fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container#46157
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…e docs tester - Add pre-agent step to set chrome-sandbox SUID mode (4755) before container starts - Bind docs preview server to 0.0.0.0 so it's reachable from the agent container - Update agent prompt to use host.docker.internal:4321 instead of localhost:4321 Fixes #46149 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Fixes Chrome startup and host-served documentation access from the sandboxed agent container.
Changes:
- Configures Chrome’s SUID sandbox before agent startup.
- Exposes Astro on all interfaces and uses
host.docker.internal. - Regenerates workflow lock files and action metadata.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/daily-multi-device-docs-tester.md |
Applies sandbox and networking fixes. |
.github/workflows/daily-multi-device-docs-tester.lock.yml |
Compiles the workflow changes. |
.github/workflows/skillet.lock.yml |
Refreshes generated action metadata. |
.github/workflows/release.lock.yml |
Refreshes generated action metadata. |
.github/workflows/hourly-ci-cleaner.lock.yml |
Refreshes generated action metadata. |
.github/workflows/avenger.lock.yml |
Refreshes generated action metadata. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Medium
|
@lpcox review please |
|
@copilot please run the
|
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Done. Here's the summary:
Hand-off: CI must be re-triggered by a maintainer (close/reopen PR or push) before merge. |
|
@copilot please run the
|
Branch is current with
Shortest maintainer path: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29861145850 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is current with
Exact next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
|
@copilot please run the Run: {run_url} Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is current with
Actions taken: None required — branch was already in a ready state. Hand-off: CI must be re-triggered by a maintainer (close/reopen PR, |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29872246821 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is still current —
Exact maintainer action needed: close and reopen the PR (or push a no-op commit from a maintainer account) to trigger CI, then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29873842709 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is still current —
Smallest re-trigger: a maintainer closing and reopening the PR is sufficient to queue CI. Approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29877220652 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is still current —
Exact next maintainer action: close and reopen the PR to trigger CI (no code changes needed), then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29881378283 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is still current —
Exact next maintainer action: close and reopen the PR to trigger CI (no code changes needed), then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29883079375 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is still current —
Exact next maintainer action: close and reopen the PR to trigger CI (no code changes needed), then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29889445104 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is current —
Actions taken: no changes required — the PR code is complete and correct. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29892356701 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is current —
Next concrete maintainer action: close and reopen the PR to trigger CI, then approve and merge once checks pass. |
|
@copilot lunch web server from within the agent by providing instructions, avoid starting as a step |
…e agent, not as pre-agent step Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done in 6e1e3e6. The docs server is now launched from within the agent by its own instructions (Step 1: install deps → build → nohup preview → wait for readiness). The three pre-agent steps (Install docs dependencies, Start docs server, Wait for server readiness) are removed. Since the server and browser now run in the same container, all URL references updated from |
|
@copilot keep install and building the docs once outside the agent so that the docs are prebuilt and start faster |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done. |
|
🎉 This pull request is included in a new release. Release: |
The multi-device docs tester failed every run due to two independent networking/sandbox issues caused by the agent running inside a Docker container while pre-agent steps run on the host runner.
Chrome sandbox SUID (
chrome-sandboxmode 0777 → 4755)Chrome refuses to launch if
chrome-sandboxis present but lacks the SUID bit. The runner ships it as0777; the Docker bind mount preserves whatever mode is set at mount time. Fix: new pre-agent step sets4755on the host before the container starts.Docs server unreachable from the agent container (
127.0.0.1→0.0.0.0)The preview server was bound to
127.0.0.1:4321(host loopback). Inside the agent container,localhostresolves to the container's own loopback — a different network namespace — so everycurl http://localhost:4321/…failed. Two changes:--host 127.0.0.1→--host 0.0.0.0localhost:4321references →host.docker.internal:4321(same pattern used bydaily-byok-ollama-test)The pre-agent TCP readiness check retains
127.0.0.1since that step runs on the host.Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/29727086788
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/29849545379
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
pr-sous-chef run: https://github.com/github/gh-aw/actions/runs/29858066392
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/29861145850
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/29883079375
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.