fix: prevent docker output from contaminating command stdout #743

Claude · 2026-02-12T06:48:40Z

Docker Compose and docker rm commands were outputting container names ("awf-squid", "awf-agent") to stdout, contaminating user command output and causing test failures that checked the last line of stdout.

Changes

Changed stdio configuration from 'inherit' to ['ignore', 'ignore', 'inherit'] in src/docker-manager.ts:

startContainers() - docker compose up command (line 1138)
stopContainers() - docker compose down command (line 1310)
stopContainers() - docker rm commands (line 1325)

This suppresses stdout while preserving stderr for error messages.

Example

Before the fix, running pwd with containerWorkDir: '/tmp' would output:

/tmp
awf-agent
awf-squid

After the fix:

/tmp

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

8.8.4.4
- Triggering command: REDACTED, pid is -1 (packet block)
8.8.8.8
- Triggering command: REDACTED, pid is -1 (packet block)
example.com
- Triggering command: /usr/bin/curl curl -f --connect-timeout 5 REDACTED --no-pager s1389343469 in/iptables by/a86e7eb8d0c6ddocker io.containerd.rucompose 2b5a9d4cf6954c3aup e2c9caba6be97d97-d NR==�� 6de724716a584890 iptables k/gh-aw-firewall/node_modules/.b--log-level nat -A /node_modules/.b-t bash (dns block)
https://api.github.com/repos/github/gh-aw-firewall/actions/runs/21936294354
- Triggering command: /usr/bin/gh gh run view 21936294354 --log -b claude/fix-github-actions-workflow-again /usr/local/bin/git --depth 2 REDACTED git conf�� unset --global e/node_modules/@anthropic-ai/claude-agent-sdk/vendor/ripgrep/x64-linux/rg pull.rebase (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

The issue was that Docker Compose and Docker commands were using `stdio: 'inherit'` which caused container names like "awf-squid" and "awf-agent" to appear in the command stdout during container startup and teardown. This contaminated the output of user commands, causing test failures when tests checked the last line of stdout. Changes: - Changed stdio from 'inherit' to ['ignore', 'ignore', 'inherit'] in: - startContainers() docker compose up command (line 1138) - stopContainers() docker compose down command (line 1310) - stopContainers() docker rm commands (line 1325) This preserves stderr output for error messages while suppressing stdout that contains container names. Fixes the three failing tests in chroot-edge-cases.test.ts: - "should respect container-workdir in chroot mode" - "should fall back to home directory if workdir does not exist" - "should have HOME set correctly" Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-02-12T07:01:26Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-02-12T07:01:29Z

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

github-actions · 2026-02-12T07:01:32Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-12T07:04:49Z

Node.js Build Test Results

Project	Install	Tests	Status
clsx	✅	All passed	PASS
execa	✅	All passed	PASS
p-limit	✅	All passed	PASS

Overall: PASS ✅

All Node.js test projects built and tested successfully.

AI generated by Build Test Node.js

github-actions · 2026-02-12T07:04:59Z

Go Build Test Results

Project	Download	Tests	Status
color	✅	1/1	PASS
env	✅	1/1	PASS
uuid	✅	1/1	PASS

Overall: PASS ✅

All Go projects successfully downloaded dependencies and passed tests.

AI generated by Build Test Go

github-actions · 2026-02-12T07:05:02Z

Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

All Deno tests completed successfully.

AI generated by Build Test Deno

github-actions · 2026-02-12T07:05:04Z

Build Test: Bun - Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS ✅
hono	✅	1/1	PASS ✅

Overall: PASS ✅

All Bun projects built and tested successfully.

AI generated by Build Test Bun

github-actions · 2026-02-12T07:05:12Z

Smoke Test Results - Run 21936807159

✅ GitHub MCP: Retrieved last 2 merged PRs

fix: create .copilot/logs mountpoint before docker mount #722: fix: create .copilot/logs mountpoint before docker mount
fix: only hide credential files if parent directory exists #737: fix: only hide credential files if parent directory exists

✅ Playwright: Verified github.com title contains "GitHub"
✅ File Write: Created /tmp/gh-aw/agent/smoke-test-copilot-21936807159.txt
✅ Bash: Verified file content

Status: PASS

cc: @Claude @lpcox

AI generated by Smoke Copilot

github-actions · 2026-02-12T07:05:29Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS ✅

All .NET projects successfully restored, built, and ran with expected output.

AI generated by Build Test .NET

github-actions · 2026-02-12T07:05:30Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

All C++ projects built successfully with CMake and make.

AI generated by Build Test C++

github-actions · 2026-02-12T07:05:53Z

Java Build Test Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS

All Java projects compiled and tested successfully through the firewall.

AI generated by Build Test Java

github-actions · 2026-02-12T07:06:08Z

Build Test: Rust - FAILED ❌

Issue

Rust build test cannot proceed due to environment limitations:

Problem: ~/.cargo directory is mounted as a 1MB tmpfs (credential hiding feature)
Impact: Cannot install Rust toolchain (cargo/rustc) in the agent container
Error: No space left on device during rustup installation

Test Results

Project	Build	Tests	Status
fd	❌	N/A	BLOCKED
zoxide	❌	N/A	BLOCKED

Overall: FAILED - Tests could not run

Required Actions

To enable Rust build tests, choose one of:

Pre-install Rust in agent container - Add Rust toolchain to containers/agent/Dockerfile
Use --allow-full-filesystem-access - Disables credential hiding tmpfs mounts
Exclude ~/.cargo from tmpfs - Modify credential hiding to skip cargo directory

Technical Details

$ mount | grep cargo
tmpfs on /home/runner/.cargo type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1024k,inode64)

$ curl https://sh.rustup.rs | sh -s -- -y
error: could not copy file: No space left on device (os error 28)

AI generated by Build Test Rust

github-actions · 2026-02-12T07:06:08Z

Chroot Version Comparison Test Results

Runtime	Host Version	Chroot Version	Match?
Python	3.12.12	3.12.3	❌ NO
Node.js	v24.13.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall Result: ❌ Tests did not pass (1/3 runtimes matched)

The chroot environment successfully accesses Go from the host, but Python and Node.js versions differ. This is expected behavior - the chroot mode provides transparent access to host binaries when available.

