fix: skip /etc bind mounts when sysroot-stage is active (arc-dind)

src/services/agent-volumes/etc-mounts.test.ts

@@ -16,6 +16,28 @@ function createMinimalConfig(overrides: Partial<WrapperConfig> = {}): WrapperCon
 }
 
 describe('buildEtcMounts', () => {
+  describe('sysroot gating by runnerTopology', () => {
+    it('returns empty array when runnerTopology is arc-dind (sysroot provides /etc)', () => {
+      const config = createMinimalConfig({ runnerTopology: 'arc-dind' });
+      const mounts = buildEtcMounts(config);
+      expect(mounts).toEqual([]);
+    });
+
+    it('still mounts /etc files when runnerTopology is standard', () => {
+      const config = createMinimalConfig({ runnerTopology: 'standard' });
+      const mounts = buildEtcMounts(config);
+      expect(mounts.length).toBeGreaterThan(0);
+      expect(mounts).toContain('/etc/ld.so.cache:/host/etc/ld.so.cache:ro');
+    });
+
+    it('still mounts /etc files when runnerTopology is undefined', () => {
+      const config = createMinimalConfig({ runnerTopology: undefined });
+      const mounts = buildEtcMounts(config);
+      expect(mounts.length).toBeGreaterThan(0);
+      expect(mounts).toContain('/etc/ld.so.cache:/host/etc/ld.so.cache:ro');
+    });
+  });
+
   describe('non-DinD mode', () => {
     it('mounts /etc/passwd and /etc/group directly', () => {
       const config = createMinimalConfig({ dockerHostPathPrefix: undefined });

src/services/agent-volumes/etc-mounts.ts

@@ -3,6 +3,7 @@ import * as path from 'path';
 import { WrapperConfig } from '../../types';
 import { shouldUseDockerHostStaging, stageHostFile, getDockerHostStageRoot } from './docker-host-staging';
 import { getSafeHostUid, getSafeHostGid } from '../../host-identity';
+import { isSysrootEnabled } from '../sysroot-service';
 
 /**
  * Synthesize a minimal /etc/passwd or /etc/group file in the staging directory.
@@ -58,6 +59,13 @@ function resolveUniqueName(content: string, preferredName: string, id: string):
 }
 
 export function buildEtcMounts(config: WrapperConfig): string[] {
+  // When sysroot-stage is active (arc-dind), the sysroot volume already provides
+  // a complete /etc from the build-tools image. Bind-mounting the host's /etc files
+  // on top would fail on split-fs (Docker daemon can't resolve runner paths).
+  if (isSysrootEnabled(config)) {
+    return [];
+  }
+
   const mounts: string[] = [
     '/etc/ssl:/host/etc/ssl:ro',
     '/etc/ca-certificates:/host/etc/ca-certificates:ro',