Add fail-closed Docker sbx egress verification by lpcox · Pull Request #7956 · github/gh-aw-firewall

lpcox · 2026-09-01T03:06:19Z

Summary

add opt-in --verify-sbx-egress and network.verifySbxEgress
probe Docker sbx with all client proxy variables removed before agent startup
abort when denied-policy domains or a stable public IP remain directly reachable
account for both public and sensitive Squid allowlist entries when selecting probes
document the compiler/orchestrator contract for DOCKER_SANDBOXES_PROXY

Motivation

The Playwright smoke work in #7938 proved that cooperative Chromium traffic can use Squid, but client proxy configuration is not an enforceable Docker sbx boundary. This change gives the gh-aw compiler a fail-closed AWF contract: after starting the sbx daemon with DOCKER_SANDBOXES_PROXY chained to AWF Squid, it can enable this verification and prevent the agent from starting if direct traffic bypasses that chain.

This is the AWF portion of github/gh-aw#57581. The option remains opt-in until the compiler owns the corresponding daemon startup sequence.

Add an opt-in preflight for orchestrators that chain the sbx daemon through AWF Squid. The probe removes proxy variables and aborts when denied destinations remain reachable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ba940bd-5aa8-4dd2-9c34-fc4c991fe355

github-actions · 2026-09-01T03:06:47Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 3332d5e

Copilot

Copilot review overview

🟡 Changes recommended

Curl configuration can bypass the direct-egress probe, and case-sensitive allowlist matching can reject valid configurations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 1

New issues introduced by this change (2)

Severity	Finding
	`src/sbx-manager.ts` — This manual plain-domain check is case-sensitive even though DNS/Squid matching is case-insensitive…
	`src/sbx-manager.ts` — Unsetting proxy environment variables does not guarantee that this is a direct request: curl still…

What changed in this PR

Adds opt-in fail-closed Docker sbx egress verification supporting the compiler contract in github/gh-aw#57581.

Changes:

Adds CLI/config/schema support for egress verification.
Probes denied domains before agent execution.
Documents sbx daemon proxy orchestration.

File	Description
`src/types/network-options.ts`	Defines the network option.
`src/sbx-runtime-backend.ts`	Runs the startup verification.
`src/sbx-runtime-backend.test.ts`	Tests backend integration.
`src/sbx-manager.ts`	Implements egress probes.
`src/sbx-manager.test.ts`	Tests probe outcomes.
`src/config-mapper.ts`	Maps file configuration.
`src/config-file.ts`	Defines file configuration.
`src/config-file-mapping.test.ts`	Tests configuration mapping.
`src/commands/validators/infrastructure-validator.ts`	Restricts the option to sbx.
`src/commands/validators/config-assembly-flags.test.ts`	Tests runtime validation.
`src/commands/build-config.ts`	Builds the runtime option.
`src/cli-options.ts`	Adds the CLI flag.
`src/awf-config-schema.json`	Updates the runtime schema.
`docs/usage.md`	Documents CLI usage.
`docs/sbx-integration.md`	Documents the orchestration contract.
`docs/awf-config.schema.json`	Updates the canonical schema.
`docs/awf-config-spec.md`	Documents config mapping.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    `curl --fail --insecure --silent --show-error --connect-timeout 5 --max-time 10 ` +
+    `--output /dev/null "https://${domain}/"; then ` +


lpcox · 2026-09-01T03:10:32Z

@copilot address review feedback

github-actions · 2026-09-01T03:11:41Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.08%	93.11%	📈 +0.03%
Statements	91.73%	91.75%	📈 +0.02%
Functions	92.17%	92.19%	📈 +0.02%
Branches	85.43%	85.45%	📈 +0.02%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/sbx-manager.ts`	100.0% → 100.0% (+0.00%)	99.5% → 99.0% (-0.43%)
`src/sbx-runtime-backend.ts`	98.5% → 98.6% (+0.09%)	98.6% → 98.7% (+0.07%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot · 2026-09-01T03:14:56Z

@copilot address review feedback

Addressed in 685c7f4: probes now invoke curl --disable and plain-domain matching is case-insensitive, with regression coverage.

github-actions · 2026-09-01T03:37:27Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-01T04:07:11Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-01T04:07:13Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-01T04:07:15Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-01T04:07:17Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-01T04:07:19Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-01T04:07:19Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7956

github-actions · 2026-09-01T04:07:22Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-01T04:07:23Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7956

github-actions · 2026-09-01T04:07:24Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-01T04:07:27Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-09-01T04:07:30Z

❌ Contribution Check failed. Please review the logs for details.

Generated by Contribution Check for #7956

github-actions · 2026-09-01T04:07:30Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-01T04:07:31Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-01T04:07:33Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-01T04:07:38Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-01T04:10:38Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
`gh` check	✅ PASS
File status	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7956 · claude · haiku45 · 58.2 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:10:42Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: 403 CONNECT tunnel failed

Overall: PASS — network isolation egress enforcement working as expected.

