fix(cap-drop): filter container cap_drop against host capability bounding set by Copilot · Pull Request #7795 · github/gh-aw-firewall

Copilot · 2026-08-27T18:48:02Z

Hosts running container runtimes with trimmed capability bounding sets (e.g. Talos Linux under arc-dind) fail to start AWF sandboxes because Docker rejects explicit cap_drop entries for capabilities absent from the host (e.g., invalid CapDrop: ... "CAP_SYS_MODULE"). This change inspects the host process capability bounding set (/proc/self/status CapBnd) and filters unsupported entries from cap_drop before writing docker-compose.yml, alongside an AWF_SKIP_CAP_DROP escape hatch.

Capability Bounding Set Filtering (`src/capability-filter.ts`)

Parses /proc/self/status CapBnd to map Linux capability bit positions (bits 0–40).
Strips named capabilities missing from CapBnd from service cap_drop arrays, preserving ALL wildcards and unrecognized capability names.
Evaluates AWF_SKIP_CAP_DROP (1, true, yes) to strip cap_drop directives entirely if capability dropping is prohibited.

Compose Generation Integration (`src/compose-generator.ts`, `src/docker-manager.ts`)

Passes generated compose objects through filterComposeCapDrop before returning from generateDockerCompose.
Re-exports capability filtering helpers in src/docker-manager.ts.

Documentation (`docs/environment.md`)

Documents AWF_SKIP_CAP_DROP environment variable in the configuration reference.

Usage Example

import { filterCapDrop } from './capability-filter';

// Host CapBnd with bit 16 (SYS_MODULE) cleared
const trimmedCapBnd = 0x000001fffffeffffn;

const requestedCapDrop = ['NET_RAW', 'SYS_ADMIN', 'SYS_MODULE'];
const effectiveCapDrop = filterCapDrop(requestedCapDrop, trimmedCapBnd);
// Result: ['NET_RAW', 'SYS_ADMIN'] — SYS_MODULE omitted to prevent Docker CapDrop rejection

Fixes [awf] cap_drop: hardcoded CAP_SYS_MODULE breaks arc-dind on hosts with trimmed capability bounding set (Talos) #7788

Copilot

Pull request overview

Adds capability-aware cap_drop filtering for hosts with restricted bounding sets.

Changes:

Parses Linux CapBnd and filters Compose capabilities.
Adds an AWF_SKIP_CAP_DROP escape hatch.
Adds tests, exports, and documentation.

Show a summary per file

File	Description
`src/capability-filter.ts`	Implements capability filtering.
`src/compose-generator.ts`	Applies filtering to generated Compose configuration.
`src/docker-manager.ts`	Re-exports filtering helpers.
`src/capability-filter.test.ts`	Tests filtering behavior and integration.
`src/docker-manager-reexports.test.ts`	Tests new exports.
`docs/environment.md`	Documents the escape hatch.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 6/6 changed files
Comments generated: 2
Review effort level: Balanced

+| `AWF_SKIP_CAP_DROP` | Set to `1`, `true`, or `yes` to disable specifying `cap_drop` requirements in generated Docker Compose configurations (useful for hosts with trimmed capability bounding sets). | `1` |
 | `NO_PROXY` | Domains bypassing Squid (host access mode) | `localhost,host.docker.internal` |

 **Note:** Most of these are set automatically based on CLI options and should not be overridden manually. `AWF_SESSION_STATE_DIR` is an exception — it is the environment-variable equivalent of `--session-state-dir` and can be set by users to configure a predictable session-state output path.


