Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

🩺 Runner Doctor UpdateRunner Doctor knowledge-base update: A27 ARC/DinD safe-output staging fix (#8932/#8933/#8938)

Open
#8,968 0 comments 1 reaction 2 assignees View on GitHub

@lpcox is already working on this.

Since Sep 24, 2026.

  • #8969 by @copilot-swe-agent — open

Assessment

This issue has not been assessed yet.

Description

automated runner-doctor

Summary

  • Scan window: items updated on/after 2026-09-22 in github/gh-aw-firewall
  • Items reviewed: ~90 issues/PRs across targeted searches (ARC/DinD, self-hosted, GHES/GHEC, chroot/musl, corporate proxy, DNS/toolcache/passwd/capsh, topology/NO_PROXY, gvisor/sbx/cloud-hypervisor signals)
  • Genuinely new lessons: 1 (new ARC/DinD failure mode, not yet in the catalog)

Proposed knowledge-base changes

.github/workflows/shared/self-hosted-failure-modes.md

Add a new row A27 to the Category A (ARC / DinD) table, immediately after the existing A26 row:

ID Signal Root cause Fix / flag Probe Citations
A27 On runner.topology: arc-dind, safe-output payload files staged under /tmp/gh-aw/agent (patch/bundle handoff, PR body, etc.) silently fail to write inside the AWF chroot — the heredoc/write succeeds on the runner side against a path the Docker daemon never sees, producing empty safe-output fields (e.g. an empty PR body) instead of a hard failure ARC/DinD's "Create gh-aw temp directory" step and AWF's dind-bootstrap.ts pre-staging only created /tmp/gh-aw/agent on the runner filesystem. The Docker daemon in a split-filesystem DinD topology cannot see that path, so when RUNNER_TEMP is set (the daemon-visible staging root), the corresponding ${RUNNER_TEMP}/gh-aw/agent directory was never created or pre-staged, leaving no daemon-visible landing path for the agent's safe-output writes Fixed in AWF (PR github/gh-aw-firewall#8933, merged 2026-09-24, fixes #8932): ensureAgentStagingDirectories() in src/dind-bootstrap.ts now creates both /tmp/gh-aw/agent (existing behavior) and ${RUNNER_TEMP}/gh-aw/agent when RUNNER_TEMP is set; agent was added to DEFAULT_PRE_STAGE_DIRS so DinD bootstrap also pre-stages it through Docker; ${RUNNER_TEMP}/gh-aw is pre-staged as a second work-directory tree when it differs from the configured dind.workDir. Non-DinD/no-RUNNER_TEMP behavior is unchanged. Upgrade AWF to include github/gh-aw-firewall#8933. Set RUNNER_TEMP and dind.preStageDirs: true and inspect whether ${RUNNER_TEMP}/gh-aw/agent exists and was pre-staged through Docker (not just /tmp/gh-aw/agent); on unpatched AWF only the runner-side path exists and safe-output payloads written to /tmp/gh-aw/agent inside the chroot silently vanish; on patched AWF both paths exist and are pre-staged github/gh-aw#63045, github/gh-aw#62924, github/gh-aw-firewall#8932, github/gh-aw-firewall#8933, github/gh-aw-firewall#8938
.github/workflows/self-hosted-runner-doctor.md

Add an entry to the "Error-string quick lookup" table:

Observable Likely mode
Safe-output field (e.g. PR body) comes back empty on runner.topology: arc-dind, with no write error, and the payload was staged under /tmp/gh-aw/agent A27 (daemon-invisible staging path when RUNNER_TEMP is set; fixed in github/gh-aw-firewall#8933)
Proposed portable agent changes

.github/agents/self-hosted-runner-doctor.md — mirror both edits above exactly:

  1. Insert the same A27 table row into its embedded Category A catalog, immediately after its own A26 row (currently ending github/gh-aw#59880, github/gh-aw-firewall#8390, github/gh-aw-firewall#8398 |).
  2. Add the matching error-string lookup entry to its embedded "Error-string quick lookup" section.

Source issues and PRs

  • github/gh-aw-firewall#8932 — "Fix ARC/DinD temp staging path for agent safe-output payloads" (root-cause issue, references upstream github/gh-aw#63045)
  • github/gh-aw-firewall#8933 — "Fix ARC/DinD agent safe-output staging paths" (the merged fix: ensureAgentStagingDirectories() in src/dind-bootstrap.ts, adds agent to DEFAULT_PRE_STAGE_DIRS, pre-stages ${RUNNER_TEMP}/gh-aw when it differs from dind.workDir)
  • github/gh-aw-firewall#8938 — "[awf] ARC/DinD: /tmp/gh-aw/agent staged host-side, invisible inside AWF chroot" (duplicate of #8932, closed same day, references upstream github/gh-aw#62924)

Notes on other reviewed items

The rest of this window's activity was either unrelated to non-hosted-runner failure modes (routing/NVX preview-runtime work, Gemini/Vertex GCP WIF auth, Copilot CLI model/MCP-protocol 400s, TLS SNI enforcement, config-consistency refactors) or already fully captured in the catalog (B2's explicit-port proxy fix, #8877/#8887, was already merged into the catalog via PR #8925 before this scan). No open runner-doctor-labeled issues currently duplicate this proposal.

Generated by Runner Doctor Updater · copilot · auto · 163.6 AIC · ⊞ 4.3K · ◷

  • expires on Oct 24, 2026, 4:42 PM UTC
Dominant language
TypeScript
Stars
145
Forks
63
Avg merge
6h 22m
Merged PRs (30d)
232

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw-firewall

All issues in github/gh-aw-firewall

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.