🩺 Runner Doctor UpdateRunner Doctor: 2 new lessons (A25 arc-dind services join, B34 Ollama host-gateway)

[github-actions]

Summary

• Scan window: items updated on or after 2026-09-06 in github/gh-aw-firewall
• Items reviewed: ~50 most-recently-updated issues/PRs (list_issues/list_pull_requests, all states), cross-checked against catalog IDs already present
• Genuinely new lessons found: 2 (both merged just outside/at the edge of the strict window but not yet captured in the catalog; see note below)

Note: PR #8172 (merged 2026-09-05) and PR #8085 (merged 2026-09-04) fall just before the 2026-09-06 scan-window boundary, but neither is present anywhere in self-hosted-failure-modes.md, the workflow playbook, or the portable agent doctor as of this run, and both are squarely non-hosted-runner/topology lessons the catalog is meant to capture. Flagging them now rather than letting them fall through the cracks between overlapping daily windows. Everything else reviewed in-window (PRs #8171, #8218, #8251, #8290, #8113/#8114, #8038, #8021/#8023, #8038/#8113/#8114/#8171/#8218/#8251 citations) is already reflected in the catalog as B29–B33 / C9–C10 / A24.

Proposed knowledge-base changes

For .github/workflows/shared/self-hosted-failure-modes.md:

New row — Category A (ARC/DinD), next free ID A25:

ID	Signal	Root cause	Fix / flag	Probe	Citations
A25	On runner.topology: arc-dind, workloads inside the AWF sandbox need a GitHub Actions services: container's native protocol (DB drivers, migration tools, etc.) but cannot reach it — the services: container runs on the runner's own bridge network while the AWF agent runs on the isolated awf-net, and the two bridges are unrouted; existing host-iptables service-port routing doesn't help because ARC/DinD network isolation never programs host iptables rules	No AWF mechanism previously joined a services: container to awf-net; raw-protocol clients (e.g. psql) have no route from the sandbox to the service	Documented in AWF (PR #8085, merged 2026-09-04): new docs/arc-dind.md section "Joining services: containers to awf-net for direct protocol access" documents a verified workaround — a pre-step waits for awf-net to exist, then docker network connect --alias <name> awf-net <service_container> attaches the service container (never the agent) with a resolvable alias. Security invariant: only the service joins awf-net; joining the agent to the runner bridge would bypass the Squid egress firewall. Longer-term direction (services.<name>.attach: true compiler sugar) is not yet implemented.	Confirm the services: container, not the agent, is the one calling docker network connect --alias <name> awf-net <container>; verify the agent can resolve/reach <name> after the join; confirm the agent itself never appears attached to the runner's default bridge	#8075, #8085

New row — Category B (self-hosted), next free ID B34:

ID	Signal	Root cause	Fix / flag	Probe	Citations
B34	A self-hosted-runner workflow whose domain allowlist includes host.docker.internal (e.g. targeting a host-side Ollama server) still fails to reach the host service from inside the AWF sandbox, even though the domain is allowlisted and allowHostPorts/--allow-host-ports includes the service port	AWF's host-gateway keyword processing did not recognize host.docker.internal (bare or with `(redacted) scheme) as a trigger for host-gateway setup, so the container-to-host route was never established even though the domain ACL and port were otherwise correctly configured	Fixed in AWF (PR #8172, merged 2026-09-05): host-gateway keyword processing now recognizes host.docker.internal, (host.docker.internal/redacted) and (host.docker.internal/redacted), enabling container host access while preserving explicit host-domain entries. Includes coverage for custom ports (e.g. Ollama's 11434`). Upgrade AWF to include #8172.	Inspect generated compose/iptables for host-gateway wiring when host.docker.internal (in any of the three forms) appears in network.allowDomains; confirm `curl (host.docker.internal/redacted) succeeds from inside the sandbox on patched AWF	#8165, #8172

Proposed doctor changes

For .github/workflows/self-hosted-runner-doctor.md — add to the error-string quick-lookup table:

| A `services:` container's native protocol (DB driver, migration tool) is unreachable from the AWF sandbox on `runner.topology: arc-dind`, with no host-iptables route available | A25 (join the **service** container, never the agent, to `awf-net` via `docker network connect --alias <name> awf-net <container>`; documented in github/gh-aw-firewall#8085) |
| `host.docker.internal` is allowlisted (e.g. for a host-side Ollama server) but the sandbox still cannot reach the host service despite correct port allowlisting | B34 (host-gateway setup wasn't triggered for `host.docker.internal`/`http(s)://host.docker.internal`; fixed in github/gh-aw-firewall#8172) |

Proposed portable agent changes

For .github/agents/self-hosted-runner-doctor.md — mirror both new catalog rows (A25, B34) into the embedded catalog copy, and mirror both new quick-lookup rows into the embedded playbook, so the portable agent stays in sync with the shared file and workflow playbook above.

Source issues and PRs

• docs: document verified pattern for joining services: containers to awf-net (ARC/DinD) #8085 — "docs: document verified pattern for joining services: containers to awf-net (ARC/DinD)" (fixes [awf] arc-dind: document/productize joining services: containers to awf-net for direct agent protocol access #8075)
• Enable host-gateway setup for explicit Ollama host domains #8172 — "Enable host-gateway setup for explicit Ollama host domains" (fixes Ollama #8165)

Generated by Runner Doctor Updater · copilot · auto · 98.9 AIC · ⊞ 3.3K · ◷

• expires on Oct 8, 2026, 4:43 PM UTC