Skip to content

fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container#46157

Open
pelikhan with Copilot wants to merge 28 commits into
mainfrom
copilot/multi-device-docs-testing-report-2026-07-17
Open

fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container#46157
pelikhan with Copilot wants to merge 28 commits into
mainfrom
copilot/multi-device-docs-testing-report-2026-07-17

Conversation

Copilot AI commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

The multi-device docs tester failed every run due to two independent networking/sandbox issues caused by the agent running inside a Docker container while pre-agent steps run on the host runner.

Chrome sandbox SUID (chrome-sandbox mode 0777 → 4755)

Chrome refuses to launch if chrome-sandbox is present but lacks the SUID bit. The runner ships it as 0777; the Docker bind mount preserves whatever mode is set at mount time. Fix: new pre-agent step sets 4755 on the host before the container starts.

- name: Configure Chrome sandbox
  run: |
    if [ -f /opt/google/chrome/chrome-sandbox ]; then
      sudo chmod 4755 /opt/google/chrome/chrome-sandbox
    fi

Docs server unreachable from the agent container (127.0.0.10.0.0.0)

The preview server was bound to 127.0.0.1:4321 (host loopback). Inside the agent container, localhost resolves to the container's own loopback — a different network namespace — so every curl http://localhost:4321/… failed. Two changes:

  • Server bind: --host 127.0.0.1--host 0.0.0.0
  • Agent prompt: all localhost:4321 references → host.docker.internal:4321 (same pattern used by daily-byok-ollama-test)

The pre-agent TCP readiness check retains 127.0.0.1 since that step runs on the host.


Generated by 👨‍🍳 PR Sous Chef · 6.92 AIC · ⌖ 6.49 AIC · ⊞ 7.5K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 8.96 AIC · ⌖ 7.34 AIC · ⊞ 7.5K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/29727086788

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 2.96 AIC · ⌖ 14.1 AIC · ⊞ 5.4K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 11.7 AIC · ⌖ 13.6 AIC · ⊞ 6.9K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 16.7 AIC · ⌖ 10.4 AIC · ⊞ 7K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 7.68 AIC · ⌖ 9.11 AIC · ⊞ 7K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/29849545379

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 9.08 AIC · ⌖ 7.1 AIC · ⊞ 7K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 9.87 AIC · ⌖ 11.8 AIC · ⊞ 7K ·
Comment /souschef to run again


pr-sous-chef run: https://github.com/github/gh-aw/actions/runs/29858066392

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 15.4 AIC · ⌖ 7.1 AIC · ⊞ 7K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/29861145850

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 8.57 AIC · ⌖ 8.31 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI and others added 2 commits July 17, 2026 07:20
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…e docs tester

- Add pre-agent step to set chrome-sandbox SUID mode (4755) before container starts
- Bind docs preview server to 0.0.0.0 so it's reachable from the agent container
- Update agent prompt to use host.docker.internal:4321 instead of localhost:4321

Fixes #46149

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix multi-device validation errors for testing report fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container Jul 17, 2026
Copilot AI requested a review from pelikhan July 17, 2026 07:34
@pelikhan
pelikhan marked this pull request as ready for review July 17, 2026 08:31
Copilot AI review requested due to automatic review settings July 17, 2026 08:31

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes Chrome startup and host-served documentation access from the sandboxed agent container.

Changes:

  • Configures Chrome’s SUID sandbox before agent startup.
  • Exposes Astro on all interfaces and uses host.docker.internal.
  • Regenerates workflow lock files and action metadata.
Show a summary per file
File Description
.github/workflows/daily-multi-device-docs-tester.md Applies sandbox and networking fixes.
.github/workflows/daily-multi-device-docs-tester.lock.yml Compiles the workflow changes.
.github/workflows/skillet.lock.yml Refreshes generated action metadata.
.github/workflows/release.lock.yml Refreshes generated action metadata.
.github/workflows/hourly-ci-cleaner.lock.yml Refreshes generated action metadata.
.github/workflows/avenger.lock.yml Refreshes generated action metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 6/6 changed files
  • Comments generated: 0
  • Review effort level: Medium

@pelikhan pelikhan added the awf label Jul 17, 2026
@pelikhan

Copy link
Copy Markdown
Collaborator

@lpcox review please

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, address unresolved review feedback, investigate any failed checks listed below, refresh the branch if needed, and rerun checks once ready.

Generated by pr-sous-chef: https://github.com/github/gh-aw/actions/runs/29590499747

Generated by 👨‍🍳 PR Sous Chef · 8.3 AIC · ⌖ 10.9 AIC · ⊞ 7.5K ·
Comment /souschef to run again

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, address unresolved review feedback, investigate any failed checks listed below, refresh the branch if needed, and rerun checks once ready.

Generated by ...

Done. Here's the summary:

  • Reviews — No unresolved review threads on this PR.
  • Checks (local)make fmt, make lint, make test-unit, and make recompile all pass. Recompile produced an update to smoke-call-workflow.lock.yml which has been committed.
  • Checks (CI) — Stale after agent push; needs human re-trigger. Prior CI run (29563473612): all 22 checks passed.
  • Mergeable — PR is open, not draft, not behind, no conflicts.

Hand-off: CI must be re-triggered by a maintainer (close/reopen PR or push) before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill on #46157, confirm the branch is still up to date, and summarize any remaining maintainer action after checks are re-triggered.

Generated by 👨‍🍳 PR Sous Chef · 14.9 AIC · ⌖ 6.23 AIC · ⊞ 6K ·
Comment /souschef to run again

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, review any remaining unresolved feedback, and rerun checks once the branch is up to date.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 11.4 AIC · ⌖ 5.11 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI added 2 commits July 21, 2026 07:27
…docs-testing-report-2026-07-17

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
…docs-testing-report-2026-07-17

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, review any remaining unresolved feedback, and rerun checks once the branch is up to date.

...

Branch refreshed — merged origin/main (15 new commits: model alias update, sprintfbool linter gate, yamllint fix, audit cancellation propagation, etc.). No conflicts. Local validation passes (make fmt, make lint all green). No unresolved review threads.

  • Reviews — No unresolved review threads.
  • Checks (local)make fmt, make lint all pass. Working tree clean.
  • Checks (CI) — Stale after agent push; agent pushes do not trigger workflows. Needs a human re-trigger.
  • Mergeable — Branch is up to date with origin/main, no conflicts.

Next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

@github-actions

Copy link
Copy Markdown
Contributor

Triage

Field Value
Category bug
Risk low
Score 40/100 (impact:20 urgency:10 quality:10)
Action batch_review
Batch pr-batch:awf-workflow-fixes

Rationale: Fixes Chrome SUID sandbox and server connectivity in multi-device docs tester. No CI data. Age: 4 days. Low-risk environment fix, good for batched review.

Generated by 🔧 PR Triage Agent · sonnet46 45.9 AIC · ⌖ 5.48 AIC · ⊞ 5.6K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the next concrete maintainer action.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 7.68 AIC · ⌖ 9.11 AIC · ⊞ 7K ·
Comment /souschef to run again

…linter improvements) and recompile lock files

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the next concrete maintainer action.

...

Branch refreshed — merged origin/main (27 new commits: mcpg v0.4.3, eslint fixes, linter/function-length improvements, vite/astro/prettier bumps, etc.). One lock file conflict in daily-multi-device-docs-tester.lock.yml was resolved by taking main's image versions then recompiling — preserving this branch's Chrome sandbox and 0.0.0.0 binding fixes in the compiled output.

  • Reviews — No unresolved review threads.
  • Checks (local)make fmt, make lint, make test-unit, make recompile all pass on the merged HEAD. Lock files in sync.
  • Checks (CI) — Stale after agent push; agent pushes do not trigger workflows. Needs a human re-trigger.
  • Mergeable — Branch is up to date with origin/main, no conflicts.

