Problem
On self-hosted ARC/DinD runners (runner.topology: arc-dind), docker compose up fails with:
error mounting "/dev/null" to .../gh-aw/home/.npmrc: create mountpoint ...: read-only file system
Context
Reported in github/gh-aw#57468. User's home dir mount is empty except whitelisted subdirs; /dev/null overlay bind-mounts are used to hide credential files like .npmrc, .docker/config.json, .composer/auth.json.
Root Cause
Per src/services/agent-volumes.ts, the empty home volume only allows whitelisted subdirs (.cache, .config, .local, .anthropic, .claude, .cargo, .rustup, .npm, .copilot) to be read-write; the rest of $HOME is read-only. The credential-hiding overlay tries to bind-mount /dev/null onto $HOME/.npmrc, but since .npmrc isn't inside a whitelisted rw subdir, Docker cannot create the mountpoint file at that read-only path — this only surfaces under arc-dind because --docker-host-path-prefix changes how/where the daemon resolves and materializes these mountpoints versus a same-host Docker daemon.
Proposed Solution
In agent-volumes.ts, ensure any path targeted by a /dev/null credential-hiding overlay is pre-created (empty file) in the underlying home volume layout (or explicitly whitelisted as rw) before Docker Compose attempts the bind, independent of docker-host-path-prefix translation. Add an integration test covering arc-dind + .npmrc/.docker/config.json/.composer/auth.json overlays to prevent regression.
Generated by Firewall Issue Dispatcher · copilot · auto · 23 AIC · ⊞ 9.4K · ◷
Problem
On self-hosted ARC/DinD runners (
runner.topology: arc-dind),docker compose upfails with:Context
Reported in github/gh-aw#57468. User's home dir mount is empty except whitelisted subdirs;
/dev/nulloverlay bind-mounts are used to hide credential files like.npmrc,.docker/config.json,.composer/auth.json.Root Cause
Per
src/services/agent-volumes.ts, the empty home volume only allows whitelisted subdirs (.cache,.config,.local,.anthropic,.claude,.cargo,.rustup,.npm,.copilot) to be read-write; the rest of$HOMEis read-only. The credential-hiding overlay tries to bind-mount/dev/nullonto$HOME/.npmrc, but since.npmrcisn't inside a whitelisted rw subdir, Docker cannot create the mountpoint file at that read-only path — this only surfaces under arc-dind because--docker-host-path-prefixchanges how/where the daemon resolves and materializes these mountpoints versus a same-host Docker daemon.Proposed Solution
In
agent-volumes.ts, ensure any path targeted by a/dev/nullcredential-hiding overlay is pre-created (empty file) in the underlying home volume layout (or explicitly whitelisted as rw) before Docker Compose attempts the bind, independent ofdocker-host-path-prefixtranslation. Add an integration test covering arc-dind +.npmrc/.docker/config.json/.composer/auth.jsonoverlays to prevent regression.