fix: drop workDir-adjacent chroot-home mount on split-fs sysroot#5857
Conversation
The sysroot bind-mount filter for arc-dind/split-fs only dropped sources equal
to workDir or under workDir/. The empty-home mount is sourced from the sibling
path ${workDir}-chroot-home, which slipped through and left a bind mount the
DinD daemon cannot resolve. Broaden the filter to drop any source with the
unique /tmp/awf-<ts> workDir prefix, covering the chroot-home sibling.
Fixes the failing compose-generator unit test 'filters out workDir and home
dot-directory bind mounts on split-fs'.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
Fixes a regression in ARC/DinD split-filesystem mode where the sysroot-stage volume filtering failed to drop the empty-home bind mount sourced from the workDir-adjacent ${workDir}-chroot-home directory, causing generateDockerCompose tests to fail on main.
Changes:
- Broadened the sysroot bind-mount source filtering logic to catch
workDir-adjacent paths (like-chroot-home) in addition toworkDir/…children. - Added a regression test covering the
${workDir}-chroot-homesibling bind mount being filtered out in split-fs mode.
Show a summary per file
| File | Description |
|---|---|
| src/services/optional-services.ts | Adjusts sysroot-stage bind-mount filtering to drop workDir-adjacent sources that the DinD daemon can’t resolve on split filesystems. |
| src/compose-generator.test.ts | Adds a regression test asserting the -chroot-home sibling bind mount is removed for runnerTopology: arc-dind. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Low
| // Drop mounts sourced from AWF workDir (runner's unshared /tmp/awf-*). | ||
| // This includes the workDir itself, paths under it, and workDir-adjacent | ||
| // sibling paths such as the empty-home dir (`${workDir}-chroot-home`) — all | ||
| // are created by AWF under the runner's /tmp and are invisible to the daemon. | ||
| // workDir is a unique `/tmp/awf-<timestamp>` path, so a prefix match is safe. | ||
| if (source.startsWith(normalizedWorkDirPrefix)) { | ||
| return false; | ||
| } |
|
@copilot address review feedback |
Done in 9cf1028. Replaced the broad |
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
🔌 Smoke Services — All services reachable! ✅ |
|
🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅ |
|
✅ Smoke Gemini completed. All facets verified. 💎 |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓 |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓 |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
Chroot tests failed Smoke Chroot failed - See logs for details. |
|
✅ Smoke Claude passed |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
🚀 Security Guard has started processing this pull request |
|
✅ Build Test Suite completed successfully! |
|
✅ Contribution Check completed successfully! PR follows the applicable CONTRIBUTING.md guidelines: clear description, regression test included, no documentation update needed for this internal bug fix, and files are organized under src/. |
Smoke Test: Claude Engine Validation
Overall Result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Copilot BYOK Smoke Test ✅ PASS
All tests passed. Agent successfully routed through api-proxy sidecar with credential injection. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
@lpcox
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL — Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: Copilot PAT Auth PASS
Overall: PASS - Auth mode: PAT (COPILOT_GITHUB_TOKEN) Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
OTEL Smoke Test Results
All 5 scenarios pass or are in expected-pending state for this development smoke test. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test Results
Overall: PARTIAL — connectivity confirmed; pre-step outputs were not injected (template literals unreplaced). cc @lpcox Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test Results: Gemini
PR Titles Found:
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
|
PRs reviewed:
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"
- "registry.npmjs.org"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Problem
npm testis failing onmain(Test Coverage workflow, Linux) insrc/compose-generator.test.ts:Root cause
The sysroot bind-mount filter (
filterAgentVolumesForSysrootinsrc/services/optional-services.ts) drops mounts sourced from the AWFworkDirso the DinD daemon isn't handed paths it can't resolve on a split filesystem. But it only matched sources equal toworkDiror underworkDir/.The empty-home mount is sourced from the sibling path
${workDir}-chroot-home(seesrc/services/agent-volumes/home-strategy.ts:18). That leading dash means it never matchedworkDir/, so it slipped through — leaving a bind mount (/tmp/awf-<ts>-chroot-home:/host<home>) the daemon cannot see. This is platform-independent and reproduces in CI.Fix
Broaden the filter to drop any source starting with the
workDirprefix.workDiris a unique/tmp/awf-<timestamp>path, so a prefix match safely covers the workDir itself, paths under it, and the-chroot-homesibling without risking unrelated mounts.Verification
-chroot-homesibling is dropped.npm test: 3434 passed (was 1 failing on main).npm run buildclean.