+ * Reads the host capability bounding set (CapBnd) from /proc/self/status.
+ * Returns the BigInt bitmask if available and readable, or null if unavailable.
+ */
+export function getHostCapabilityBoundingSet(procStatusPath = '/proc/self/status'): bigint | null {


lpcox · 2026-08-27T19:07:24Z

@copilot address review feedback

Copilot · 2026-08-27T19:13:14Z

@copilot address review feedback

Addressed in 0b59608: capability filtering now probes CapBnd from a privileged container created through the configured Docker daemon using getLocalDockerEnv(), avoiding the CLI process/ARC-DinD mismatch. Documentation now identifies AWF_SKIP_CAP_DROP as a last-resort escape hatch that removes every cap_drop directive, including ALL.

github-actions · 2026-08-27T19:22:32Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-08-27T19:22:46Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit bba4407

github-actions · 2026-08-28T01:34:33Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-08-28T01:34:34Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-08-28T01:34:35Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-08-28T01:34:37Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-08-28T01:34:37Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7795

github-actions · 2026-08-28T01:34:38Z

✅ Smoke Claude passed

Generated by Smoke Claude for #7795

github-actions · 2026-08-28T01:34:38Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-08-28T01:34:39Z

❌ Security Guard failed. Please review the logs for details.

Generated by Security Guard for #7795

github-actions · 2026-08-28T01:37:35Z

Smoke Test: Copilot BYOK (Direct) ✅

✅ GitHub MCP: PR queries working
✅ GitHub.com connectivity: HTTP 200
✅ File write/read: verified
✅ BYOK inference: active (api-proxy → api.githubcopilot.com)

Status: PASS | Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY)

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:37:52Z

Copilot Engine Smoke Test @lpcox

✅ GitHub MCP connectivity (PR refactor: split Cloud Hypervisor backend helpers #7797, PR Split Cloud Hypervisor manager lifecycle into focused modules #7796 fetched)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:37:53Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
GitHub CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #7795 · claude · haiku45 · 55.7 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:38:22Z

Smoke Test: Services Connectivity

Redis PING: ❌ (DNS resolution failure for host.docker.internal)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (DNS resolution failure)

Overall: FAIL

host.docker.internal could not be resolved from within the AWF sandbox — name resolution failure for all three checks.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:38:41Z

Smoke Test: Docker Sbx Validation

MCP: ✅ (PR refactor: split Cloud Hypervisor backend helpers #7797, Split Cloud Hypervisor manager lifecycle into focused modules #7796 fetched)
github.com connectivity: ✅ (HTTP 200)
File write/read: ✅

Overall: PASS

cc @lpcox (author)

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:39:25Z

PR titles:

Add protected enclave entry diagnostics
Unavailable (safeinputs-gh missing)

GitHub reads: ❌
Playwright: ✅
File write/read: ✅
Discussion: ❌
Build: ✅
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:39:33Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.19.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment. smoke-chroot label not applied since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:39:56Z

Smoke Test: API Proxy OTEL Tracing — Results

✅ Scenario 1 (Module Loading): otel.js loads successfully; isEnabled() returns true; exports include startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus internal helpers.
✅ Scenario 2 (Test Suite): OTEL jest suites pass — 3 suites (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js), 68/68 tests passed.
✅ Scenario 3 (Env Var Forwarding): src/services/agent-environment/env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID; src/services/api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and the trace context vars.
✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js contains the onUsage callback hook point for OTEL.
⚠️ Scenario 5 (OTEL Diagnostics): No otel.jsonl was found under api-proxy-logs for this run (no LLM API calls were proxied through api-proxy in this smoke test), so no spans were exported this run — expected given the workflow scope, not a failure of the OTEL integration itself (workflow-level gh-aw spans in /tmp/gh-aw/otel.jsonl did export correctly).

Overall: All scenarios pass or are expected-pending; no regressions found.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:40:18Z

@Copilot @lpcox

MCP connectivity via GitHub MCP: ❌
GitHub.com HTTP: ✅
File I/O: ✅
BYOK inference: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall: FAIL

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-28T01:40:22Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

All repositories cloned successfully; all builds/installs succeeded; all tests passed. Note: Maven builds used -Dmaven.repo.local pointed at a writable temp directory since ~/.m2/repository was not writable by the default user in this environment.

