Add a guide for running GitHub Copilot coding agent on ARC with DinD

[lpcox]

Summary

We need user-facing documentation explaining how to run GitHub Copilot coding agent on Actions Runner Controller (ARC) using Docker-in-Docker (DinD) mode. Today this is a common self-hosted runner topology, and customers attempting it have no official guide to follow.

Our own testing infrastructure (the agentic-workflows-canary repo) already validates this setup on a daily basis, so we know it works. This issue proposes turning that operational knowledge into a proper guide.

Background

ARC deploys GitHub Actions runners as Kubernetes pods. When a workflow targets an ARC runner set, Kubernetes schedules a pod that picks up the job. DinD mode gives each runner pod its own Docker daemon so it can build images and run containers — which is a requirement for Copilot coding agent's sandbox.

What the guide should cover

Prerequisites

• A Kubernetes cluster (minikube, EKS, AKS, GKE, etc.)
• helm and kubectl CLI tools installed
• A GitHub PAT (or GitHub App credentials) with appropriate permissions for runner registration

Step 1 — Install the ARC controller

helm install arc \
  --namespace "arc-system" --create-namespace \
  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller

Step 2 — Create the runner namespace and auth secret

kubectl create ns arc-runners
kubectl create secret generic arc-runner-secret \
  --namespace=arc-runners \
  --from-literal=github_token=<PAT>

Step 3 — Install the runner scale set with DinD mode

This is the critical step. DinD mode (containerMode.type="dind") is required — Copilot coding agent needs to spawn containers inside the runner, and DinD provides the nested Docker daemon that makes this possible.

helm install "arc-runner-set" \
  --namespace "arc-runners" --create-namespace \
  --set githubConfigUrl="https://github.com/contoso/my-repo" \
  --set githubConfigSecret="arc-runner-secret" \
  --set containerMode.type="dind" \
  --set-json 'template.spec.containers=[{
    "name": "runner",
    "image": "ghcr.io/actions/actions-runner:latest",
    "command": ["/home/runner/run.sh"],
    "securityContext": {
      "capabilities": {
        "add": ["NET_ADMIN"]
      }
    }
  }]' \
  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set

Step 4 — Verify the runner is online

Check the runner set appears at https://github.com/contoso/my-repo/settings/actions/runners (or the org-level equivalent).

Step 5 — Target the runner set from a workflow

runs-on: arc-runner-set

Key requirements and assumptions to document

Item	Required?	Notes
DinD container mode	Yes	Copilot coding agent's sandbox needs a Docker daemon inside the runner pod. Kubernetes mode (containerMode.type="kubernetes") is not supported.
NET_ADMIN capability	Yes	Required for network operations inside the DinD sidecar.
ghcr.io/actions/actions-runner:latest	Recommended	The official runner image. Customers can use custom images as long as they include the runner binary and meet the same base requirements.
Non-root runner user	Supported	The runner process can start as a non-root user (the default for the official runner image). However, the runner must retain the ability to escalate privileges (e.g., via sudo).
securityContext.allowPrivilegeEscalation: false	Avoid	Setting this in the pod security context blocks sudo and may break Copilot coding agent. While allowPrivilegeEscalation: true is not a hard requirement, explicitly setting it to false is known to cause failures.
Specific Kubernetes distribution	No	Any conformant cluster works — minikube for dev/test, managed Kubernetes (EKS, AKS, GKE) for production.
Specific namespace names	No	arc-system / arc-runners are conventions, not requirements.

References

• ARC documentation
• ARC Helm charts
• Our canary testing validates this topology daily via the Runner - ARC - DinD and Build Test Suite (ARC DinD) workflows