI triage: the only failing check is uv lock --check; tests, docker builds, nix, ruff, and supply-chain checks are green.

I reproduced this locally on the PR head and after merging current origin/main: uv lock --check reports that uv.lock is stale. Running uv lock changes only uv.lock (196-line diff) and resolves 213 packages, with the notable metadata/version refresh:

Updated aiohttp v3.13.4 -> v3.13.3
Updated anthropic v0.87.0 -> v0.86.0
Updated hermes-agent v0.13.0 -> v0.14.0

This PR only edits a Dockerfile package and a pyproject comment, so the narrow fix is just to run uv lock on the branch and commit the resulting uv.lock update. I’m not force-pushing to the contributor fork from the bot.

BoardJames-Bot · 2026-05-18T07:33:40Z

BoardJames follow-up: I reproduced uv lock --check failing on current origin/main too, so #27795's merged-state lock failure is systemic rather than caused by the Dockerfile change. Opened #27837 to refresh uv.lock; local validation there: uv lock --check passes after the lock refresh.

Copilot

Pull request overview

This PR fixes Matrix lazy-install failures in the official Docker image by ensuring the container has the system headers needed to compile python-olm (pulled in by mautrix[encryption]) when tools/lazy_deps.py runs after dropping root privileges.

Changes:

Add libolm-dev to the Docker image’s apt-get install layer so python-olm can build from source during lazy-install.
Document in pyproject.toml that the Docker image ships libolm-dev specifically for the Matrix lazy-install path.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
`Dockerfile`	Installs `libolm-dev` in the base image to support compiling `python-olm` during non-root lazy installs.
`pyproject.toml`	Updates the `[all]` policy comment to note the Docker image includes `libolm-dev` for Matrix lazy-install builds.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

austinpickett

LGTM, just use PULL_REQUEST_TEMPLATE.md please.

konsisumer · 2026-05-18T21:39:59Z

Thanks for the review. Addressed in this update:

PR template: Updated the PR description to follow PULL_REQUEST_TEMPLATE.md format (What does this PR do?, Related Issue, Type of Change, Changes Made, How to Test, Checklist sections).
uv lock --check CI failure: Per BoardJames-Bot's analysis, this failure reproduces on current origin/main independently of this PR's changes — it's a systemic main-health issue, not caused by the Dockerfile edit. uv.lock is not in this PR's diff scope; chore: refresh uv lock #27837 addresses the lockfile refresh on main.

konsisumer · 2026-05-23T08:35:29Z

@austinpickett friendly nudge — the template feedback is addressed: the PR description now follows PULL_REQUEST_TEMPLATE.md (What does this PR do? / Related Issue / Type of Change / Changes Made / How to Test / Checklist). Since that was a description-only change there's no new commit to auto-clear the review, so it's waiting on a re-review when you have a moment.

The only red check is uv lock --check, which reproduces on origin/main independently of this diff (uv.lock isn't in scope here) and is being refreshed in #27837. All other checks are green.

Happy to make any further changes if needed.

On macOS, `mautrix[encryption]` pulls in python-olm 3.2.16, which bundles libolm source containing a C++ const-pointer bug in `libolm/include/olm/list.hh`: T * const other_pos = other._data; // ... ++other_pos; // error: cannot assign to const-qualified variable Apple clang (Xcode 15+) rejects this as a hard compile error even without -Werror, so `platform.matrix` lazy-install always fails on macOS with: error: subprocess-exited-with-error × Getting requirements to build wheel did not run successfully. Fix: when `ensure("platform.matrix")` runs on darwin, pre-install python-olm from a patched copy of the sdist (one-line removal of the spurious `const` qualifier) before the main pip install runs. mautrix[encryption] then finds python-olm already satisfied and skips the broken bundled-source build. The patch is idempotent — if the target line is absent (upstream fixed it), we log a warning and proceed without patching. Relates to: NousResearch#27795 (adds libolm-dev for Docker, same root cause) Relates to: NousResearch#14139 (replaces python-olm with fresholm long-term)

benbarclay · 2026-05-28T05:54:46Z

Thanks for catching this @konsisumer — I've reconstructed this fix against current main as #33685 since cherry-pick would have conflicted with the post-#27795 apt-list rework (Node multi-stage in #4977, build-essential drop in #27507, ca-certificates added). The reconstruction is the same one-word libolm-dev insert plus your pyproject.toml comment update.

