[awf] ARC/DinD chroot: 7 gaps remain after v0.75.0 fix requiring workflow-level workarounds

[lpcox]

Problem

On ARC/DinD runners with (redacted) DOCKER_HOST`, AWF v0.25.53 chroot mode still forces 7 workflow-level workarounds despite gh-aw #30840 being closed as fixed in v0.75.0.

Context

Upstream report: github/gh-aw#34896

Root Cause

Seven distinct deficiencies in the firewall agent:

1. Chroot rejects Alpine/musl DinD — entrypoint.sh requires capsh + glibc on the daemon host; stock docker:dind (Alpine) fails (chroot: No such file or directory)
2. engine.env identity vars clobbered by capsh — HOME/USER/LOGNAME are reset by the user-switch in entrypoint.sh; engine.env overrides are lost, breaking Copilot
3. TCP DOCKER_HOST doesn't resolve daemon filesystem — host-env.ts infers the bind-mountable root from the DOCKER_HOST URL scheme; TCP hosts have no unix-socket path to derive the daemon rootfs from
4. Runner-installed binaries invisible in chroot — agent-volumes.ts mounts the daemon's /usr:ro, not the runner's, so runner-installed copilot is absent
5. INTERNAL_SERVERS hardcodes "github" — mount_mcp_as_cli.cjs always excludes github MCP from CLI shimming when --disable-builtin-mcps is active
6. No identity/hosts synthesis — AWF doesn't generate a minimal /etc/passwd//etc/group//etc/hosts for the target UID
7. Threat-detection job silently no-ops — runs without pre-agent-steps; ENOENT on copilot is swallowed by GH_AW_DETECTION_CONTINUE_ON_ERROR default, masking the failure as green

Proposed Solution

• containers/agent/entrypoint.sh: stage a glibc chroot-runtime bundle; apply engine.env identity vars post-capsh; synthesize /etc/passwd, /etc/group, /etc/hosts for the target UID
• src/host-env.ts: add resolveDaemonFilesystem() using Docker API inspect (MergedDir/UpperDir) instead of DOCKER_HOST URL inference
• src/services/agent-volumes.ts: include engine binary staging into chroot overlay for both agent and detection jobs
• containers/agent/Dockerfile: bundle capsh, /bin/sh, busybox applets, and libutil.so.1 as a chroot-runtime tarball
• Fix INTERNAL_SERVERS hardcoding and reconsider GH_AW_DETECTION_CONTINUE_ON_ERROR default to surface setup failures

Generated by Firewall Issue Dispatcher · ◷

[github-actions]

👋 Hello! I noticed this issue might be related to an existing open issue:

• [awf] agent: ARC/DinD chroot mode requires workflow-level workarounds (v0.75.4 gaps) #4737 — [awf] agent: ARC/DinD chroot mode requires workflow-level workarounds (v0.75.4 gaps)

Both issues describe the same core problem: ARC/DinD chroot mode requiring manual workflow-level workarounds. They share several specific root causes:

• Alpine/musl DinD incompatibility in entrypoint.sh
• Missing identity file synthesis (/etc/passwd, /etc/group, /etc/hosts)
• INTERNAL_SERVERS hardcoding github in mount_mcp_as_cli.cjs
• engine.env HOME/USER/LOGNAME not propagated into the chroot context

This issue adds 3 additional gaps (TCP DOCKER_HOST daemon resolution, runner binaries invisible in chroot, threat-detection silently no-oping) not covered by #4737.

If the intent is to track the expanded set of 7 gaps, consider linking to or updating #4737, or marking one as a duplicate.

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #4787 · ◷