fix: drop workDir-adjacent chroot-home mount on split-fs sysroot

src/compose-generator.test.ts

@@ -541,5 +541,21 @@ describe('generateDockerCompose', () => {
         expect(volumes).toContain('/dev:/host/dev:ro');
         expect(volumes).toContain('sysroot:/host:rw');
       });
+
+      it('drops the workDir-adjacent chroot-home bind mount on split-fs', () => {
+        const config = {
+          ...mockConfig,
+          runnerTopology: 'arc-dind' as const,
+          workDir: '/tmp/awf-12345',
+        };
+        const result = generateDockerCompose(config, mockNetworkConfig);
+        const volumes = result.services.agent.volumes as string[];
+
+        // The empty-home mount is sourced from `${workDir}-chroot-home`, a sibling
+        // of workDir under the runner's /tmp that the DinD daemon cannot see.
+        expect(volumes.some(v => v.split(':')[0] === '/tmp/awf-12345-chroot-home')).toBe(false);
+        expect(volumes.some(v => v.split(':')[0].startsWith('/tmp/awf-12345'))).toBe(false);
+      });
     });
 });
+

src/services/optional-services.ts

@@ -70,8 +70,12 @@ function filterAgentVolumesForSysroot(
     // Drop sysroot-shadowed targets (system binaries provided by volume)
     if (sysrootShadowedTargets.has(target)) return false;
 
-    // Drop mounts sourced from AWF workDir (runner's unshared /tmp/awf-*)
-    if (source === normalizedWorkDirPrefix || source.startsWith(`${normalizedWorkDirPrefix}/`)) {
+    // Drop mounts sourced from AWF workDir (runner's unshared /tmp/awf-*).
+    // This includes the workDir itself, paths under it, and workDir-adjacent
+    // sibling paths such as the empty-home dir (`${workDir}-chroot-home`) — all
+    // are created by AWF under the runner's /tmp and are invisible to the daemon.
+    // workDir is a unique `/tmp/awf-<timestamp>` path, so a prefix match is safe.
+    if (source.startsWith(normalizedWorkDirPrefix)) {
       return false;
     }
     // Drop home dot-directory mounts (e.g. .cache, .config) — sysroot provides them.