docs: DinD is required for ARC (not optional), fix NET_ADMIN misinformation, clarify sudo scope by Copilot · Pull Request #44586 · github/gh-aw

Copilot · 2026-07-09T16:20:29Z

The self-hosted-runners reference doc and ARC DinD guide contained three categories of inaccuracies: DinD was presented as one option among peers rather than a hard requirement for ARC, NET_ADMIN was incorrectly stated as required on the runner container, and the sudo requirement conflated AWF (which runs rootless) with the Copilot CLI install script (which actually needs sudo).

`self-hosted-runners.md`

Sudo section: Replace blanket "AWF requires sudo for host iptables" with two distinct requirements:
- AWF runs rootless in default network-isolation mode — egress via internal Docker network + Squid proxy, no NET_ADMIN or sudo needed on the runner
- install_copilot_cli.sh escalates via sudo for file ops (chown, binary install, cleanup); this is the actual blocker for allowPrivilegeEscalation: false pods
Docker requirements → ARC/Kubernetes bullet: State DinD is required, containerMode.type="kubernetes" is not supported; add cross-reference links
Filesystem section: Update stale "host-level AWF setup requires sudo" bullet to reflect rootless operation
Bottom ARC section (was inconsistent with the top ARC DinD section): Full rewrite — leads with DinD required, Kubernetes mode unsupported, adds runner.topology: arc-dind reference, fixes pod security:
- Before: "both dind sidecar and runner container need privileged: true" (incorrect)
- After: only the dind sidecar needs privileged: true; runner container needs neither privileged nor NET_ADMIN

`arc-dind-copilot-agent.md`

Step 3 helm command: Remove NET_ADMIN capability from the runner container spec
Requirements table: NET_ADMIN row changed from Yes to No; Runner user row updated — sudo is for the install script, not AWF
"How it works" section: Add Network isolation bullet explaining Docker-network-topology enforcement (no host iptables, daemon handles everything)

…rmation Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Pull request overview

This PR updates the self-hosted runner and ARC DinD documentation to correct previously inaccurate statements about ARC requirements, NET_ADMIN, and what actually needs sudo (AWF vs the Copilot CLI install script).

Changes:

Clarifies sudo requirements by separating AWF (rootless, no sudo in default isolation mode) from the Copilot CLI install script (uses sudo, incompatible with allowPrivilegeEscalation: false).
Updates ARC guidance to state DinD is required and containerMode.type="kubernetes" is not supported; clarifies pod security (privileged only for the DinD sidecar, not the runner container).
Updates the ARC DinD guide to remove NET_ADMIN from the runner container example and adds an explanation of network isolation via Docker topology.

Show a summary per file

File	Description
docs/src/content/docs/reference/self-hosted-runners.md	Corrects ARC/DinD and pod security guidance; clarifies `sudo` scope and rootless AWF behavior.
docs/src/content/docs/guides/arc-dind-copilot-agent.md	Updates ARC DinD setup instructions (removes `NET_ADMIN`) and explains network isolation model.
.github/workflows/firewall.lock.yml	Deleted generated workflow lock file (compiled output) for `firewall.md`.
.github/workflows/example-permissions-warning.lock.yml	Deleted generated workflow lock file (compiled output) for `example-permissions-warning.md`.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Deleted generated workflow lock file (compiled output) for `codex-github-remote-mcp-test.md`.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 12/258 changed files
Comments generated: 2
Review effort level: Low

+GitHub Copilot coding agent **requires** Docker-in-Docker (DinD) mode on ARC. Set `containerMode.type="dind"` in your ARC Helm configuration. The `containerMode.type="kubernetes"` mode is not supported.
+
+Set `runner.topology: arc-dind` in workflow frontmatter to enable ARC DinD split-filesystem handling. See the [ARC with Docker-in-Docker (DinD)](#arc-with-docker-in-docker-dind) section above and the [ARC DinD setup guide](/gh-aw/guides/arc-dind-copilot-agent/) for a complete walkthrough.


