Default GitHub-hosted Ubuntu runners to Docker Sandbox

[Copilot]

GitHub-hosted Ubuntu workflows now prefer Docker Sandbox (docker sbx) when no agent runtime is explicitly configured. Explicit runtime selection and self-hosted/local defaults remain unchanged.

• Default runtime selection

  • Select docker-sbx for supported GitHub-hosted Ubuntu labels.
  • Preserve explicit sandbox.agent.runtime overrides.

• Runtime fallback

  • Attempt Docker Sandbox setup, KVM validation, authentication, daemon startup, and policy initialization.
  • Emit a workflow warning and continue with the standard Docker runtime if Docker Sandbox cannot be used.
  • Skip Docker Sandbox credential refresh after fallback.

• Generated workflows and documentation

  • Regenerate workflow lock files for the new default.
  • Document runtime selection, fallback behavior, and MCP gateway network exposure.

sandbox:
  agent: awf # GitHub-hosted Ubuntu: attempts docker-sbx automatically

sandbox:
  agent:
    id: awf
    runtime: gvisor # Explicit runtime remains authoritative

• Fixes Make Docker sandbox the default runtime on GitHub-hosted runners #51252

[github-actions]

👋 Thanks for working on this!

The PR implements the Docker Sandbox runtime default feature for GitHub-hosted Ubuntu runners as planned in #51252. The description clearly outlines the behavior (default selection, fallback handling, and explicit overrides), and the regenerated workflow lock files are consistent with the approach.

Here are a few areas to strengthen before this is ready for merge:

Add test coverage — The new runtime selection logic (preferring docker-sbx for GitHub-hosted Ubuntu, fallback to standard Docker, preserving explicit overrides) should have unit tests covering:

• Runtime selection on GitHub-hosted vs. self-hosted runners
• Fallback behavior when Docker Sandbox setup fails
• Explicit runtime configuration taking precedence over defaults
• Local/self-hosted defaults remaining unchanged

This ensures the logic is resilient and maintainable as the codebase evolves.

Verify test files — The large diff is mostly auto-generated workflow lock files (expected), but confirm that tests for the underlying runtime selection code are present. If the logic is in Go code, look for corresponding *_test.go files with the scenarios above covered.

Note on draft status — The PR is currently in draft mode. When you're ready for review, remember to mark it ready for review so maintainers can prioritize it.

If you'd like help adding tests for the runtime selection logic, you can assign this prompt to your coding agent:

Add unit tests for the Docker Sandbox runtime selection feature in gh-aw.

Cover these scenarios:
1. On GitHub-hosted Ubuntu runners: default to docker-sbx runtime
2. Explicit sandbox.agent.runtime configuration: should override defaults
3. Docker Sandbox setup failure: fallback to standard Docker with warning
4. Non-GitHub-hosted runners: preserve existing defaults
5. Self-hosted runners: preserve existing defaults

Ensure tests validate both the selection logic and the fallback flow.

Generated by ✅ Contribution Check · auto · 89.7 AIC · ⌖ 2.91 AIC · ⊞ 8.7K · ◷