Rootless Docker: chroot-home cleanup fails after permission repair

[lpcox]

Problem

On rootless Docker runners, the chroot home directory (/tmp/awf-*-chroot-home) cannot be removed during cleanup. The fixArtifactPermissionsForRootless repair step runs successfully (no error logged from the docker run) but does not actually fix permissions, leaving the retry rmSync to hit EACCES again.

Observed in: https://github.com/github/gh-aw/actions/runs/28418855393/job/84207700269

Error

[WARN] Failed to remove chroot home directory after permission repair: Error: EACCES, Permission denied: /tmp/awf-1782791441868-chroot-home

Code path

1. removeWorkDirectories() in src/artifact-preservation.ts tries fs.rmSync(chrootHomeDir) → EACCES (files owned by remapped UIDs from rootless Docker)
2. Calls fixArtifactPermissionsForRootless() in src/artifact-permissions.ts, which spawns a Docker container with CHOWN, DAC_OVERRIDE, and FOWNER capabilities to chown the files back to the host user
3. The repair container exits successfully (no warn from line 79/82 in artifact-permissions.ts)
4. Retry rmSync → still EACCES

Likely cause

The repair container runs with CHOWN/DAC_OVERRIDE/FOWNER capabilities, but in rootless Docker these capabilities operate within the user namespace, not at the host level. The chown inside the container may appear to succeed but the ownership change doesn't map back to the host UID, so the host process still cannot delete the directory.

Impact

Non-fatal — leaves an orphan directory in /tmp on the runner. The wrapped command's exit code is unaffected. However, repeated runs could accumulate stale directories.

Relevant files

• src/artifact-preservation.ts — removeWorkDirectories() (lines 228–258)
• src/artifact-permissions.ts — fixArtifactPermissionsForRootless() (lines 21–85)