feat: Add `docker-sbx` runtime support to compiler by Copilot · Pull Request #45006 · github/gh-aw

Copilot · 2026-07-11T20:03:32Z

Adds docker-sbx as a sandbox.agent.runtime option, running the agent inside a KVM-isolated Docker sbx microVM while infrastructure containers (Squid, api-proxy, MCP gateway) remain on the host via Docker Compose.

New frontmatter

sandbox:
  agent:
    id: awf
    runtime: docker-sbx
    sudo: true  # required

Compiler changes

New step generators (docker_sbx_install.go):

KVM availability fail-fast (lsmod | grep kvm, /dev/kvm writable)
Docker secrets fail-fast (DOCKER_PAT, DOCKER_USERNAME non-empty)
sbx install via Docker apt repo + sudo apt-get install -y docker-sbx
Daemon startup + Docker Hub auth (secrets via env: block, never inline) + policy reset + image pre-pull
Pre-flight smoke test: sbx create → sbx exec uname -a → sbx rm

MCP gateway routing — microVM cannot reach 127.0.0.1; for docker-sbx:

Port binding changed to 0.0.0.0
Gateway domain set to host.docker.internal
MCP_GATEWAY_HOST_DOMAIN=host.docker.internal injected into environment

AWF config:

--container-runtime sbx added to AWF CLI invocation
host.docker.internal added to network.allowDomains
network.isolation: true always forced (regardless of sudo: true)

Compile-time validation — rejects:

runtime: docker-sbx + runner.topology: arc-dind (no nested virt)
runtime: docker-sbx + sudo: false (install requires root)

Strict mode: sudo: true deprecation warning suppressed for docker-sbx (root is a hard requirement, not a choice).

Schema

docker-sbx added to the sandbox.agent.runtime enum in main_workflow_schema.json.

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-07-11T21:13:45Z

Hey @copilot-swe-agent 👋 — great work adding docker-sbx as a sandbox.agent.runtime option! The implementation looks well-scoped, covering the new step generators, schema update, validation logic, and a dedicated test file (docker_sbx_test.go). This is exactly the kind of focused, agentic contribution the project is built around. The PR looks ready for review! 🚀

Generated by ✅ Contribution Check · 97 AIC · ⌖ 12.9 AIC · ⊞ 6.2K · ◷

Copilot

Pull request overview

Adds compiler support for running agents in KVM-isolated Docker sbx microVMs.

Changes:

Adds runtime validation, schema support, and AWF configuration.
Generates Docker sbx installation, authentication, and smoke-test steps.
Routes MCP gateway traffic through host.docker.internal and adds tests.

Show a summary per file

File	Description
`.changeset/minor-docker-sbx-runtime-support.md`	Documents the new runtime.
`pkg/parser/schemas/main_workflow_schema.json`	Adds the runtime schema option.
`pkg/workflow/awf_config.go`	Configures microVM network access.
`pkg/workflow/awf_helpers.go`	Adds the AWF sbx runtime argument.
`pkg/workflow/codex_engine.go`	Installs sbx for Codex workflows.
`pkg/workflow/docker_sbx_install.go`	Generates sbx setup steps.
`pkg/workflow/docker_sbx_test.go`	Tests runtime compilation and setup.
`pkg/workflow/firewall.go`	Adds sbx runtime helpers and isolation.
`pkg/workflow/mcp_setup_generator.go`	Routes MCP traffic to the microVM.
`pkg/workflow/nodejs.go`	Installs sbx for npm engines.
`pkg/workflow/sandbox.go`	Defines the new runtime.
`pkg/workflow/sandbox_validation.go`	Validates sudo and runner topology.
`pkg/workflow/strict_mode_sandbox_validation.go`	Exempts required sudo usage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 13/13 changed files
Comments generated: 5
Review effort level: Medium

+	if isDockerSbxRuntime(config.WorkflowData) {
+		awfArgs = append(awfArgs, "--container-runtime", "sbx")


+		"          set -euo pipefail",
+		`          echo "::group::Start sbx daemon"`,


+		`          if ! test -w /dev/kvm; then`,
+		`            echo "::error::/dev/kvm exists but is not writable. The runner must allow access to /dev/kvm."`,
+		`            exit 1`,
+		`          fi`,
+		`          echo "KVM is available and /dev/kvm is writable ✅"`,


