feat: Add `docker-sbx` runtime support to compiler by Copilot · Pull Request #45006 · github/gh-aw

Copilot · 2026-07-11T20:03:32Z

Adds docker-sbx as a sandbox.agent.runtime option, running the agent inside a KVM-isolated Docker sbx microVM while infrastructure containers (Squid, api-proxy, MCP gateway) remain on the host via Docker Compose.

New frontmatter

sandbox:
agent:
id: awfruntime: docker-sbxsudo: true # required

Compiler changes

New step generators (docker_sbx_install.go):

KVM availability fail-fast (lsmod | grep kvm, /dev/kvm writable)
Docker secrets fail-fast (DOCKER_PAT, DOCKER_USERNAME non-empty)
sbx install via Docker apt repo + sudo apt-get install -y docker-sbx
Daemon startup + Docker Hub auth (secrets via env: block, never inline) + policy reset + image pre-pull
Pre-flight smoke test: sbx create → sbx exec uname -a → sbx rm

MCP gateway routing — microVM cannot reach 127.0.0.1; for docker-sbx:

Port binding changed to 0.0.0.0
Gateway domain set to host.docker.internal
MCP_GATEWAY_HOST_DOMAIN=host.docker.internal injected into environment

AWF config:

--container-runtime sbx added to AWF CLI invocation
host.docker.internal added to network.allowDomains
network.isolation: true always forced (regardless of sudo: true)

Compile-time validation — rejects:

runtime: docker-sbx + runner.topology: arc-dind (no nested virt)
runtime: docker-sbx + sudo: false (install requires root)

Strict mode: sudo: true deprecation warning suppressed for docker-sbx (root is a hard requirement, not a choice).

Schema

docker-sbx added to the sandbox.agent.runtime enum in main_workflow_schema.json.

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-07-11T21:13:45Z

Hey @copilot-swe-agent 👋 — great work adding docker-sbx as a sandbox.agent.runtime option! The implementation looks well-scoped, covering the new step generators, schema update, validation logic, and a dedicated test file (docker_sbx_test.go). This is exactly the kind of focused, agentic contribution the project is built around. The PR looks ready for review! 🚀

Generated by ✅ Contribution Check · 97 AIC · ⌖ 12.9 AIC · ⊞ 6.2K · ◷

Copilot

Pull request overview

Adds compiler support for running agents in KVM-isolated Docker sbx microVMs.

Changes:

Adds runtime validation, schema support, and AWF configuration.
Generates Docker sbx installation, authentication, and smoke-test steps.
Routes MCP gateway traffic through host.docker.internal and adds tests.

Show a summary per file

File	Description
`.changeset/minor-docker-sbx-runtime-support.md`	Documents the new runtime.
`pkg/parser/schemas/main_workflow_schema.json`	Adds the runtime schema option.
`pkg/workflow/awf_config.go`	Configures microVM network access.
`pkg/workflow/awf_helpers.go`	Adds the AWF sbx runtime argument.
`pkg/workflow/codex_engine.go`	Installs sbx for Codex workflows.
`pkg/workflow/docker_sbx_install.go`	Generates sbx setup steps.
`pkg/workflow/docker_sbx_test.go`	Tests runtime compilation and setup.
`pkg/workflow/firewall.go`	Adds sbx runtime helpers and isolation.
`pkg/workflow/mcp_setup_generator.go`	Routes MCP traffic to the microVM.
`pkg/workflow/nodejs.go`	Installs sbx for npm engines.
`pkg/workflow/sandbox.go`	Defines the new runtime.
`pkg/workflow/sandbox_validation.go`	Validates sudo and runner topology.
`pkg/workflow/strict_mode_sandbox_validation.go`	Exempts required sudo usage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 13/13 changed files
Comments generated: 5
Review effort level: Medium

+	if isDockerSbxRuntime(config.WorkflowData) {
+ awfArgs = append(awfArgs, "--container-runtime", "sbx")


+ " set -euo pipefail",
+ ` echo "::group::Start sbx daemon"`,


+ ` if ! test -w /dev/kvm; then`,
+ ` echo "::error::/dev/kvm exists but is not writable. The runner must allow access to /dev/kvm."`,
+ ` exit 1`,
+ ` fi`,
+ ` echo "KVM is available and /dev/kvm is writable ✅"`,


+ ` echo "y" | sbx create shell --name test-sandbox-direct "${GITHUB_WORKSPACE}"`,
+ ` sbx exec test-sandbox-direct uname -a`,
+ ` sbx stop test-sandbox-direct`,
+ ` sbx rm --force test-sandbox-direct`,


+ if isDockerSbxRuntime(workflowData) {
+ // docker-sbx: publish to 0.0.0.0 so the microVM can reach the gateway via
+ // host.docker.internal (the Docker bridge gateway, 172.17.0.1).
+ containerCmd.WriteString(" -p 0.0.0.0:${MCP_GATEWAY_PORT}:${MCP_GATEWAY_PORT}")


gh-aw-bot · 2026-07-11T23:34:30Z

@copilot please run the pr-finisher skill, make sure the branch is up to date with the base branch, and rerun checks once everything is green.

