🩺 Runner Doctor UpdateRunner Doctor Update: A14 (missing docker-compose-plugin on ARC/DinD), A15 (rootless artifact repair fails on ARC/DinD)

[github-actions]

Summary

• Scan window: 2026-06-25 → 2026-07-02 UTC
• Items reviewed: ~20 issues/PRs updated in this window; 0 open runner-doctor proposals found
• Genuinely new lessons: 2 new failure modes (A14, A15); 1 citation-only update (A1 + gh-aw compiler: ARC/DinD topology requires daemon-visible path redirections #5753)

---

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

1 — New row A14: ARC/DinD sidecar missing Docker Compose plugin

Append after the A13 row in the Category A table:

| A14 | `unknown shorthand flag: 'd' in -d` / `Command failed with exit code 125: docker compose up -d --pull never` | ARC/DinD sidecar image lacks `docker-compose-plugin`; AWF uses `docker compose` (v2 plugin syntax) to orchestrate containers but the DinD sidecar only has legacy standalone Docker or no Compose support | Add `docker-compose-plugin` to the DinD sidecar Dockerfile: `RUN apt-get update && apt-get install -y docker-compose-plugin` (Debian/Ubuntu) or `RUN apk add docker-compose` (Alpine) | `docker compose version` inside the DinD sidecar — v2 output confirms plugin is present; inspect sidecar Dockerfile for `docker-compose-plugin` | #5729 |

2 — New row A15: Rootless artifact permission repair fails on ARC/DinD due to missing path-prefix translation

Append after the A14 row in the Category A table:

| A15 | `[WARN] Rootless artifact permission repair failed for .../sandbox/firewall/logs (exit 1)`; squid log files unreadable after ARC/DinD run; `awf logs summary` returns `Failed to load logs: EACCES` | `fixArtifactPermissionsForRootless()` binds the log directory into a repair container but does not apply `dockerHostPathPrefix` translation to the bind mount source path; the DinD daemon cannot resolve the runner-local path, so `chmod` exits non-zero | **Open — fix in progress** (PR #5817): workaround — run `chmod -R a+rX` inside the squid container before `docker compose down` while it still owns the log volume; or configure squid to write logs as runner UID | `ls -la <proxy-logs-dir>` after run — files owned by uid 13 (squid) confirm the mode; check AWF logs for `[WARN] Rootless artifact permission repair failed` | #5816 |

3 — Update A1 citations: add #5753

In the A1 row, replace the Citations cell:

Before: #2833, #2945, #3553, #3845, #3906, #4023, #4271, #4399, #4727, #4737, #4787

After: #2833, #2945, #3553, #3845, #3906, #4023, #4271, #4399, #4727, #4737, #4787, #5753

(#5753 formally documents that ${RUNNER_TEMP} is the canonical daemon-visible base path for all ARC/DinD artifacts; /tmp, /usr/local/bin, and /home/runner/_work/_tool are all daemon-invisible.)

4 — New error-string lookup entries

Append two rows to the error-string quick-lookup table:

| `unknown shorthand flag: 'd' in -d` from `docker compose up -d` on ARC/DinD | A14 |
| `Rootless artifact permission repair failed for .../sandbox/firewall/logs` on ARC/DinD | A15 |

5 — Add A15 to Known unresolved items

Append to the Known unresolved items section:

- A15 / #5816 — rootless artifact permission repair on ARC/DinD: `fixArtifactPermissionsForRootless()` does not apply `dockerHostPathPrefix` to repair step bind mount; fix tracked in PR #5817

---

Proposed doctor changes

File: .github/workflows/self-hosted-runner-doctor.md

§3 "Match symptom → failure mode" — add A14 and A15 examples

Append two bullet points to the examples list in §3, before the FATAL: http_port line:

- `unknown shorthand flag: 'd' in -d` from `docker compose up -d` → A14 (DinD sidecar missing `docker-compose-plugin`)
- `Rootless artifact permission repair failed` on ARC/DinD squid logs → A15 (`dockerHostPathPrefix` not applied to repair bind mount)

---

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

All catalog changes above must be mirrored in the embedded catalog section (starting at the # Self-Hosted Runner Failure Modes heading, around line 116).

1 — New A14 row (mirror of shared catalog §1)

Same text as proposed for self-hosted-failure-modes.md A14 row above.

2 — New A15 row (mirror of shared catalog §2)

Same text as proposed for self-hosted-failure-modes.md A15 row above.

3 — Update A1 citations (mirror of shared catalog §3)

Same citation addition: append , #5753 to the A1 Citations cell.

4 — New error-string lookup entries (mirror of shared catalog §4)

Same two rows appended to the embedded error-string quick-lookup table.

5 — Add A15 to Known unresolved items (mirror of shared catalog §5)

Same line appended to the embedded Known unresolved items section.

6 — Diagnostic playbook §3 examples (mirror of workflow doctor §3)

Same two bullet points added to the Match symptom → failure mode examples in the portable agent's §3.

---

Source issues and PRs

Issue/PR	Title	Status	Lesson extracted
#5729	ARC DinD runner missing Docker Compose plugin	Closed	New failure mode A14
#5816	fix: rootless artifact permission repair fails on ARC/DinD topology	Closed (fix in PR #5817)	New failure mode A15
#5753	gh-aw compiler: ARC/DinD topology requires daemon-visible path redirections	Closed (moved to gh-aw#42807)	Citation update to A1

Items reviewed but already covered (citations already in catalog): #5728, #5717, #5708, #5693, #5696, #5653, #5615, #5616, #5545, #5543, #5542, #5541, #5582, #5689, #5646, #5498.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Runner Doctor Updater · 160.8 AIC · ⊞ 10.8K · ◷

• expires on Aug 1, 2026, 5:17 PM UTC