🩺 Runner Doctor UpdateRunner Doctor update: A15 fixed in PR #5963 (rootless artifact permission repair on ARC/DinD)

[github-actions]

Summary

• Scan window: 2026-07-06 (UTC)
• Items reviewed: 1 merged PR — fix: harden log directory management for ARC/DinD and rootless Docker #5963 (fix: harden log directory management for ARC/DinD and rootless Docker)
• Genuinely new lessons: 1 — A15 status flip: "Open — fix in progress" → Fixed in PR fix: harden log directory management for ARC/DinD and rootless Docker #5963

---

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

1. Update A15 — flip status from Open to Fixed, add #5963 citation

Current A15 Fix column:

**Open — fix in progress** (PR github/gh-aw-firewall#5817): workaround — run `chmod -R a+rX` inside the squid container before `docker compose down` while it still owns the log volume; or configure squid to write logs as runner UID

Replace with:

**Fixed in PR github/gh-aw-firewall#5963**: `fixArtifactPermissionsForRootless()` now calls `applyHostPathPrefixToVolumes()` so the repair container bind mount is correctly translated for the DinD daemon. Upgrade AWF to the version that includes #5963. Workaround (older AWF): run `chmod -R a+rX` inside the squid container before `docker compose down`.

Current Citations column for A15:

github/gh-aw-firewall#5816

Replace with:

github/gh-aw-firewall#5816, github/gh-aw-firewall#5817, github/gh-aw-firewall#5963

2. Remove A15 from "Known unresolved items"

Remove this line:

- A15 / github/gh-aw-firewall#5816 — rootless artifact permission repair on ARC/DinD: `fixArtifactPermissionsForRootless()` does not apply `dockerHostPathPrefix` to repair step bind mount; fix tracked in PR github/gh-aw-firewall#5817

---

Proposed doctor changes

File: .github/workflows/self-hosted-runner-doctor.md

No changes needed to the playbook itself. The diagnostic step that maps Rootless artifact permission repair failed → A15 remains correct; only the status of A15 changes.

---

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

This file embeds its own copy of the catalog and must be updated to match.

1. Update A15 Fix column

Replace (in the embedded A15 table row):

**Open — fix in progress** (PR github/gh-aw-firewall#5817): workaround — run `chmod -R a+rX` inside the squid container before `docker compose down` while it still owns the log volume; or configure squid to write logs as runner UID

With:

**Fixed in PR github/gh-aw-firewall#5963**: `fixArtifactPermissionsForRootless()` now calls `applyHostPathPrefixToVolumes()` so the repair container bind mount is correctly translated for the DinD daemon. Upgrade AWF to the version that includes #5963. Workaround (older AWF): run `chmod -R a+rX` inside the squid container before `docker compose down`.

2. Update A15 Citations

Change github/gh-aw-firewall#5816 → github/gh-aw-firewall#5816, github/gh-aw-firewall#5817, github/gh-aw-firewall#5963

3. Remove A15 from "Known unresolved items"

Remove:

- A15 / github/gh-aw-firewall#5816 — rootless artifact permission repair on ARC/DinD: `fixArtifactPermissionsForRootless()` does not apply `dockerHostPathPrefix` to repair step bind mount; fix tracked in PR github/gh-aw-firewall#5817

---

Source issues and PRs

• fix: rootless artifact permission repair fails on ARC/DinD topology #5816 — Issue: [WARN] Rootless artifact permission repair failed for .../sandbox/firewall/logs (exit 1) on ARC/DinD; dockerHostPathPrefix not applied to repair bind mount (original report)
• fix: chmod squid logs inside container before compose down #5817 — PR tracking the fix (referenced in A15 as "fix in progress")
• fix: harden log directory management for ARC/DinD and rootless Docker #5963 — Merged PR: fix: harden log directory management for ARC/DinD and rootless Docker — confirms the fix is now merged; fixArtifactPermissionsForRootless() calls applyHostPathPrefixToVolumes() on the repair bind mount source path, resolving the DinD daemon path translation failure

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Runner Doctor Updater · 179.1 AIC · ⊞ 11.4K · ◷

• expires on Aug 5, 2026, 7:34 PM UTC