+		`          echo "y" | sbx create shell --name test-sandbox-direct "${GITHUB_WORKSPACE}"`,
+		`          sbx exec test-sandbox-direct uname -a`,
+		`          sbx stop test-sandbox-direct`,
+		`          sbx rm --force test-sandbox-direct`,


+		if isDockerSbxRuntime(workflowData) {
+			// docker-sbx: publish to 0.0.0.0 so the microVM can reach the gateway via
+			// host.docker.internal (the Docker bridge gateway, 172.17.0.1).
+			containerCmd.WriteString(" -p 0.0.0.0:${MCP_GATEWAY_PORT}:${MCP_GATEWAY_PORT}")


gh-aw-bot · 2026-07-11T23:34:30Z

@copilot please run the pr-finisher skill, make sure the branch is up to date with the base branch, and rerun checks once everything is green.

Generated by 👨‍🍳 PR Sous Chef · 12.6 AIC · ⌖ 7.9 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

lpcox · 2026-07-11T23:35:22Z

@copilot run the pr-finisher skill

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-12T00:00:15Z

@copilot please run the pr-finisher skill, make sure the branch is up to date with the base branch, and rerun checks once everything is green.

...

Addressed in b7feffc. The branch is up to date with main and local make fmt, make lint, make test-unit, and make test all pass. CI on this new head still needs a maintainer re-trigger because agent pushes here do not start a fresh checks run.

github-actions · 2026-07-13T16:48:29Z

🎉 This pull request is included in a new release.

Release: v0.82.9

Initial plan

78b0e30

Copilot AI assigned Copilot and lpcox Jul 11, 2026

Copilot started work on behalf of lpcox July 11, 2026 20:03 View session

Copilot AI linked an issue Jul 11, 2026 that may be closed by this pull request

feat: Add docker-sbx runtime support to compiler #44978

Closed

13 tasks

Copilot AI and others added 2 commits July 11, 2026 20:26

feat: add docker-sbx runtime support to compiler

213e9d5

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: add negative secret assertions in auth/daemon step test

496eeb5

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add docker-sbx runtime support to compiler~~ feat: Add docker-sbx runtime support to compiler Jul 11, 2026

Copilot finished work on behalf of lpcox July 11, 2026 20:33

Copilot AI requested a review from lpcox July 11, 2026 20:33

github-actions Bot mentioned this pull request Jul 11, 2026

[Contribution Check Report] Contribution Check — 2026-07-11 #44855

Closed

lpcox marked this pull request as ready for review July 11, 2026 23:27

Copilot AI review requested due to automatic review settings July 11, 2026 23:27

Copilot started reviewing on behalf of lpcox July 11, 2026 23:28 View session

Copilot AI reviewed Jul 11, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 11, 2026

[pr-sous-chef] Run report — 0 nudged, 0 skipped #44850

Closed

Copilot started work on behalf of gh-aw-bot July 11, 2026 23:35 View session

fix docker-sbx review follow-ups

b30535a

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

lpcox added the smoke label Jul 11, 2026

fix docker-sbx log wording

b7feffc

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 12, 2026 00:00

Copilot AI requested a review from gh-aw-bot July 12, 2026 00:00

Copilot started work on behalf of lpcox July 12, 2026 00:01 View session

lpcox merged commit b4f3c45 into main Jul 12, 2026
29 of 30 checks passed

lpcox deleted the copilot/feat-add-docker-sbx-runtime-support branch July 12, 2026 00:07

Copilot stopped work on behalf of lpcox due to an error July 12, 2026 00:07
The session was cancelled by the user.

This was referenced Jul 12, 2026

Suggested test: copilot/docker-sbx-runtime githubnext/gh-aw-test#6735

Open

[blog] Weekly blog post – 2026-07-13 #45166

Merged

[docs] Update glossary - weekly full scan #45252

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add `docker-sbx` runtime support to compiler#45006

feat: Add `docker-sbx` runtime support to compiler#45006
lpcox merged 5 commits into
mainfrom
copilot/feat-add-docker-sbx-runtime-support

Copilot AI commented Jul 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

gh-aw-bot commented Jul 11, 2026

Uh oh!

lpcox commented Jul 11, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		if isDockerSbxRuntime(config.WorkflowData) {
		awfArgs = append(awfArgs, "--container-runtime", "sbx")

Uh oh!

Conversation

Copilot AI commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New frontmatter

Compiler changes

Schema

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

gh-aw-bot commented Jul 11, 2026

Uh oh!

lpcox commented Jul 11, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 11, 2026 •

edited

Loading