[awf] ARC/DinD: preserve chroot identity overrides, add binaries overlay path, and publish glibc DinD companion image#4587
Conversation
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 96.50% | 96.54% | 📈 +0.04% |
| Statements | 96.42% | 96.45% | 📈 +0.03% |
| Functions | 98.73% | 98.74% | ➡️ +0.01% |
| Branches | 90.70% | 90.69% | 📉 -0.01% |
📁 Per-file Coverage Changes (3 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/services/agent-volumes/system-mounts.ts |
100.0% → 92.3% (-7.70%) | 100.0% → 92.3% (-7.70%) |
src/commands/validators/config-assembly.ts |
97.9% → 98.1% (+0.16%) | 97.0% → 97.2% (+0.23%) |
src/config-writer.ts |
89.3% → 90.9% (+1.65%) | 89.3% → 90.9% (+1.65%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
There was a problem hiding this comment.
Pull request overview
This PR improves ARC/DinD chroot reliability by (1) ensuring chroot identity overrides survive the capsh user-switch, (2) adding a config-driven overlay mount for runner-installed binaries into chroot PATH, and (3) introducing and publishing a glibc-based DinD companion image plus related docs/schema updates.
Changes:
- Apply
HOME/USER/LOGNAMEoverrides inside the generated chroot command script (post-capsh) to prevent clobbering. - Add
chroot.binariesSourcePath(config-only) and wire it into mount generation as an overlay to/usr/local/bininside chroot. - Add
containers/dind-ubuntuimage and extend the release workflow to build/sign/attest/publish it; update docs/schema/spec accordingly.
Show a summary per file
| File | Description |
|---|---|
| src/types/runtime-options.ts | Adds chrootBinariesSourcePath to runtime options typing. |
| src/services/agent-volumes/volume-builder.ts | Passes chrootBinariesSourcePath into system-mount generation. |
| src/services/agent-volumes/system-mounts.ts | Adds optional /host/usr/local/bin overlay mount from chrootBinariesSourcePath. |
| src/services/agent-volumes-mounts.test.ts | Extends volume-mount tests to cover the binaries overlay behavior (with/without prefix). |
| src/schema.test.ts | Adds schema validation coverage for chroot.binariesSourcePath type. |
| src/config-file.ts | Adds stdin/config-file parsing/mapping for chroot.binariesSourcePath. |
| src/config-file-validation.test.ts | Adds validation tests for chroot.binariesSourcePath and unknown chroot keys. |
| src/config-file-mapping.test.ts | Verifies mapping of chroot.binariesSourcePath into CLI/options layer. |
| src/commands/validators/config-assembly.ts | Adds post-assembly validation for chrootBinariesSourcePath (absolute path, not /). |
| src/commands/validators/config-assembly.test.ts | Adds unit tests for the new chrootBinariesSourcePath validations. |
| src/commands/build-config.ts | Threads chrootBinariesSourcePath through config construction. |
| src/commands/build-config.test.ts | Adds unit test ensuring chrootBinariesSourcePath passthrough. |
| src/awf-config-schema.json | Adds chroot.binariesSourcePath to the canonical JSON schema. |
| docs/chroot-mode.md | Documents the additional mount when chroot.binariesSourcePath is set. |
| docs/awf-config.schema.json | Mirrors schema updates for documentation output. |
| docs/awf-config-spec.md | Documents the new config-only field and its behavior. |
| docs/arc-dind.md | Updates ARC/DinD guidance to include binariesSourcePath and the new image recommendation. |
| containers/dind-ubuntu/Dockerfile | Introduces a new Ubuntu-based DinD companion image definition. |
| containers/agent/entrypoint.sh | Moves identity exports into the generated script to apply post-capsh effectively. |
| .github/workflows/release.yml | Adds build/sign/SBOM/attestation/publish steps for dind-ubuntu and includes it in release artifacts. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 20/20 changed files
- Comments generated: 2
| EXPOSE 2375 2376 | ||
|
|
||
| CMD ["dockerd", "--host=unix:///var/run/docker.sock"] |
| if (config.chrootBinariesSourcePath && !config.chrootBinariesSourcePath.startsWith('/')) { | ||
| logger.error( | ||
| `❌ chroot.binariesSourcePath must be an absolute path, got: ${config.chrootBinariesSourcePath}`, | ||
| ); | ||
| logger.error(' Example (stdin config): {"chroot":{"binariesSourcePath":"/tmp/gh-aw/runner-bin"}}'); | ||
| process.exit(1); | ||
| } | ||
| if (config.chrootBinariesSourcePath === '/') { | ||
| logger.error('❌ chroot.binariesSourcePath cannot be "/"'); | ||
| logger.error(' Provide a specific binaries directory, for example /tmp/gh-aw/runner-bin'); | ||
| process.exit(1); | ||
| } |
|
@copilot address review feedback and merge main |
Done in 230f9a0:
|
|
@copilot run pr-finisher skill |
There's no |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (3 files)
Coverage comparison generated by |
|
GitHub API: ✅ PASS Total: PASS
|
|
Smoke test results:
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
🔬 Smoke Test ResultsPR: [awf] ARC/DinD: preserve chroot identity overrides, add binaries overlay path, and publish glibc DinD companion image
Overall: FAIL — pre-step outputs (
|
|
Smoke Test: Copilot BYOK (Direct) Mode — PASS ✅
Running in direct BYOK mode via PR: #4587 by
|
Chroot Version Comparison Results
Result: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot environments.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL
|
ARC/DinD chroot runs had two AWF-specific breakages:
HOME/USER/LOGNAMEoverrides were being lost aftercapsh, and runner-installed CLIs were not reliably visible when/usrcame from the daemon filesystem. This PR adjusts chroot identity application order, adds a first-class binaries overlay path, and introduces a glibc DinD image path for ARC guidance.Entrypoint identity semantics (post-capsh effective env)
HOME,USER, andLOGNAMEnow come fromchroot.identity.*without being clobbered by pre-switch environment state.Config surface:
chroot.binariesSourcePathchroot.binariesSourcePathto config types, schema, config-file mapping, and config assembly./).<binariesSourcePath>:/host/usr/local/bin:ro, allowing runner-side binaries (e.g.copilot) to be visible in chroot without pre-run copy hacks.ARC/DinD companion image
containers/dind-ubuntu/Dockerfilefor a glibc DinD base withdocker-ce,libcap2-bin(capsh), and Node.js preinstalled.ghcr.io/github/gh-aw-firewall/dind-ubuntu.Docs/schema updates
chroot.binariesSourcePathand thedind-ubunturecommendation.{ "chroot": { "binariesSourcePath": "/tmp/gh-aw/runner-bin", "identity": { "home": "/tmp/gh-aw/home", "user": "runner", "uid": 1001, "gid": 1001 } } }