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:10:50Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP: PR Fix Playwright smoke tests across sandbox runtimes #7938 "Fix Playwright smoke tests across sandbox runtimes" fetched
✅ GitHub.com connectivity: HTTP 200
✅ File write/read test passed

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:10:57Z

Smoke Test: Copilot BYOK (Direct) Mode

Status: ✅ PASS

✅ GitHub MCP: Listed 2 merged PRs successfully
✅ github.com connectivity: HTTP 200
✅ File write/read: Test file created and verified
✅ BYOK inference: Running in direct mode via api-proxy → api.githubcopilot.com

All tests passed. Agent using COPILOT_PROVIDER_API_KEY for direct BYOK mode.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:11:10Z

Docker Sbx Smoke Test — @lpcox

✅ GitHub MCP: PR Fix Playwright smoke tests across sandbox runtimes #7938, Add Playwright loopback smoke workflows #7934 confirmed
✅ github.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:11:23Z

Smoke Test: Services Connectivity

Redis PING: ❌ (DNS resolution failure for host.docker.internal)
Postgres pg_isready: ❌ (no response)
Postgres SELECT 1: ❌ (DNS resolution failure)

Overall: FAIL — host.docker.internal could not be resolved from the sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:12:15Z

@lpcox

Smoke test (BYOK AOAI api-key) results:

GitHub MCP test: ❌
GitHub.com connectivity: ✅
Agent file I/O: ✅
BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: FAIL

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:12:15Z

Fix Playwright smoke tests across sandbox runtimes
Add Playwright loopback smoke workflows
MCP connectivity: ❌
GitHub.com connectivity: ✅
File I/O: ✅
BYOK inference: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall: FAIL
@lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:12:42Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.19.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment. smoke-chroot label not applied.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:12:48Z

PR titles: unavailable (safeinputs-gh missing)
Merged PR review: ❌
safeinputs-gh PR query: ❌
Playwright title check: ✅
Temp file write/read: ✅
Discussion query/comment: ❌ (github-discussion-query / discussions write unavailable)
npm ci && npm run build: ✅
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:13:08Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Notes:

Java tests required overriding Maven's local repo to -Dmaven.repo.local=<writable dir> since the default ~/.m2/repository path was not writable; all other steps ran exactly as specified.
All repositories cloned successfully; no CLONE_FAILED cases.

Generated by Build Test Suite for #7956 · copilot · auto · 33.8 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-01T04:14:27Z

Smoke Test: API Proxy OTEL Tracing — Results

✅ Scenario 1 (Module Loading): otel.js loads successfully, isEnabled() = true. Exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus internal exporter/serialization helpers.
✅ Scenario 2 (Test Suite): npx jest --testPathPatterns=otel → 3 suites, 68 tests passed, 0 failed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js).
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and both trace-context vars to api-proxy.
✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js exposes the onUsage callback hook point for OTEL span attribute updates.
✅ Scenario 5 (OTEL Diagnostics): Workflow-level trace spans were exported to /tmp/gh-aw/otel.jsonl (gh-aw.agent.setup span present). No api-proxy-side otel.jsonl was produced this run — expected, since this run made no LLM requests through the api-proxy sidecar.

Overall: all 5 scenarios pass. No unexpected failures detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

Copilot AI balanced review requested due to automatic review settings September 1, 2026 03:06

Copilot started reviewing on behalf of lpcox September 1, 2026 03:06 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

Comment thread src/sbx-manager.ts Outdated

Comment thread src/sbx-manager.ts Outdated

Comment on lines +585 to +586

`curl --fail --insecure --silent --show-error --connect-timeout 5 --max-time 10 ` +

`--output /dev/null "https://${domain}/"; then ` +

Copilot started work on behalf of lpcox September 1, 2026 03:10 View session

fix: harden sbx egress probes

685c7f4

Copilot finished work on behalf of lpcox September 1, 2026 03:15

lpcox added the ready-for-aw label Sep 1, 2026

lpcox enabled auto-merge (squash) September 1, 2026 04:07

lpcox temporarily deployed to aoai-model September 1, 2026 04:07 — with GitHub Actions Inactive

github-actions Bot added the smoke-claude label Sep 1, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 1, 2026

github-actions Bot added the smoke-copilot label Sep 1, 2026

github-actions Bot added smoke-copilot-byok smoke-docker-sbx labels Sep 1, 2026

github-actions Bot mentioned this pull request Sep 1, 2026

[aw] Smoke Gemini failed #7958

Closed

lpcox temporarily deployed to aoai-model September 1, 2026 04:11 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Sep 1, 2026

lpcox temporarily deployed to aoai-model September 1, 2026 04:12 — with GitHub Actions Inactive

github-actions Bot added the build-test label Sep 1, 2026

lpcox merged commit b241c6e into main Sep 1, 2026
181 of 184 checks passed

lpcox deleted the verify-sbx-egress-enforcement branch September 1, 2026 04:19

github-actions Bot mentioned this pull request Sep 1, 2026

[docs] auth: list Google Vertex AI in README API-proxy provider list #7957

Merged

		`curl --fail --insecure --silent --show-error --connect-timeout 5 --max-time 10 ` +
		`--output /dev/null "https://${domain}/"; then ` +

Uh oh!

Conversation

lpcox commented Sep 1, 2026

Summary

Motivation

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

lpcox commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading