feat: enable docker-sbx sandbox for ~50% of agentic workflows - #51264
Merged
Conversation
…eekly/hourly/smoke) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
August 8, 2026 01:12
View session
pelikhan
marked this pull request as ready for review
August 8, 2026 01:13
Contributor
There was a problem hiding this comment.
Pull request overview
Rolls out KVM-isolated docker-sbx execution to 108 scheduled and smoke-test agentic workflows.
Changes:
- Configures AWF agents with
runtime: docker-sbxandsudo: true. - Regenerates lock files with KVM checks, Docker authentication, sbx setup, and secret redaction.
- Removes obsolete host mounts from the CI cleaner.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/daily-*.md (69 files) |
Enables docker-sbx for daily workflows. |
.github/workflows/daily-*.lock.yml (69 files) |
Regenerates daily compiled workflows. |
.github/workflows/hourly-ci-cleaner.md |
Enables docker-sbx and removes host mounts. |
.github/workflows/hourly-ci-cleaner.lock.yml |
Regenerates the hourly workflow. |
.github/workflows/weekly-*.md (4 files) |
Enables docker-sbx for weekly workflows. |
.github/workflows/weekly-*.lock.yml (4 files) |
Regenerates weekly compiled workflows. |
.github/workflows/smoke-*.md (34 files) |
Enables docker-sbx for smoke workflows. |
.github/workflows/smoke-*.lock.yml (34 files) |
Regenerates smoke-test compiled workflows. |
Review details
Tip
Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 58/216 changed files
- Comments generated: 1
- Review effort level: Balanced
| sandbox: | ||
| agent: | ||
| id: awf | ||
| runtime: docker-sbx |
This was referenced Aug 8, 2026
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolls out
sandbox.agent.runtime: docker-sbx(KVM microVM isolation) to thedaily-*,weekly-*,hourly-*, andsmoke-*workflow groups — 108 of ~246 agentic workflows (≈44%).Sandbox config applied
sudo: trueis required for the sbx install step; the strict-mode deprecation warning is suppressed specifically fordocker-sbx.Skipped workflows
runner.topology: arc-dindsandbox.agent.config(filesystem mounts)smoke-claude.md,smoke-pi.mdlegacy-security: enablesmoke-service-ports.mdRuntime requirements
/dev/kvmpresentDOCKER_PATandDOCKER_USERNAMErepository secretsWorkflows on non-KVM runners fail fast at the "Check KVM availability for docker-sbx" preflight step with a clear error. No agent execution is attempted.
New secrets in compiled lock files
DOCKER_PATdocker/sandbox-templates:shell-dockertemplate image; not passed to agentDOCKER_USERNAMEdocker login/sbx loginduring daemon setup onlyNeither secret is accessible to the agent or exposed to the prompt.