Next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the next concrete maintainer action.

Run: https://github.com/github/gh-aw/actions/runs/29849545379

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 9.08 AIC · ⌖ 7.1 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the next concrete maintainer action.

_Run: https://github.com/github/...

Branch is current with origin/main — no new commits since the last merge. Working tree is clean.

  • Reviews — No unresolved review threads.
  • Checks (local)make fmt, make lint, make test-unit, make recompile all passed on the merged HEAD (87b5657). Lock files in sync.
  • Checks (CI) — Stale after agent push; agent pushes do not trigger workflows. Needs a human re-trigger.
  • Mergeable — Up to date with origin/main, no conflicts.

Next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, confirm whether any review threads or failing checks still need work, and summarize the shortest maintainer path to unblock this PR. If the branch is ready except for stale CI, say that explicitly.

Run: https://github.com/github/gh-aw/actions/runs/29852558324

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 9.87 AIC · ⌖ 11.8 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, confirm whether any review threads or failing checks still need work, and summarize the shortest maintainer path to unblock this PR. If the branch is ready...

The branch is ready — stale CI is the only remaining blocker.

  • Reviews — No unresolved review threads.
  • Checks (local)make fmt, make lint, make test-unit, make recompile all pass on HEAD 87b5657. Lock files in sync.
  • Checks (CI) — Stale after agent push. Agent pushes do not trigger workflows; CI has not run against current HEAD.
  • Mergeable — Up to date with origin/main, no conflicts.

Shortest path for a maintainer: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

@github-actions

Copy link
Copy Markdown
Contributor

🤖 PR Triage (refreshed)

Field Value
Category bug
Risk low
Score 47 / 100
Action batch_review
Batch pr-batch:awf-fixes

Score breakdown: Impact 20 · Urgency 15 · Quality 12

Fixes Chrome SUID sandbox + server unreachable issues in multi-device docs tester (workflow md + lock). CI passing. 4 days old. Ready for batch review with other awf-fixes.

Generated by 🔧 PR Triage Agent · sonnet46 43.3 AIC · ⌖ 5.33 AIC · ⊞ 5.6K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, confirm whether any review threads or checks still need action, verify the branch status after the attempted refresh, and summarize the shortest maintainer path to unblock this PR. If the remaining blocker is stale or infrastructure-side CI, say so clearly.

Run: https://github.com/github/gh-aw/actions/runs/29858066392

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 15.4 AIC · ⌖ 7.1 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, confirm whether any review threads or checks still need action, verify the branch status after the attempted refresh, and summarize the shortest maintainer...

Branch is current with origin/main and the working tree is clean. No review threads or code issues remain.

  • Reviews — No unresolved review threads.
  • Checks (local)make fmt, make lint, make test-unit, make recompile all pass on HEAD 87b5657. Lock files in sync.
  • Checks (CI) — Stale infrastructure-side blocker. Agent pushes do not trigger workflows; CI has not run against the current HEAD. This is the only remaining blocker.
  • Mergeable — Up to date with origin/main, no conflicts.

Shortest maintainer path: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the exact next maintainer action.

Run: https://github.com/github/gh-aw/actions/runs/29861145850

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · gpt54 8.57 AIC · ⌖ 8.31 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the exact next maintainer action.

_Run: https://github.com/github/gh-...

Branch is current with origin/main and the working tree is clean. No review threads or code issues remain.

  • Reviews — No unresolved review threads.
  • Checks (local)make fmt, make lint, make test-unit, make recompile all pass on HEAD 87b5657. Lock files in sync.
  • Checks (CI) — Stale infrastructure-side blocker only. Agent pushes do not trigger workflows; CI has not run against the current HEAD.
  • Mergeable — Up to date with origin/main, no conflicts.

Exact next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

🔍 Multi-Device Docs Testing Report - 2026-07-17

4 participants