🩺 Runner Doctor Update🩺 Runner Doctor update: D1 (gVisor resolved), B11 (silent repair failure → exit 1)

[github-actions]

Summary

• Scan window: 2026-06-26 to 2026-07-10
• Items reviewed: ~30 issues and PRs updated in this window
• Genuinely new lessons: 2

---

Proposed knowledge-base changes

For .github/workflows/shared/self-hosted-failure-modes.md:

1. Update D1 — gVisor support added (partial resolution)

Current D1 row:

| D1 | AWF does not start or isolation is ineffective under gVisor / Kata | These runtimes do not support AWF's expected netns / capability model | Known unresolved research area | `docker info | grep -i runtime`; inspect NAT rules in `awf-iptables-init` | #3264 |

Proposed replacement:

| D1 | AWF does not start or isolation is ineffective under gVisor / Kata | These runtimes do not support AWF's expected netns / capability model in their default configuration | **gVisor (`runsc`) resolved** in PR github/gh-aw-firewall#6093 (merged 2026-07-10): use `--container-runtime gvisor`; AWF detects `runsc` and applies the appropriate seccomp/capability profile. **Kata Containers** remain an unresolved research area. | `docker info | grep -i runtime`; use `--container-runtime gvisor` with AWF including github/gh-aw-firewall#6093 | #3264, github/gh-aw-firewall#6093 |

Remove D1 from the Known unresolved items section (or narrow it to Kata only):

Current:

- D1 / #3264 — gVisor and Kata compatibility research

Proposed replacement:

- D1 / #3264 — Kata Containers compatibility research (gVisor resolved in github/gh-aw-firewall#6093)

---

2. Add B11 — Rootless repair failure causes non-zero exit code despite successful agent task

Add as a new row after B10 in the Category B table:

| B11 | Agent task succeeds but AWF process exits with code 1; logs show `[WARN] Rootless artifact permission repair failed for .../sandbox/firewall/logs (exit 1)` and `[WARN] Failed to remove chroot home directory after permission repair: Error: EACCES`; no actionable detail visible — repair container stderr was silently discarded | `fixArtifactPermissionsForRootless()` ran a `docker run` for chown/chmod but did not capture or log stderr, so the root cause was opaque. `removeWorkDirectories()` then escalated the subsequent `EACCES` from `fs.rmSync` on remapped-UID files to a fatal exit, overriding the successful agent exit code. | **Fixed in AWF (PR github/gh-aw-firewall#6072, merged 2026-07-10)**: stderr from the repair container is now captured and included in the `[WARN]` message. Chroot-home removal failure is downgraded from `warn` to `debug` so it no longer propagates as a non-zero exit code — the post-step cleanup via `sudo` handles it. Upgrade to AWF including github/gh-aw-firewall#6072. | `[WARN] Rootless artifact permission repair failed` with no additional detail (no stderr), followed by `Command completed with exit code: 1` even though the agent log shows success | github/gh-aw-firewall#6070, github/gh-aw-firewall#6072 |

Add a new error-string lookup entry:

| `[WARN] Rootless artifact permission repair failed ... (exit 1)` with no stderr detail, followed by `Command completed with exit code: 1` despite apparent agent success | B11 |

---

Proposed doctor changes

For .github/workflows/self-hosted-runner-doctor.md:

Same updates as above — the doctor embeds the same catalog tables.

---

Proposed portable agent changes

For .github/agents/self-hosted-runner-doctor.md:

The portable agent embeds a copy of the catalog. Apply the same two changes:

1. Update D1 row and Known-unresolved entry (gVisor resolved, Kata still open).
2. Add B11 row and error-string lookup entry.

---

Source issues and PRs

• D1 update: PR feat: gVisor runtime support #6093 (feat: gVisor runtime support, merged 2026-07-10 to main) — resolves the gVisor half of the D1 research item. Issue [research] Supporting alternative container runtimes (gVisor, Kata Containers) in AWF #3264 remains open for Kata.
• B11 new mode: Issue Rootless artifact permission repair fails silently — causes exit code 1 on cleanup #6070 (Rootless artifact permission repair fails silently — causes exit code 1 on cleanup, closed 2026-07-10) + PR fix: log stderr from rootless permission repair and make chroot-home removal non-fatal #6072 (fix: log stderr from rootless permission repair and make chroot-home removal non-fatal, merged 2026-07-10).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Runner Doctor Updater · 100.2 AIC · ⊞ 13.8K · ◷

• expires on Aug 9, 2026, 7:28 PM UTC