fix: drop workDir-adjacent chroot-home mount on split-fs sysroot

src/compose-generator.test.ts

@@ -541,5 +541,21 @@ describe('generateDockerCompose', () => {
         expect(volumes).toContain('/dev:/host/dev:ro');
         expect(volumes).toContain('sysroot:/host:rw');
       });
+
+      it('drops the workDir-adjacent chroot-home bind mount on split-fs', () => {
+        const config = {
+          ...mockConfig,
+          runnerTopology: 'arc-dind' as const,
+          workDir: '/tmp/awf-12345',
+        };
+        const result = generateDockerCompose(config, mockNetworkConfig);
+        const volumes = result.services.agent.volumes as string[];
+
+        // The empty-home mount is sourced from `${workDir}-chroot-home`, a sibling
+        // of workDir under the runner's /tmp that the DinD daemon cannot see.
+        expect(volumes.some(v => v.split(':')[0] === '/tmp/awf-12345-chroot-home')).toBe(false);
+        expect(volumes.some(v => v.split(':')[0].startsWith('/tmp/awf-12345'))).toBe(false);
+      });
     });
 });
+

src/services/optional-services.ts

@@ -70,8 +70,16 @@ function filterAgentVolumesForSysroot(
     // Drop sysroot-shadowed targets (system binaries provided by volume)
     if (sysrootShadowedTargets.has(target)) return false;
 
-    // Drop mounts sourced from AWF workDir (runner's unshared /tmp/awf-*)
-    if (source === normalizedWorkDirPrefix || source.startsWith(`${normalizedWorkDirPrefix}/`)) {
+    // Drop mounts sourced from AWF workDir (runner's unshared /tmp/awf-*).
+    // Matches: the workDir itself, paths under it (`workDir/…`), and the known
+    // sibling pattern `workDir-…` (e.g. `${workDir}-chroot-home`).  Using three
+    // explicit conditions avoids dropping unrelated bind mounts when workDir is
+    // configured to a short or non-unique prefix.
+    if (
+      source === normalizedWorkDirPrefix ||
+      source.startsWith(normalizedWorkDirPrefix + '/') ||
+      source.startsWith(normalizedWorkDirPrefix + '-')
+    ) {
       return false;
     }
     // Drop home dot-directory mounts (e.g. .cache, .config) — sysroot provides them.