fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container#46157
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…e docs tester - Add pre-agent step to set chrome-sandbox SUID mode (4755) before container starts - Bind docs preview server to 0.0.0.0 so it's reachable from the agent container - Update agent prompt to use host.docker.internal:4321 instead of localhost:4321 Fixes #46149 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Fixes Chrome startup and host-served documentation access from the sandboxed agent container.
Changes:
- Configures Chrome’s SUID sandbox before agent startup.
- Exposes Astro on all interfaces and uses
host.docker.internal. - Regenerates workflow lock files and action metadata.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/daily-multi-device-docs-tester.md |
Applies sandbox and networking fixes. |
.github/workflows/daily-multi-device-docs-tester.lock.yml |
Compiles the workflow changes. |
.github/workflows/skillet.lock.yml |
Refreshes generated action metadata. |
.github/workflows/release.lock.yml |
Refreshes generated action metadata. |
.github/workflows/hourly-ci-cleaner.lock.yml |
Refreshes generated action metadata. |
.github/workflows/avenger.lock.yml |
Refreshes generated action metadata. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Medium
|
@lpcox review please |
|
@copilot please run the
|
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Done. Here's the summary:
Hand-off: CI must be re-triggered by a maintainer (close/reopen PR or push) before merge. |
|
@copilot please run the
|
|
@copilot please run the Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
…docs-testing-report-2026-07-17 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
…docs-testing-report-2026-07-17 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Branch refreshed — merged
Next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
Triage
Rationale: Fixes Chrome SUID sandbox and server connectivity in multi-device docs tester. No CI data. Age: 4 days. Low-risk environment fix, good for batched review.
|
|
@copilot please run the Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
…linter improvements) and recompile lock files Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Branch refreshed — merged
Next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29849545379 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is current with
Next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29852558324 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
The branch is ready — stale CI is the only remaining blocker.
Shortest path for a maintainer: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
🤖 PR Triage (refreshed)
Score breakdown: Impact 20 · Urgency 15 · Quality 12
|
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29858066392 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is current with
Shortest maintainer path: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
|
@copilot please run the Run: https://github.com/github/gh-aw/actions/runs/29861145850 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "pi.dev"See Network Configuration for more information.
|
Branch is current with
Exact next maintainer action: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass. |
The multi-device docs tester failed every run due to two independent networking/sandbox issues caused by the agent running inside a Docker container while pre-agent steps run on the host runner.
Chrome sandbox SUID (
chrome-sandboxmode 0777 → 4755)Chrome refuses to launch if
chrome-sandboxis present but lacks the SUID bit. The runner ships it as0777; the Docker bind mount preserves whatever mode is set at mount time. Fix: new pre-agent step sets4755on the host before the container starts.Docs server unreachable from the agent container (
127.0.0.1→0.0.0.0)The preview server was bound to
127.0.0.1:4321(host loopback). Inside the agent container,localhostresolves to the container's own loopback — a different network namespace — so everycurl http://localhost:4321/…failed. Two changes:--host 127.0.0.1→--host 0.0.0.0localhost:4321references →host.docker.internal:4321(same pattern used bydaily-byok-ollama-test)The pre-agent TCP readiness check retains
127.0.0.1since that step runs on the host.Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/29727086788
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/29849545379
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
pr-sous-chef run: https://github.com/github/gh-aw/actions/runs/29858066392
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/29861145850
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
pi.devSee Network Configuration for more information.