Skip to content

docs: add D5 failure mode — stale gVisor release pin returns 404 #6161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 4 commits into from
Jul 13, 2026
+4 −0
Merged

docs: add D5 failure mode — stale gVisor release pin returns 404 #6161

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cd217f9
Initial plan
Copilot Jul 13, 2026
4ae11ac
docs: add D5 failure mode (stale gVisor release pin) to runner doctor…
Copilot Jul 13, 2026
beab09f
Potential fix for pull request finding
lpcox Jul 13, 2026
5fa4609
Potential fix for pull request finding
lpcox Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/agents/self-hosted-runner-doctor.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,6 +210,7 @@ Establish these facts before matching a failure mode:
| D2 | cli-proxy fails on IPv6-enabled runners | The tunnel was bound only to `127.0.0.1` | Fixed by dual-stack binding | Check `ss -tlnp` inside `awf-cli-proxy` | #4626 |
| D3 | `--enable-dind` still exists after DinD removal | Legacy flag cleanup is incomplete | Known unresolved cleanup item | `awf --help | grep enable-dind` | #1727 |
| D4 | Enterprise LLM gateway needs an injected auth header | API proxy lacks a user extension point for that hop | Known unresolved proposal | No general probe; capture the required header flow in the report | #4849 |
| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. `20250623.0`); Google removes old releases from `storage.googleapis.com`, so the download returns 404 | Update gVisor lock files to the latest pinned release (`20250707.0` or newer); upgrade to the AWF version after PR github/gh-aw-firewall#6143 | `curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/x86_64/runsc` — HTTP 404 confirms a stale pin | github/gh-aw-firewall#6143 |
Comment thread
Copilot marked this conversation as resolved.
Resolved

## Error-string quick lookup

Expand Down Expand Up @@ -240,6 +241,7 @@ Establish these facts before matching a failure mode:
| `getent passwd <UID>` fails or `HOME=/`, `USER=root` in chroot | A6 |
| Bind-mounted `/tmp/...` files are missing inside DinD containers | A1 |
| `diagnosis=unknown` from `awf-cli-proxy` DIFC probe (proxy reachable, no connection error) with `GITHUB_SERVER_URL=*.ghe.com`, or `diagnosis=reachable-but-api-error (HTTP NNN)` | C7 |
| `HTTP 404` / `404 Not Found` downloading `runsc` from `storage.googleapis.com` during gVisor install | D5 |

## Known unresolved items

Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/shared/self-hosted-failure-modes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ Establish these facts before matching a failure mode:
| D2 | cli-proxy fails on IPv6-enabled runners | The tunnel was bound only to `127.0.0.1` | Fixed by dual-stack binding | Check `ss -tlnp` inside `awf-cli-proxy` | #4626 |
| D3 | `--enable-dind` still exists after DinD removal | Legacy flag cleanup is incomplete | Known unresolved cleanup item | `awf --help | grep enable-dind` | #1727 |
| D4 | Enterprise LLM gateway needs an injected auth header | API proxy lacks a user extension point for that hop | Known unresolved proposal | No general probe; capture the required header flow in the report | #4849 |
| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. `20250623.0`); Google removes old releases from `storage.googleapis.com`, so the download returns 404 | Update gVisor lock files to the latest pinned release (`20250707.0` or newer): in your AWF config set `gvisor.releaseTag` to the newest valid tag, or upgrade to the AWF version after PR github/gh-aw-firewall#6143 which bumped all smoke-test lock files | `curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/x86_64/runsc` — HTTP 404 confirms a stale pin; replace tag with `20250707.0` and retry | github/gh-aw-firewall#6143 |
Comment thread
Copilot marked this conversation as resolved.
Resolved

## Error-string quick lookup

Expand Down Expand Up @@ -102,6 +103,7 @@ Establish these facts before matching a failure mode:
| `getent passwd <UID>` fails or `HOME=/`, `USER=root` in chroot | A6 |
| Bind-mounted `/tmp/...` files are missing inside DinD containers | A1 |
| `diagnosis=unknown` from `awf-cli-proxy` DIFC probe (proxy reachable, no connection error) with `GITHUB_SERVER_URL=*.ghe.com`, or `diagnosis=reachable-but-api-error (HTTP NNN)` | C7 |
| `HTTP 404` / `404 Not Found` downloading `runsc` from `storage.googleapis.com` during gVisor install | D5 |

## Known unresolved items

Expand Down