fix(gateway): harden Docker/container gateway pathway - #8614
Merged
Conversation
Centralize container detection in hermes_constants.is_container() with process-lifetime caching, matching existing is_wsl()/is_termux() patterns. Dedup _is_inside_container() in config.py to delegate to the new function. Add _run_systemctl() wrapper that converts FileNotFoundError to RuntimeError for defense-in-depth — all 10 bare subprocess.run(_systemctl_cmd(...)) call sites now route through it. Make supports_systemd_services() return False in containers and when systemctl binary is absent (shutil.which check). Add Docker-specific guidance in gateway_command() for install/uninstall/start subcommands — exit 0 with helpful instructions instead of crashing. Make 'hermes status' show 'Manager: docker (foreground)' and 'hermes dump' show 'running (docker, pid N)' inside containers. Fix setup_gateway() to use supports_systemd instead of _is_linux for all systemd-related branches, and show Docker restart policy instructions in containers. Replace inline /.dockerenv check in voice_mode.py with is_container(). Fixes #7420 Co-authored-by: teknium1 <teknium1@users.noreply.github.com>
This was referenced Apr 12, 2026
Contributor
|
This was referenced Apr 12, 2026
This was referenced Apr 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Salvage of #8573 by @alt-glitch — cherry-picked onto current main with unrelated files removed.
Fixes the
FileNotFoundError: systemctlcrash when running gateway commands inside Docker containers.What changed
Core: centralized container detection
is_container()tohermes_constants.pywith process-lifetime caching (matchesis_wsl()/is_termux()pattern)_is_inside_container()inconfig.pyto delegate to the new function/.dockerenvcheck invoice_mode.pyGateway: defense-in-depth
_run_systemctl()wrapper — catchesFileNotFoundErrorand raisesRuntimeErrorwith clear messaging. All 10 baresubprocess.run(_systemctl_cmd(...))call sites now route through itsupports_systemd_services()now returnsFalsein containers AND whensystemctlbinary is absent (shutil.whichcheck)gateway_command()for install/uninstall/start — exit 0 instead of crashingCLI: accurate Docker status
hermes statusshows "Manager: docker (foreground)" in containershermes dumpshows "running (docker, pid N)" or "stopped (docker)"setup_gateway()shows Docker restart policy instructions in containersChanges from original PR
Removed from #8573:
spec.md(unrelated contributor notes)Dockerfile.test(contributor's local testing artifact)uv.lockchanges (unrelated Matrix dependency additions)All substantive code and tests preserved as-is.
Test results
113 targeted tests pass. One pre-existing failure in
test_auth_commands.pyunrelated to these changes.Fixes #7420
Closes #8573