AI generated by Smoke Chroot

Copilot

Pull request overview

This PR aims to prevent Docker/Compose commands (e.g., docker compose up/down, docker rm -f) from writing container names to stdout, which can contaminate the user command’s output and break stdout-sensitive tests/consumers.

Changes:

Suppress stdout for docker compose up -d during container startup while preserving stderr for errors.
Suppress stdout for docker compose down -v during cleanup while preserving stderr for errors.
Suppress stdout for fallback docker rm -f container removals while preserving stderr for errors.

Comments suppressed due to low confidence (1)

src/docker-manager.ts:1138

This change updates the execa options for docker compose up, but the unit tests still assert stdio: 'inherit' for this call (see src/docker-manager.test.ts startContainers tests around the expectations for compose up). Please update the mocked toHaveBeenCalledWith expectations to match the new stdio configuration so the unit test suite reflects the new behavior.

    await execa('docker', composeArgs, {
      cwd: workDir,
      stdio: ['ignore', 'ignore', 'inherit'], // Only inherit stderr for errors, ignore stdout to prevent container names appearing in output

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-12T07:11:16Z

src/docker-manager.ts

    await execa('docker', composeArgs, {
      cwd: workDir,
-      stdio: 'inherit',
+      stdio: ['ignore', 'ignore', 'inherit'], // Only inherit stderr for errors, ignore stdout to prevent container names appearing in output


stdio: ['ignore', 'ignore', 'inherit'] also changes stdin from inherited to ignored. If the goal is only to suppress Docker stdout, consider inheriting stdin and only ignoring stdout (e.g., keep stdin as inherit) to avoid an unnecessary behavior change for interactive/TTY-sensitive Docker commands.

This issue also appears on line 1136 of the same file.

Suggested change

stdio: ['ignore', 'ignore', 'inherit'], // Only inherit stderr for errors, ignore stdout to prevent container names appearing in output

stdio: ['inherit', 'ignore', 'inherit'], // Only inherit stderr for errors, ignore stdout to prevent container names appearing in output

Copilot · 2026-02-12T07:11:16Z

src/docker-manager.ts

      await execa('docker', ['compose', 'down', '-v'], {
        cwd: workDir,
-        stdio: 'inherit',
+        stdio: ['ignore', 'ignore', 'inherit'], // Ignore stdout to prevent container names appearing in output


The stopContainers() unit tests currently expect docker compose down -v to be invoked with stdio: 'inherit', but this call now uses a different stdio config. Also, stopContainers() only takes the compose-down branch when docker-compose.yml exists; the test should either create that file to exercise this branch or update expectations to match the fallback path.

Suggested change

stdio: ['ignore', 'ignore', 'inherit'], // Ignore stdout to prevent container names appearing in output

stdio: 'inherit',

Initial plan

7064881

Claude AI assigned Claude and lpcox Feb 12, 2026

Claude started work on behalf of lpcox February 12, 2026 06:48 View session

Claude AI changed the title ~~[WIP] Fix failing GitHub Actions workflow for chroot edge cases~~ fix: prevent docker output from contaminating command stdout Feb 12, 2026

Claude AI requested a review from lpcox February 12, 2026 07:00

Claude finished work on behalf of lpcox February 12, 2026 07:00

github-actions bot mentioned this pull request Feb 12, 2026

[agentics] No-Op Runs #735

Open

github-actions bot added the build-test-node label Feb 12, 2026

github-actions bot added the build-test-go label Feb 12, 2026

github-actions bot added the build-test-deno label Feb 12, 2026

github-actions bot added the build-test-bun label Feb 12, 2026

github-actions bot added smoke-copilot build-test-dotnet labels Feb 12, 2026

github-actions bot added the build-test-cpp label Feb 12, 2026

github-actions bot added the build-test-java label Feb 12, 2026

lpcox marked this pull request as ready for review February 12, 2026 07:07

Copilot AI review requested due to automatic review settings February 12, 2026 07:07

lpcox merged commit 8d29c00 into lpcox/port-one-shot-token-rust Feb 12, 2026
66 of 67 checks passed

lpcox deleted the claude/fix-github-actions-workflow-again branch February 12, 2026 07:07

Copilot started reviewing on behalf of lpcox February 12, 2026 07:08 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

github-actions bot mentioned this pull request Feb 12, 2026

feat: port one-shot-token from C to Rust and improve container security #720

Open

	stdio: ['ignore', 'ignore', 'inherit'], // Only inherit stderr for errors, ignore stdout to prevent container names appearing in output
	stdio: ['inherit', 'ignore', 'inherit'], // Only inherit stderr for errors, ignore stdout to prevent container names appearing in output

	stdio: ['ignore', 'ignore', 'inherit'], // Ignore stdout to prevent container names appearing in output
	stdio: 'inherit',

fix: prevent docker output from contaminating command stdout #743

fix: prevent docker output from contaminating command stdout #743

Conversation

Claude AI commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Example

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026

Node.js Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Go Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Deno Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Build Test: Bun - Results

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

.NET Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Java Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Build Test: Rust - FAILED ❌

Issue

Test Results

Required Actions

Technical Details

Uh oh!

github-actions bot commented Feb 12, 2026

Chroot Version Comparison Test Results

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Claude AI commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading