[aw-failures] [aw-fix] Rootless chroot hosts-file EACCES crashes awf sandbox config generation (blocks Smoke CI)

[github-actions]

Fix the rootless chroot hosts-file write in awf sandbox config generation — it fatally EACCES-crashes every network-isolated agent run

Parent: #46170

Problem statement

In network-isolation mode, awf config generation (writeConfigs, awf-bundle.js:805) aborts with a fatal EACCES while writing the chroot hosts file, killing the agent job before any work runs (token usage 0). This is 100% reproducible on GitHub-hosted rootless runners and is currently failing all Smoke CI agent jobs.

Affected workflows & run IDs

• Smoke CI (.github/workflows/smoke-ci.lock.yml) — dominant, majority of 31 failed runs in the 6h window.
• Confirmed runs: §29561818387, §29561792838, §29561773855, §29561757674, §29561745591.

Probable root cause

1. Uid-remap permission mismatch: chroot dirs are created mode=0600/0700 owned by uid=1001, but under the rootless container remap the effective writer's uid differs from the owner, so the 0700 dir is not traversable/writable → the initial EACCES warning.
2. Broken fallback: the fallback is supposed to write into hostsRootDir (/tmp/awf-<id>) but instead targets a different, never-created path /tmp/awf-chroot-<y>/hosts — so the "recovery" write is guaranteed to fail fatally.

Proposed remediation

• Create the chroot hosts directory with group/other-traversable perms appropriate for the rootless remap (e.g. 0711 on parents, 0644 on the hosts file) instead of 0700/0600, or create it under the uid that actually performs the write.
• Fix the fallback to write into the actual hostsRootDir it just logged, not a newly-constructed /tmp/awf-chroot-* path; reuse the existing verified directory handle.
• Make the fallback non-fatal: on EACCES, retry via the already-created writable dir and only abort if all candidates fail, with a diagnostic listing attempted paths + stat perms.
• Add a rootless-runner regression test that exercises writeConfigs under a remapped uid.

Success criteria / verification

• Smoke CI agent job proceeds past "Generating configuration files..." with non-zero token usage on a rootless runner.
• Re-run of a previously-failing PR (e.g. the branches behind §29561818387) completes the Execute GitHub Copilot CLI step.
• No EACCES ... /hosts fatal in writeConfigs across 10 consecutive Smoke CI runs.
  Related to [aw-failures] P0: Smoke CI sandbox crash — EACCES writing chroot hosts file blocks all PR agent runs (last 6h) #46170

Generated by 🔍 [aw] Failure Investigator (6h) · 129.8 AIC · ⌖ 40.7 AIC · ⊞ 5.2K · ◷

• expires on Jul 23, 2026, 11:41 PM UTC-08:00

---

Resolved — EACCES chroot sandbox crash no longer reproduces (Failure Investigator 6h, 2026-07-20)

Fresh evidence from the last 6h window: all 20 recent failed runs got past awf sandbox config generation (writeConfigs). Containers start, chroot mounts, agents execute, and token usage is non-zero — failures are now downstream (model-policy 403, AI-credits pricing 400, CLI timeout), not the EACCES ... open '/tmp/awf-chroot-*/hosts' fatal at awf-bundle.js:805. The dominant P0 signature is absent. Closing as fixed. Reopen if the EACCES-at-writeConfigs signature reappears.

Sample runs that cleared sandbox setup: §29742584537, §29742523537, §29742584188.

Generated by 🔍 [aw] Failure Investigator (6h) · 136.1 AIC · ⌖ 36.6 AIC · ⊞ 5.2K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · 1.19 AIC · ⌖ 6.19 AIC · ⊞ 7.4K · ◷