[awf] ARC/DinD: chroot mode still requires 6 manual workarounds on v0.75.4

[lpcox]

Problem

On v0.75.4 (AWF v0.25.53), ARC/DinD ((redacted) DOCKER_HOST`) setups require six distinct workflow/infra-level workarounds to get a working Copilot agent run in chroot mode. Despite #30840 being closed COMPLETED at v0.75.0, users are still shipping extensive bootstrap action workarounds.

Context

Original report: github/gh-aw#34896

Six workarounds identified in v0.75.4:

1. /etc/passwd, /etc/group, /etc/hosts must be manually staged into the shared DinD /tmp volume
2. The copilot binary must be manually copied from the runner into the DinD daemon's /usr/local/bin (so AWF's /usr:/host/usr:ro bind exposes it to the chrooted agent)
3. Node is required to be baked into the DinD image
4. --docker-host-path-prefix /tmp/gh-aw must be set explicitly
5. Custom volume configuration in the RunnerScaleSet helm chart
6. Workflow-level bootstrap action needed before every agent run

Root Cause

The AWF agent container's selective bind mounts under /host/ do not account for the split-filesystem nature of ARC/DinD environments. The runner's filesystem (containing binaries like copilot) and the DinD daemon's filesystem are separate; AWF binds the DinD daemon's paths, not the runner's actual installed binaries. System user/group/host files are similarly not present in the DinD daemon's view.

Proposed Solution

In src/docker-manager.ts and containers/agent/entrypoint.sh, when --docker-host-path-prefix is active (ARC/DinD mode):

1. Auto-copy or bind-mount the invoking binary (e.g. copilot, claude) into the shared tmp volume so it's visible to the chrooted agent — detect via which (binary) on the runner.
2. Auto-stage /etc/passwd, /etc/group, and /etc/hosts to the shared volume path before container start.
3. Document the remaining Node.js requirement for DinD images in docs/arc-dind.md with a recommended base image.

Add integration tests covering the ARC/DinD code path with a mock `(redacted) Docker host.

Generated by Firewall Issue Dispatcher · sonnet46 909K · ◷