Self hosted runner pre-requisite on kubernetes are not clear

[GregoireW]

Hello,

The documentation to setup a agentic workflow on self hosted runner is a little bit unclear. I take this doc: https://github.github.com/gh-aw/reference/self-hosted-runners/

There is multiple elements on multiple part, there is 2 part for ARC ...

Anyway, I run runner on kubernetes with a container runner + a container dind. The docker socket is shared via an empty dir.

• I use to not have privileged mode on the runner container, is this really mandatory ?
• I need to share the /tmp directory between the runner container/docker container via an empty directory
• I notice I need iptables command else there is a failure

And with all that, I keep getting an error

[SUCCESS] Host-level iptables rules configured successfully
[INFO] Generating configuration files...
[INFO] API proxy sidecar enabled - API keys will be held securely in sidecar container
[INFO] API proxy will route through Squid to respect domain whitelisting
[INFO] CLI proxy sidecar enabled - connecting to external DIFC proxy at host.docker.internal:18443
[INFO] Starting containers...
 Container awf-squid Creating 
 Container awf-api-proxy Creating 
 Container awf-api-proxy Created 
 Container awf-squid Created 
 Container awf-cli-proxy Creating 
 Container awf-cli-proxy Created 
 Container awf-agent Creating 
 Container awf-agent Created 
 Container awf-iptables-init Creating 
 Container awf-iptables-init Created 
 Container awf-squid Starting 
 Container awf-api-proxy Starting 
 Container awf-api-proxy Started 
 Container awf-squid Started 
 Container awf-squid Waiting 
 Container awf-squid Healthy 
 Container awf-cli-proxy Starting 
 Container awf-cli-proxy Started 
 Container awf-squid Waiting 
 Container awf-api-proxy Waiting 
 Container awf-cli-proxy Waiting 
 Container awf-api-proxy Healthy 
 Container awf-squid Healthy 
 Container awf-cli-proxy Error dependency cli-proxy failed to start
dependency failed to start: container awf-cli-proxy is unhealthy
Error:  awf-cli-proxy container logs (last 50 lines):
[cli-proxy] Starting CLI proxy sidecar...
[cli-proxy] External DIFC proxy at host.docker.internal:18443
[cli-proxy] Starting TCP tunnel: localhost:18443 → host.docker.internal:18443
[cli-proxy] TLS certificate available
[cli-proxy] Combined CA bundle created at /tmp/proxy-tls/combined-ca.crt
[cli-proxy] gh CLI configured to route through DIFC proxy at localhost:18443
[tcp-tunnel] Forwarding localhost:18443 → host.docker.internal:18443
[cli-proxy] DIFC proxy probe failed (attempt 1/10, diagnosis=unknown), retrying in 1s...
[cli-proxy] DIFC proxy probe failed (attempt 2/10, diagnosis=unknown), retrying in 2s...
[cli-proxy] DIFC proxy probe failed (attempt 3/10, diagnosis=unknown), retrying in 4s...
[cli-proxy] DIFC proxy probe failed (attempt 4/10, diagnosis=unknown), retrying in 8s...
[cli-proxy] DIFC proxy probe failed (attempt 5/10, diagnosis=unknown), retrying in 16s...
[cli-proxy] DIFC proxy probe failed (attempt 6/10, diagnosis=unknown), retrying in 30s...
[tcp-tunnel] Connection from ::1:47780
[tcp-tunnel] Connection closed: ::1:47780
[tcp-tunnel] Connection from ::1:47792
[tcp-tunnel] Connection closed: ::1:47792
[tcp-tunnel] Connection from ::1:59336
[tcp-tunnel] Connection closed: ::1:59336
[tcp-tunnel] Connection from ::1:59352
[tcp-tunnel] Connection closed: ::1:59352
[tcp-tunnel] Connection from ::1:54366
[tcp-tunnel] Connection closed: ::1:54366
[tcp-tunnel] Connection from ::1:47170
[tcp-tunnel] Connection closed: ::1:47170
Error: [ERROR] Fatal error: Error: AWF firewall failed to start: awf-cli-proxy could not connect to the external DIFC proxy (or exited before establishing a connection). Failing fast to avoid repeated in-agent retries. The agent was never invoked. See awf-cli-proxy container logs above for details.
    at Object.QD [as startContainers] (/usr/local/lib/awf/awf-bundle.js:781:4730)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async ZN (/usr/local/lib/awf/awf-bundle.js:786:10770)
    at async e.<anonymous> (/usr/local/lib/awf/awf-bundle.js:796:1139)
[INFO] Stopping containers...

My issue is the "check logs" ... I was checking the /tmp/gh-aw/sandbox/firewall/logs/cli-proxy-logs but no log file where there, so .... i'm stuck trying to understand if there is something missing

[fbecar22]

Hi , I give a +1 on this issue, we are stuck setting up gh aw on our self hosted runners.

Can you give us guidance by responding to this issue?