🩺 Runner Doctor Update🩺 Runner Doctor update: B10 (rootless permission repair timeout on tag@digest ref)

[github-actions]

Summary

• Scan window: 2026-07-02 to 2026-07-09 (UTC)
• Items reviewed: ~30 issues/PRs updated in the scan window; 2 with runner-doctor relevance
• Genuinely new lessons: 1 (PR fix: use tag-only image ref in rootless permission repair #6025 — new failure mode B10); A17 status update already applied in merged PR docs: mark A17 (build-tools digest pinning) as fixed #6040

---

Background

PR #6040 (merged 2026-07-09) already updated A17 from "open/pending" to "fixed" in all three catalog files. That change is already captured in the live catalog — no action needed there.

PR #6025 (merged 2026-07-09) introduces a new distinct failure mode that is not yet captured in the catalog.

---

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

1. Add new row B10 to the Category B table (after B9)

| B10 | `[WARN] Rootless artifact permission repair failed for .../sandbox/firewall/logs (exit 1)` × 3 directories, each taking exactly ~30 s; total ~90 s wasted; cascading `EACCES: permission denied` / `Failed to remove chroot home directory after permission repair` | `fixArtifactPermissionsForRootless()` builds compound `tag@digest` image refs (e.g. `agent:0.27.22@sha256:55f065...`) for its `docker run --pull never` repair container. Despite `--pull never`, Docker still attempts registry manifest verification for compound refs; when GHCR credentials are unavailable (cleaned in an earlier workflow step or expired) the verification TCP-connects and times out (~30 s per directory). | **Fixed in AWF (PR github/gh-aw-firewall#6025)**: `resolvePermFixerImageRef()` now strips the `@sha256:...` digest and uses a tag-only ref. `--pull never` with a tag-only ref skips all registry I/O. Upgrade to AWF version that includes github/gh-aw-firewall#6025. Workaround (older AWF): ensure GHCR credentials are available until after the AWF cleanup step. | `[WARN] Rootless artifact permission repair failed` messages each followed by exactly ~30 s delay in the workflow log; `docker pull --dry-run agent:...`@sha256`:...` times out while `docker inspect agent:...` succeeds | github/gh-aw-firewall#6025 |

2. Add new entry to the Error-string quick lookup table

After the existing Rootless artifact permission repair failed row (which maps to A15), add:

| `[WARN] Rootless artifact permission repair failed` with each attempt taking ~30 s (timeout, not an instant error), followed by cascading `EACCES: permission denied` on chroot-home removal | B10 |

---

Proposed doctor changes

File: .github/workflows/self-hosted-runner-doctor.md

In § 3 "Match symptom → failure mode", add:

- `[WARN] Rootless artifact permission repair failed` with each attempt taking ~30 s (registry timeout, not instant) → B10 (compound tag@digest ref causes Docker to attempt GHCR manifest verification even under `--pull never`)

In § 4 "Check for known gaps and notable fixes", add:

B10 / github/gh-aw-firewall#6025 — `fixArtifactPermissionsForRootless()` compound `tag@digest` ref timeout is **fixed** in AWF version including github/gh-aw-firewall#6025. `resolvePermFixerImageRef()` now returns tag-only refs, eliminating registry I/O during `--pull never` repair.

---

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

Apply the identical three edits to the embedded copy of the catalog and playbook:

1. B10 table row — add after B9 in the embedded Category B table (same content as above).
2. Error-string quick lookup — add the B10 entry after the existing A15 Rootless artifact permission repair failed entry.
3. § 3 symptom → failure mode — add the ~30 s timeout recognizer hint.
4. § 4 known gaps and notable fixes — add the B10 fix paragraph.

---

Source issues and PRs

• fix: use tag-only image ref in rootless permission repair #6025 (merged 2026-07-09) — fix: use tag-only image ref in rootless permission repair
  fix: use tag-only image ref in rootless permission repair #6025

  Observed symptom (from the PR body):

  [WARN] Rootless artifact permission repair failed for /tmp/gh-aw/sandbox/firewall/logs (exit 1)
  [WARN] Rootless artifact permission repair failed for /tmp/gh-aw/sandbox/firewall/audit (exit 1)
  [WARN] Rootless artifact permission repair failed for /tmp/awf-1783534966689-chroot-home (exit 1)
  [WARN] Failed to remove chroot home directory after permission repair: Error: EACCES: permission denied
  

  Each attempt took exactly ~30 s (TCP connect timeout to GHCR). Total ~90 s wasted per run.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Runner Doctor Updater · 238.9 AIC · ⊞ 13.3K · ◷

• expires on Aug 8, 2026, 7:37 PM UTC