fix(security): run gateway container as non-root and remove shell=True in cleanup

[dlkakbs]

What does this PR do?

Two independent container security issues:

1. Dockerfile ran as root — no USER directive meant the entire gateway process (and the entrypoint) executed as uid 0. A container escape via kernel exploit or Docker daemon vulnerability would immediately grant full root access to the host.

2. shell=True + f-string in DockerEnvironment.cleanup() — tools/environments/docker.py used subprocess.Popen(f"... {self._container_id} ...", shell=True) in two places in cleanup(). While _container_id is Docker-daemon-generated (low injection risk in practice), this is the same root-cause pattern that was fixed in #1241. List-form subprocess eliminates the risk entirely and removes the implicit dependency on a POSIX shell in the cleanup path.

Dockerfile changes

• Add hermes group (gid 1000) and user (uid 1000)
• Transfer ownership of /opt/hermes and /opt/data to hermes
• Switch to USER hermes:hermes before ENTRYPOINT

docker.py changes

• Replace both Popen(shell=True) cleanup calls with Popen([...], stdout=DEVNULL, stderr=DEVNULL, start_new_session=True) — preserves the background/non-blocking behaviour

Note on capabilities: DAC_OVERRIDE, CHOWN, and FOWNER are retained in _SECURITY_ARGS — they are required by pip/npm/apt inside sandbox containers (documented in the code). If the sandbox image also adopts a non-root user these can be revisited, but that is out of scope for this PR.

Related Issue

Fixes #3969

Type of Change

• 🔒 Security fix

Changes Made

• Dockerfile: create hermes user/group, chown install directories, add USER hermes:hermes
• tools/environments/docker.py (cleanup): replace two shell=True Popen calls with list-form

How to Test

1. docker build -t hermes-test . and verify docker inspect hermes-test | grep -i user shows hermes
2. Run docker run --rm hermes-test whoami — should print hermes, not root
3. Confirm DockerEnvironment.cleanup() still terminates containers cleanly in an integration test

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation — or N/A
• I've considered cross-platform impact — or N/A

[alt-glitch]

Fixes #3969. Related to #5018 (shell=True elimination in tools/).

[alt-glitch]

Fixes #3969. Related to #5018 (shell=True elimination in tools/).

[benbarclay]

Thanks for this, @dlkakbs — closing as superseded. Both halves of your fix have since landed on main via the s6-overlay rework: the container runs as non-root hermes (UID 10000), and the cleanup path no longer uses shell=True (it's list-form subprocess.run([...]) on a bounded daemon thread, per #33645). This branch is now CONFLICTING against the rewritten tools/environments/docker.py. Credit to you for getting the non-root hardening on the radar early. 🙏