🩺 Runner Doctor UpdateUpdate B20: cli-proxy-egress relay resolves ENETUNREACH in network-isolation mode

[github-actions]

Summary

• Scan window: updated >= 2026-08-13 (UTC) in github/gh-aw-firewall.
• Reviewed recently merged PRs; found 1 genuinely new, not-yet-captured lesson.

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

Update row B20 (currently listed as "Known unresolved" — the dual-home attempt in #7066 was reverted). PR #7338 ("fix: route CLI proxy through isolated egress relay", merged 2026-08-14) supersedes that unresolved status with an actual fix:

• Instead of dual-homing the credential-bearing cli-proxy onto awf-ext (which was reverted due to granting unrestricted egress), AWF now creates a separate cli-proxy-egress service when the DIFC proxy target is external under --network-isolation:
  • contains no GitHub credentials or writable mounts
  • runs only a fixed-target TCP relay forwarding solely to the configured DIFC host:port
  • is the only CLI-proxy component attached to awf-ext
  • uses a read-only filesystem, dropped capabilities, and resource limits
  • the credential-bearing cli-proxy connects to this relay over awf-net only
  • attached sibling DIFC proxies (already on awf-net) continue to work directly — no relay is created for them
  • loopback DIFC addresses are normalized to host.docker.internal so the relay reaches the runner-host proxy rather than itself

Proposed row edit (replace the "Fix / flag" and "Citations" cells for B20):

Fix / flag: Fixed in AWF (PR #7338, merged 2026-08-14): a credential-free cli-proxy-egress relay service is created and attached to awf-ext only when the DIFC proxy target is external; the credential-bearing cli-proxy stays on awf-net and reaches the relay there. No relay is created for attached sibling DIFC proxies already on awf-net. Loopback DIFC addresses are normalized to host.docker.internal. Upgrade AWF to include #7338.

Probe: Inspect generated compose for a cli-proxy-egress service attached to awf-ext with no credential env vars and a read-only filesystem; confirm cli-proxy itself remains attached only to awf-net.

Citations: #7063, #7066, #7335, #7338

Also update the "Known unresolved items" list at the bottom of the file to remove the B20 entry (no longer unresolved).

Proposed doctor changes

File: .github/workflows/self-hosted-runner-doctor.md

Update the error-string quick-lookup row:

ENETUNREACH ... :18443 (or default bridge gateway IP) from awf-cli-proxy in --network-isolation mode | B20 (fixed in #7338 via credential-free cli-proxy-egress relay attached to awf-ext; upgrade AWF)

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

Apply the identical B20 row edit, "Known unresolved items" removal, and error-string lookup update as above, to keep the embedded copy in sync with the workflow/shared files.

Source issues and PRs

• fix: route CLI proxy through isolated egress relay #7338 (fix: route CLI proxy through isolated egress relay — merged)
• [awf] network-isolation: cli-proxy still cannot reach an external DIFC proxy on v0.28.0 (supersedes #7063) #7335 (underlying issue; not independently readable due to integrity policy but referenced by the fix PR)
• Prior citations already in catalog: [awf] network-isolation: cli-proxy cannot reach the external DIFC proxy (ENETUNREACH to host gateway) on GitHub-hosted runners, no Tailscale - variant of #6704 #7063, Fix cli-proxy ENETUNREACH in network-isolation mode by dual-homing it on the external bridge #7066

Note: PR #7387 (open, docs) already proposes a related docs/awf-config-spec.md update describing this relay for the auth/DIFC angle — that is a separate, non-duplicate documentation track from this runner-doctor knowledge-base update.

Generated by Runner Doctor Updater · auto · 41.9 AIC · ⊞ 43.4K · ◷

• expires on Sep 14, 2026, 7:01 PM UTC