Generated by 👨‍🍳 PR Sous Chef · 12.6 AIC · ⌖ 7.9 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

lpcox · 2026-07-11T23:35:22Z

@copilot run the pr-finisher skill

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-12T00:00:15Z

@copilot please run the pr-finisher skill, make sure the branch is up to date with the base branch, and rerun checks once everything is green.
...

Addressed in b7feffc. The branch is up to date with main and local make fmt, make lint, make test-unit, and make test all pass. CI on this new head still needs a maintainer re-trigger because agent pushes here do not start a fresh checks run.

github-actions · 2026-07-13T16:48:29Z

🎉 This pull request is included in a new release.

Release: v0.82.9

Initial plan
78b0e30

CopilotAI assigned Copilot and lpcox Jul 11, 2026

Copilotstarted work on behalf of lpcox July 11, 2026 20:03 View session

CopilotAI linked an issue Jul 11, 2026 that may be closed by this pull request
feat: Add docker-sbx runtime support to compiler #44978
Closed
13 tasks

CopilotAIand others added 2 commits July 11, 2026 20:26

feat: add docker-sbx runtime support to compiler
213e9d5
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: add negative secret assertions in auth/daemon step test
496eeb5
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Add docker-sbx runtime support to compiler~~feat: Add docker-sbx runtime support to compilerJul 11, 2026

Copilotfinished work on behalf of lpcox July 11, 2026 20:33

CopilotAI requested a review from lpcox July 11, 2026 20:33

github-actionsBot mentioned this pull request Jul 11, 2026
[Contribution Check Report] Contribution Check — 2026-07-11 #44855
Closed

lpcox marked this pull request as ready for review July 11, 2026 23:27

CopilotAI review requested due to automatic review settings July 11, 2026 23:27

Copilotstarted reviewing on behalf of lpcox July 11, 2026 23:28 View session

CopilotAI reviewed Jul 11, 2026
View reviewed changes

github-actionsBot mentioned this pull request Jul 11, 2026
[pr-sous-chef] Run report — 0 nudged, 0 skipped #44850
Closed

Copilotstarted work on behalf of gh-aw-bot July 11, 2026 23:35 View session

fix docker-sbx review follow-ups
b30535a
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

lpcox added the smoke label Jul 11, 2026

fix docker-sbx log wording
b7feffc
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilotfinished work on behalf of gh-aw-bot July 12, 2026 00:00

CopilotAI requested a review from gh-aw-bot July 12, 2026 00:00

Copilotstarted work on behalf of lpcox July 12, 2026 00:01 View session

lpcox merged commit b4f3c45 into mainJul 12, 2026
29 of 30 checks passed

lpcox deleted the copilot/feat-add-docker-sbx-runtime-support branch July 12, 2026 00:07

Copilot stopped work on behalf of lpcox due to an error July 12, 2026 00:07
The session was cancelled by the user.

This was referenced Jul 12, 2026
Suggested test: copilot/docker-sbx-runtime githubnext/gh-aw-test#6735
Open
[blog] Weekly blog post – 2026-07-13 #45166
Merged
[docs] Update glossary - weekly full scan #45252
Merged

Navigation Menu

Uh oh!

feat: Add `docker-sbx` runtime support to compiler - #45006

feat: Add `docker-sbx` runtime support to compiler#45006
lpcox merged 5 commits into
mainfrom
copilot/feat-add-docker-sbx-runtime-support

CopilotAI commented Jul 11, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Jul 11, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

gh-aw-bot commented Jul 11, 2026

Uh oh!

lpcox commented Jul 11, 2026

Uh oh!

CopilotAI commented Jul 12, 2026

Uh oh!

Uh oh!

github-actionsBot commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		if isDockerSbxRuntime(config.WorkflowData) {
		awfArgs = append(awfArgs, "--container-runtime", "sbx")

Uh oh!

Conversation

CopilotAI commented Jul 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New frontmatter

Compiler changes

Schema

Uh oh!

github-actionsBot commented Jul 11, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

gh-aw-bot commented Jul 11, 2026

Uh oh!

lpcox commented Jul 11, 2026

Uh oh!

CopilotAI commented Jul 12, 2026

Uh oh!

Uh oh!

github-actionsBot commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CopilotAI commented Jul 11, 2026•
edited
Loading