docs: DinD is required for ARC (not optional), fix NET_ADMIN misinformation, clarify sudo scope

[Copilot]

The self-hosted-runners reference doc and ARC DinD guide contained three categories of inaccuracies: DinD was presented as one option among peers rather than a hard requirement for ARC, NET_ADMIN was incorrectly stated as required on the runner container, and the sudo requirement conflated AWF (which runs rootless) with the Copilot CLI install script (which actually needs sudo).

self-hosted-runners.md

• Sudo section: Replace blanket "AWF requires sudo for host iptables" with two distinct requirements:
  • AWF runs rootless in default network-isolation mode — egress via internal Docker network + Squid proxy, no NET_ADMIN or sudo needed on the runner
  • install_copilot_cli.sh escalates via sudo for file ops (chown, binary install, cleanup); this is the actual blocker for allowPrivilegeEscalation: false pods
• Docker requirements → ARC/Kubernetes bullet: State DinD is required, containerMode.type="kubernetes" is not supported; add cross-reference links
• Filesystem section: Update stale "host-level AWF setup requires sudo" bullet to reflect rootless operation
• Bottom ARC section (was inconsistent with the top ARC DinD section): Full rewrite — leads with DinD required, Kubernetes mode unsupported, adds runner.topology: arc-dind reference, fixes pod security:
  • Before: "both dind sidecar and runner container need privileged: true" (incorrect)
  • After: only the dind sidecar needs privileged: true; runner container needs neither privileged nor NET_ADMIN

arc-dind-copilot-agent.md

• Step 3 helm command: Remove NET_ADMIN capability from the runner container spec
• Requirements table: NET_ADMIN row changed from Yes to No; Runner user row updated — sudo is for the install script, not AWF
• "How it works" section: Add Network isolation bullet explaining Docker-network-topology enforcement (no host iptables, daemon handles everything)

[Copilot]

Pull request overview

This PR updates the self-hosted runner and ARC DinD documentation to correct previously inaccurate statements about ARC requirements, NET_ADMIN, and what actually needs sudo (AWF vs the Copilot CLI install script).

Changes:

• Clarifies sudo requirements by separating AWF (rootless, no sudo in default isolation mode) from the Copilot CLI install script (uses sudo, incompatible with allowPrivilegeEscalation: false).
• Updates ARC guidance to state DinD is required and containerMode.type="kubernetes" is not supported; clarifies pod security (privileged only for the DinD sidecar, not the runner container).
• Updates the ARC DinD guide to remove NET_ADMIN from the runner container example and adds an explanation of network isolation via Docker topology.

Show a summary per file

File	Description
docs/src/content/docs/reference/self-hosted-runners.md	Corrects ARC/DinD and pod security guidance; clarifies sudo scope and rootless AWF behavior.
docs/src/content/docs/guides/arc-dind-copilot-agent.md	Updates ARC DinD setup instructions (removes NET_ADMIN) and explains network isolation model.
.github/workflows/firewall.lock.yml	Deleted generated workflow lock file (compiled output) for firewall.md.
.github/workflows/example-permissions-warning.lock.yml	Deleted generated workflow lock file (compiled output) for example-permissions-warning.md.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Deleted generated workflow lock file (compiled output) for codex-github-remote-mcp-test.md.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 12/258 changed files
• Comments generated: 2
• Review effort level: Low

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

The 256 accidentally deleted .lock.yml files have been restored in commit docs: restore accidentally deleted .lock.yml workflow files. The docs-only changes to self-hosted-runners.md and arc-dind-copilot-agent.md remain intact.

[gh-aw-bot]

@copilot please run the pr-finisher skill, ensure the branch is up to date, and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · 6.57 AIC · ⌖ 6.74 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.8