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox · 2026-07-09T16:44:13Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-07-09T16:51:06Z

@copilot address review feedback

The 256 accidentally deleted .lock.yml files have been restored in commit docs: restore accidentally deleted .lock.yml workflow files. The docs-only changes to self-hosted-runners.md and arc-dind-copilot-agent.md remain intact.

gh-aw-bot · 2026-07-09T17:08:47Z

@copilot please run the pr-finisher skill, ensure the branch is up to date, and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · 6.57 AIC · ⌖ 6.74 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

github-actions · 2026-07-11T09:03:26Z

🎉 This pull request is included in a new release.

Release: v0.82.8

Initial plan

8fda2a4

Copilot AI assigned Copilot and lpcox Jul 9, 2026

Copilot started work on behalf of lpcox July 9, 2026 16:22 View session

Copilot AI linked an issue Jul 9, 2026 that may be closed by this pull request

docs: self-hosted-runners reference reads DinD as optional for ARC — should state it's required #44569

Closed

docs: fix DinD required wording, sudo accuracy, and NET_ADMIN misinfo…

1aad289

…rmation Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update self-hosted runners documentation to clarify DinD requirement~~ docs: DinD is required for ARC (not optional), fix NET_ADMIN misinformation, clarify sudo scope Jul 9, 2026

Copilot finished work on behalf of lpcox July 9, 2026 16:34

Copilot AI requested a review from lpcox July 9, 2026 16:34

lpcox marked this pull request as ready for review July 9, 2026 16:35

Copilot AI review requested due to automatic review settings July 9, 2026 16:35

Copilot started reviewing on behalf of lpcox July 9, 2026 16:36 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Potential fix for pull request finding

874dfd5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of lpcox July 9, 2026 16:45 View session

docs: restore accidentally deleted .lock.yml workflow files

08662f6

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox July 9, 2026 16:51

lpcox merged commit 5226c7a into main Jul 9, 2026
8 checks passed

lpcox deleted the copilot/update-dinh-requirement-docs branch July 9, 2026 17:01

This was referenced Jul 9, 2026

[pr-sous-chef] Run report — 10 nudged, 0 skipped #44594

Closed

[aw] No-Op Runs #43499

Open

github-actions Bot mentioned this pull request Jul 12, 2026

[doc-healer] DDUw improvement: stop re-attempting the rejected antigravity engine catalog sync (3rd rejection: PR #44649) #45017

Closed

Copilot AI mentioned this pull request Jul 12, 2026

Mark Antigravity as intentionally undocumented and gate engine-doc drift checks on that intent #45018

Closed

github-actions Bot mentioned this pull request Jul 15, 2026

[docs] Self-healing documentation fixes from issue analysis - 2026-07-15 #45578

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: DinD is required for ARC (not optional), fix NET_ADMIN misinformation, clarify sudo scope#44586

docs: DinD is required for ARC (not optional), fix NET_ADMIN misinformation, clarify sudo scope#44586
lpcox merged 4 commits into
mainfrom
copilot/update-dinh-requirement-docs

Copilot AI commented Jul 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

lpcox commented Jul 9, 2026

Uh oh!

Copilot AI commented Jul 9, 2026

Uh oh!

Uh oh!

gh-aw-bot commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		GitHub Copilot coding agent requires Docker-in-Docker (DinD) mode on ARC. Set `containerMode.type="dind"` in your ARC Helm configuration. The `containerMode.type="kubernetes"` mode is not supported.

		Set `runner.topology: arc-dind` in workflow frontmatter to enable ARC DinD split-filesystem handling. See the [ARC with Docker-in-Docker (DinD)](#arc-with-docker-in-docker-dind) section above and the [ARC DinD setup guide](/gh-aw/guides/arc-dind-copilot-agent/) for a complete walkthrough.

Uh oh!

Conversation

Copilot AI commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

self-hosted-runners.md

arc-dind-copilot-agent.md

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

lpcox commented Jul 9, 2026

Uh oh!

Copilot AI commented Jul 9, 2026

Uh oh!

Uh oh!

gh-aw-bot commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 9, 2026 •

edited

Loading

`self-hosted-runners.md`

`arc-dind-copilot-agent.md`