You're attributed as Co-author on the salvage commit and credited in the PR body. Closing this one in favor of #33685 — apologies it sat unrebased for so long; #25495 is still real and you spotted the right fix.

@konsisumer

Closes #25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages #27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (#33685) Closes #25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages #27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (#33685) Closes #25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages #27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

@konsisumer

…lm (NousResearch#33685) Closes NousResearch#25495 (matrix/synapse broken in the official docker image). `tools/lazy_deps.py` routes `platform.matrix` to `mautrix[encryption]==0.21.0`, which transitively depends on `python-olm`. `python-olm` is a Cython extension that links against `libolm`; without `libolm-dev` in the image's apt set the lazy-install build fails. Add `libolm-dev` to the runtime apt install line so the in-container source build succeeds on first matrix use. Salvages NousResearch#27795 by @konsisumer. Their PR targeted a pre-rework Dockerfile (still had `build-essential nodejs npm` in the apt list, no `ca-certificates`); cherry-pick conflicts on incidental apt-list churn, so this re-applies the same one-word insert against the current apt line plus the matching pyproject.toml comment update. Co-authored-by: konsisumer <11262660+konsisumer@users.noreply.github.com>

konsisumer requested a review from a team May 18, 2026 05:59

alt-glitch added type/bug Something isn't working area/docker Docker image, Compose, packaging platform/matrix Matrix adapter (E2EE) P2 Medium — degraded but workaround exists labels May 18, 2026

BoardJames-Bot mentioned this pull request May 18, 2026

chore: refresh uv lock #27837

Closed

austinpickett requested a review from Copilot May 18, 2026 14:18

Copilot started reviewing on behalf of austinpickett May 18, 2026 14:18 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

austinpickett requested changes May 18, 2026

View reviewed changes

alt-glitch mentioned this pull request May 22, 2026

[Bug]: Cannot use Matrix gateway from Docker image #30399

Closed

1 task

konsisumer requested a review from austinpickett May 22, 2026 16:25

ayushere mentioned this pull request May 24, 2026

fix(setup): patch python-olm bundled libolm for macOS Apple clang #31354

Open

1 task

benbarclay mentioned this pull request May 28, 2026

fix(docker): add libolm-dev so matrix lazy-install can build python-olm #33685

Merged

benbarclay closed this May 28, 2026

Navigation Menu

Uh oh!

fix(docker): add libolm-dev so matrix lazy-install can build python-olm - #27795

fix(docker): add libolm-dev so matrix lazy-install can build python-olm#27795
konsisumer wants to merge 1 commit into
NousResearch:mainfrom
konsisumer:fix/docker-add-libolm-dev-for-matrix-lazy-install

konsisumer commented May 18, 2026 •

edited

Loading

Uh oh!

BoardJames-Bot commented May 18, 2026

Uh oh!

BoardJames-Bot commented May 18, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

austinpickett left a comment

Uh oh!

konsisumer commented May 18, 2026

Uh oh!

konsisumer commented May 23, 2026

Uh oh!

benbarclay commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

konsisumer commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Related Issue

Type of Change

Changes Made

How to Test

Checklist

Code

Documentation & Housekeeping

Screenshots / Logs

Uh oh!

BoardJames-Bot commented May 18, 2026

Uh oh!

BoardJames-Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

austinpickett left a comment

Choose a reason for hiding this comment

Uh oh!

konsisumer commented May 18, 2026

Uh oh!

konsisumer commented May 23, 2026

Uh oh!

benbarclay commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

konsisumer commented May 18, 2026 •

edited

Loading

BoardJames-Bot commented May 18, 2026 •

edited

Loading