[Bug]: Dockerfile fails to build on podman/buildah due to unsupported flag

[irusensei]

Bug Description

The optimizations made to Dockerfile are not engine-agnostic and break on Podman. Many people (especially on Linux desktops/servers, Fedora, RHEL, or rootless setups) prefer or are forced to use Podman.

Steps to Reproduce

Build Hermes-agent with podman build --file Dockerfile .

Expected Behavior

Container build should succeed.

Actual Behavior

Build fails with error

[3/3] STEP 36/56: COPY --link --chmod=a+rX,go-w . .
Error: building at STEP "COPY --link --chmod=a+rX,go-w . .": Error parsing chmod a+rX,go-w

Affected Component

Setup / Installation

Messaging Platform (if gateway-related)

N/A (CLI only)

Debug Report

N/A

Operating System

Nixos 26.05

Python Version

No response

Hermes Version

0.18.2

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

Commit 6382437 introduced https://github.com/NousResearch/hermes-agent/blob/main/Dockerfile#L202

This calls COPY --link --chmod=a+rX,go-w . . during build time. Podman (via Buildah) does not support --link.

Proposed Fix (optional)

Revert to previous COPY . . and chmod -R

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR

[silviuchingaru]

Adding a bit more detail from another Podman/Buildah build failure: the breakage appears to be specifically the symbolic COPY --chmod value, not necessarily --link.

Failing build command/context:

cd /mnt/storage/podman/hermes/.pod
podman build -t hermes-agent:${tag} -f hermes-agent/Dockerfile hermes-agent

Failure:

[3/3] STEP 35/55: COPY --link --chmod=a+rX,go-w . .
Error: building at STEP "COPY --link --chmod=a+rX,go-w . .": Error parsing chmod a+rX,go-w

This points at the change introduced by commit 638243726eb99497bf9bd9f9cdffca492abe190b:

COPY --link --chmod=a+rX,go-w . .

Buildah has an older closed issue for the same class of problem with symbolic chmod in COPY --chmod:

• Containerfile --chmod +x not working in podman podman-container-tools/buildah#4614

That issue shows COPY --chmod=+x ... failing with:

Error parsing chmod +x

and discusses that Buildah/Podman effectively expect octal values for COPY --chmod, while symbolic forms such as +x or a+rX,go-w are not portable.

Why replacing this with a single octal mode is not equivalent:

• a+rX,go-w is conditional because of uppercase X:
  • directories get execute/traverse bits;
  • files only get execute if they already had at least one execute bit;
  • group/other write bits are removed.
• --chmod=0755 would make every source file executable.
• --chmod=0644 would break directories and executable scripts.

The most portable equivalent seems to be the slower version:

COPY --link . .
RUN chmod -R a+rX,go-w /opt/hermes

or, if COPY --link itself is also considered too BuildKit-specific for the supported builder matrix:

COPY . .
RUN chmod -R a+rX,go-w /opt/hermes

I understand the original change was intended to avoid a very expensive recursive chmod pass, especially on arm64. But as written, the Dockerfile is no longer buildable with Podman/Buildah because the invalid symbolic --chmod is rejected during Dockerfile parsing, before any runtime detection or ARG-based workaround could run.

A possible upstream-friendly approach may be one of:

1. keep one portable Dockerfile and accept the slower chmod pass;
2. split Docker/BuildKit and Podman-compatible build files;
3. generate/patch the Dockerfile in CI/build scripts based on the selected builder;
4. restructure copies so octal COPY --chmod can be used only for paths where a fixed mode is actually correct.

But the current single-instruction form is not Podman/Buildah-compatible.