feat: add gVisor smoke test workflow#6092
Merged
Merged
Conversation
Adds a new workflow that installs gVisor (runsc), registers it as a Docker runtime, and runs a standard AWF smoke test to validate compatibility. This workflow will be used to test gVisor support once the runtime field is plumbed through AWF's compose generation. The pre-agent step: 1. Downloads and installs runsc + containerd-shim-runsc-v1 2. Registers runsc in Docker daemon.json via 'runsc install' 3. Verifies gVisor works with a hello-world container The agent step runs the standard smoke test (MCP, connectivity, file I/O) and adds a gVisor-specific runtime detection check. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (2 files)
Coverage comparison generated by |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new agentic workflow to smoke-test gVisor (runsc) installation/registration on GitHub-hosted runners, as groundwork for a follow-up PR that will wire gVisor runtime selection into AWF’s compose generation.
Changes:
- Introduces a new
smoke-gvisoragentic workflow (workflow_dispatch+ PR label trigger) with pre-agent gVisor install/verification steps and an agent prompt for reporting results. - Adds a post-agent verification job that downloads the agent artifact and performs basic runtime/log checks plus token-usage sanity validation.
- Commits the compiled lock workflow (
.lock.yml) for deterministic execution.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/smoke-gvisor.md | New agentic workflow definition, including gVisor install/verification steps, prompt, and post-agent verification job. |
| .github/workflows/smoke-gvisor.lock.yml | Compiled workflow output generated from smoke-gvisor.md. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 5
- Review effort level: Low
|
|
||
| ## Context | ||
|
|
||
| This workflow validates that AWF's network-isolation mode works correctly when the agent container runs under gVisor (`runsc`) instead of the default `runc` runtime. The pre-agent step installed gVisor and registered it as a Docker runtime. |
Comment on lines
+5
to
+8
| label_command: | ||
| name: test-gvisor | ||
| events: [pull_request] | ||
| remove_label: false |
Comment on lines
+34
to
+35
| add-labels: | ||
| allowed: [smoke-gvisor] |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a gVisor (runsc) smoke test workflow to validate AWF's compatibility with alternative container runtimes. This is the first of two PRs — it establishes the workflow on
mainso the second PR can use it to test actual gVisor runtime plumbing in AWF.What this does
The workflow (
smoke-gvisor.md) is triggered viaworkflow_dispatchor thetest-gvisorlabel on PRs. It:Pre-agent step: Install gVisor
runscandcontainerd-shim-runsc-v1from gVisor releasesrunscas a Docker runtime viarunsc installdocker run --rm --runtime=runsc hello-worldAgent step: Standard smoke test under gVisor environment
/proc/version,dmesgavailability)Post-agent step: Verify gVisor was used
Design notes
sandbox.agent.runtimefield yet — the compiler doesn't support this. The second PR will add the AWF-sideruntime:field to compose generation, at which point this workflow will actually run the agent container under gVisor.runtime: runscto Docker Compose. This PR validates the install + registration path works on GitHub-hosted runners.sandbox.agent.runtime: gvisorto this workflow's frontmatter will complete the end-to-end test.Follow-up (second PR)
runtime?: stringtoDockerServiceinterface insrc/types/docker.ts--container-runtimeCLI flagsandbox.agent.runtime: gvisorRelated: #3264