Generated by Build Test Suite for #7795 · copilot · auto · 54.5 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

Initial plan

176469c

Copilot AI assigned Copilot and lpcox Aug 27, 2026

Copilot started work on behalf of lpcox August 27, 2026 18:48 View session

Copilot AI linked an issue Aug 27, 2026 that may be closed by this pull request

[awf] cap_drop: hardcoded CAP_SYS_MODULE breaks arc-dind on hosts with trimmed capability bounding set (Talos) #7788

Closed

fix: filter cap_drop against host capability bounding set

2cc995a

Copilot AI changed the title ~~[WIP] Fix hardcoded CAP_SYS_MODULE in cap_drop for arc-dind~~ fix(cap-drop): filter container cap_drop against host capability bounding set Aug 27, 2026

Copilot finished work on behalf of lpcox August 27, 2026 19:01

Copilot AI requested a review from lpcox August 27, 2026 19:01

lpcox marked this pull request as ready for review August 27, 2026 19:02

Copilot AI balanced review requested due to automatic review settings August 27, 2026 19:02

Copilot started reviewing on behalf of lpcox August 27, 2026 19:02 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Copilot started work on behalf of lpcox August 27, 2026 19:07 View session

fix: probe Docker daemon capability bounding set

0b59608

Copilot finished work on behalf of lpcox August 27, 2026 19:13

lpcox added the ready-for-aw label Aug 28, 2026

lpcox deployed to aoai-model August 28, 2026 01:34 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 28, 2026

github-actions Bot added smoke-copilot-byok smoke-copilot labels Aug 28, 2026

github-actions Bot added the smoke-claude label Aug 28, 2026

github-actions Bot added the smoke-docker-sbx label Aug 28, 2026

github-actions Bot mentioned this pull request Aug 28, 2026

[aw] Contribution Check hit engine rate limit (HTTP 429) #7803

Closed

github-actions Bot mentioned this pull request Aug 28, 2026

[aw] Smoke Copilot BYOK AOAI (api-key) hit engine rate limit (HTTP 429) #7804

Closed

lpcox deployed to aoai-model August 28, 2026 01:40 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-byok-aoai-entra label Aug 28, 2026

lpcox deployed to aoai-model August 28, 2026 01:40 — with GitHub Actions Active

github-actions Bot added the build-test label Aug 28, 2026

github-actions Bot mentioned this pull request Aug 28, 2026

[aw] Security Guard hit engine rate limit (HTTP 429) #7806

Closed

lpcox merged commit 003225a into main Aug 28, 2026
158 of 165 checks passed

lpcox deleted the copilot/awf-fix-cap-drop-issue branch August 28, 2026 02:53

github-actions Bot mentioned this pull request Aug 28, 2026

🩺 Runner Doctor UpdateRunner Doctor: update catalog with A22 (cap_drop/Talos) and B27 (awf-net collision) from 2026-08-26+ scan #7835

Closed

Copilot AI mentioned this pull request Aug 28, 2026

Update Runner Doctor catalog with A22 and B27 #7836

Merged

Copilot AI mentioned this pull request Aug 30, 2026

docs: add B28 runner-doctor coverage for private-CA api-proxy TLS failures #7871

Open

Uh oh!

Conversation

Copilot AI commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Capability Bounding Set Filtering (src/capability-filter.ts)

Compose Generation Integration (src/compose-generator.ts, src/docker-manager.ts)

Documentation (docs/environment.md)

Usage Example

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Aug 27, 2026

Uh oh!

Copilot AI commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026

Smoke Test: Copilot BYOK (Direct) ✅

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Aug 28, 2026

Smoke Test: API Proxy OTEL Tracing — Results

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

🏗️ Build Test Suite Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

Copilot AI commented Aug 27, 2026 •

edited

Loading

Capability Bounding Set Filtering (`src/capability-filter.ts`)

Compose Generation Integration (`src/compose-generator.ts`, `src/docker-manager.ts`)

Documentation (`docs/environment.md`)

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading