Pre-install commonly needed system packages in agent container image by Copilot · Pull Request #1432 · github/gh-aw-firewall

Copilot · 2026-03-25T18:22:58Z

The agent container lacks several packages present on GitHub Actions ubuntu-latest runners, forcing agents to install them at runtime and often exhausting their turn budget.

Changes

containers/agent/Dockerfile — New RUN layer installs lightweight runner-parity packages with the same retry logic and --no-install-recommends pattern used by existing package installation:
- libgdiplus (GDI+ for .NET System.Drawing)
- libev-dev (high-performance event loop library)
- libssl-dev (OpenSSL development headers for native extensions)
- php-intl, php-gd (common PHP extensions)
docs-site/.../agent-images.md — Documents new packages in the agent image tools table

Heavy packages (pandoc, libgtk-4-dev, libadwaita-1-dev, opam) were excluded to keep image size reasonable — the lightweight set adds ~77 MB uncompressed (~38% increase) vs ~907 MB for the full set.

All packages verified installable together on ubuntu:22.04. Dockerfile.minimal unchanged — chroot mode relies on host tools.

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/e8563f79-69e4-48ef-84cd-98df7851552f

Mossaka · 2026-03-25T18:53:26Z

@copilot how does this affect agent container image size?

Copilot · 2026-03-25T18:58:24Z

@copilot how does this affect agent container image size?

Measured the impact on a fresh ubuntu:22.04 base:

Package	Installed Size
`pandoc`	~148 MB
`libssl-dev`	~12 MB
`libgtk-4-dev`	~11 MB
`opam`	~9 MB
`libadwaita-1-dev`	~1 MB
`libgdiplus`	~0.5 MB
`php-intl`	~0.5 MB
`libev-dev`	~0.2 MB
`php-gd`	~0.1 MB

The full layer (9 requested packages + 330 transitive dependencies) adds ~907 MB uncompressed to the image. The compressed Docker layer (what gets pulled) would be smaller, but this is still significant — mostly driven by pandoc and the GTK4/SSL dev header dependency chains.

For reference, the current agent image is ~200 MB. This would roughly 5× the image size. If that's a concern, we could consider:

Dropping pandoc (the single heaviest package) to cut ~148 MB + deps
Dropping libgtk-4-dev/libadwaita-1-dev (heavy GTK dependency chain) to save more
Keeping only the lightweight packages (libev-dev, libssl-dev, libgdiplus, php-intl, php-gd) which add much less

Mossaka · 2026-03-25T19:36:41Z

@copilot go with your suggestions

Dropping pandoc (the single heaviest package) to cut ~148 MB + deps
Dropping libgtk-4-dev/libadwaita-1-dev (heavy GTK dependency chain) to save more
Keeping only the lightweight packages (libev-dev, libssl-dev, libgdiplus, php-intl, php-gd) which add much less

And then measure the size impact

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/109bc7bc-c61b-481f-8398-7c6a21d34d50 Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot · 2026-03-25T19:40:14Z

@copilot go with your suggestions

Dropping pandoc (the single heaviest package) to cut ~148 MB + deps
Dropping libgtk-4-dev/libadwaita-1-dev (heavy GTK dependency chain) to save mor...

Done in 9bfc7e9. Dropped pandoc, libgtk-4-dev, libadwaita-1-dev, and opam. The remaining lightweight packages (libgdiplus, libev-dev, libssl-dev, php-intl, php-gd) add:

~77 MB uncompressed Docker layer (down from ~907 MB)
44 new packages (down from 330)
Image goes from ~200 MB → ~277 MB (vs ~1.1 GB before)

Updated both the Dockerfile and docs accordingly.

github-actions · 2026-03-25T19:58:01Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit b9b1f7b

github-actions · 2026-03-25T19:58:09Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.69%	82.80%	📈 +0.11%
Statements	82.35%	82.46%	📈 +0.11%
Functions	81.11%	81.11%	➡️ +0.00%
Branches	75.88%	75.94%	📈 +0.06%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	86.3% → 86.7% (+0.44%)	85.7% → 86.1% (+0.42%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Adds a small set of preinstalled Ubuntu packages to the default agent container image to better match commonly available dependencies on GitHub Actions runners, reducing runtime setup time in workflows.

Changes:

Install additional “runner-parity” packages in containers/agent/Dockerfile with existing apt retry + --no-install-recommends pattern.
Document the newly preinstalled packages in the agent image tools reference.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
containers/agent/Dockerfile	Adds a new apt install layer for parity packages (libgdiplus, libev-dev, libssl-dev, php-intl, php-gd).
docs-site/src/content/docs/reference/agent-images.md	Updates the agent image tools table to include the newly installed packages.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T19:59:35Z

+| php-intl | — | `php-intl` | PHP Internationalization extension |
+| php-gd | — | `php-gd` | PHP GD graphics extension |


The table lists php-intl/php-gd as available “tools”, but the agent image Dockerfile doesn’t appear to install a PHP runtime (php/php-cli). If PHP isn’t actually runnable in the image, these rows may be misleading—either add the runtime or note explicitly that only the extension packages/deps are present and php may not be available.

Suggested change

| php-intl | — | `php-intl` | PHP Internationalization extension |

| php-gd | — | `php-gd` | PHP GD graphics extension |

| php-intl | — | `php-intl` | PHP Internationalization extension package/dependencies only; PHP runtime (`php`/`php-cli`) may not be installed |

| php-gd | — | `php-gd` | PHP GD graphics extension package/dependencies only; PHP runtime (`php`/`php-cli`) may not be installed |

Copilot · 2026-03-25T19:59:36Z

+# These packages are commonly needed by workflows and avoid agents spending time installing them manually
+# See: https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2204-Readme.md
+RUN set -eux; \
+    PARITY_PKGS="libgdiplus libev-dev libssl-dev php-intl php-gd"; \


php-intl and php-gd are extensions but this Dockerfile doesn’t install a PHP runtime (php/php-cli). On Ubuntu, these packages may not provide the php executable, so workflows still won’t be able to run PHP. Either add an explicit PHP runtime package (e.g., php-cli/php) or clarify in docs/comments that PHP itself is not included and these are only for build dependencies.

Suggested change

PARITY_PKGS="libgdiplus libev-dev libssl-dev php-intl php-gd"; \

# Include php-cli so that PHP workflows have a runtime, not just extensions.

PARITY_PKGS="libgdiplus libev-dev libssl-dev php-cli php-intl php-gd"; \

Copilot · 2026-03-25T19:59:36Z

+# Install additional system packages for GitHub Actions runner parity
+# These packages are commonly needed by workflows and avoid agents spending time installing them manually
+# See: https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2204-Readme.md
+RUN set -eux; \
+    PARITY_PKGS="libgdiplus libev-dev libssl-dev php-intl php-gd"; \
+    apt-get update && \
+    ( apt-get install -y --no-install-recommends $PARITY_PKGS || \
+      (echo "apt-get install failed, retrying with fresh package index..." && \
+       rm -rf /var/lib/apt/lists/* && \
+       apt-get update && \
+       apt-get install -y --no-install-recommends $PARITY_PKGS) ) && \
+    rm -rf /var/lib/apt/lists/*


This new RUN duplicates the existing apt retry/install logic and does an additional apt-get update in a separate layer. To reduce build time and keep the Dockerfile simpler, consider folding PARITY_PKGS into the earlier PKGS install (same retry block) so the package index is fetched once per build step and the logic isn’t repeated.

github-actions · 2026-03-25T20:03:45Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note (Java): Maven's default local repository (~/.m2/repository) was not writable due to directory ownership. Tests succeeded using -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo.

Generated by Build Test Suite for issue #1432 · ◷

github-actions · 2026-03-25T20:05:31Z

🔮 The oracle has read the runes of smoke test 23560473235.
PR titles: "docs: Fix proxy env var docs and add missing CLI flags", "fix: write apiKeyHelper to ~/.claude/settings.json for Claude Code v2.1.81+"
GitHub MCP (last 2 merged PRs): ✅
safeinputs-gh pr list --repo github/gh-aw-firewall --limit 2 --json number,title,author: ❌ (tool unavailable)
Playwright title contains "GitHub": ✅
Tavily search returned at least one result: ❌ (Tavily MCP unavailable)
File write /tmp/gh-aw/agent/smoke-test-codex-23560473235.txt: ✅
Bash cat verification: ✅
Discussion query/comment via safe-input tool: ❌ (tool unavailable)
Build npm ci && npm run build: ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex

Warning

⚠️ Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Initial plan

03e9f53

Copilot AI assigned Copilot and Mossaka Mar 25, 2026

Copilot started work on behalf of Mossaka March 25, 2026 18:32 View session

Copilot AI linked an issue Mar 25, 2026 that may be closed by this pull request

Pre-install commonly needed system packages in agent container image #1428

Closed

Copilot AI and others added 2 commits March 25, 2026 18:38

feat: pre-install commonly needed system packages in agent container

c803976

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/e8563f79-69e4-48ef-84cd-98df7851552f

fix: correct runner-images URL to Ubuntu 22.04

b1b8b7d

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/e8563f79-69e4-48ef-84cd-98df7851552f

Copilot AI changed the title ~~[WIP] Add commonly needed system packages to agent container~~ Pre-install commonly needed system packages in agent container image Mar 25, 2026

Copilot AI requested a review from Mossaka March 25, 2026 18:40

Copilot finished work on behalf of Mossaka March 25, 2026 18:40

Copilot started work on behalf of Mossaka March 25, 2026 18:53 View session

Copilot finished work on behalf of Mossaka March 25, 2026 18:59

Copilot started work on behalf of Mossaka March 25, 2026 19:36 View session

fix: drop heavy packages, keep only lightweight ones

9bfc7e9

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/109bc7bc-c61b-481f-8398-7c6a21d34d50 Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot finished work on behalf of Mossaka March 25, 2026 19:51

Mossaka marked this pull request as ready for review March 25, 2026 19:57

Copilot AI review requested due to automatic review settings March 25, 2026 19:57

Copilot started reviewing on behalf of Mossaka March 25, 2026 19:57 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

github-actions Bot added the build-test label Mar 25, 2026

Mossaka merged commit eaf62bd into main Mar 25, 2026
63 of 65 checks passed

Mossaka deleted the copilot/preinstall-system-packages branch March 25, 2026 21:50

github-actions Bot mentioned this pull request Mar 25, 2026

fix: allow host service ports for GitHub Actions services containers #1436

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pre-install commonly needed system packages in agent container image#1432

Pre-install commonly needed system packages in agent container image#1432
Mossaka merged 4 commits into
mainfrom
copilot/preinstall-system-packages

Copilot AI commented Mar 25, 2026 •

edited

Loading

Uh oh!

Mossaka commented Mar 25, 2026

Uh oh!

Copilot AI commented Mar 25, 2026

Uh oh!

Mossaka commented Mar 25, 2026

Uh oh!

Copilot AI commented Mar 25, 2026

Uh oh!

github-actions Bot commented Mar 25, 2026

Uh oh!

github-actions Bot commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

github-actions Bot commented Mar 25, 2026

Uh oh!

github-actions Bot commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		\| php-intl \| — \| `php-intl` \| PHP Internationalization extension \|
		\| php-gd \| — \| `php-gd` \| PHP GD graphics extension \|

	PARITY_PKGS="libgdiplus libev-dev libssl-dev php-intl php-gd"; \
	# Include php-cli so that PHP workflows have a runtime, not just extensions.
	PARITY_PKGS="libgdiplus libev-dev libssl-dev php-cli php-intl php-gd"; \

Conversation

Copilot AI commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Mossaka commented Mar 25, 2026

Uh oh!

Copilot AI commented Mar 25, 2026

Uh oh!

Mossaka commented Mar 25, 2026

Uh oh!

Copilot AI commented Mar 25, 2026

Uh oh!

github-actions Bot commented Mar 25, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Mar 25, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Mar 25, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 25, 2026 •

edited

Loading