feat: remove Docker-in-Docker support

[Copilot]

Complete removal of docker-in-docker functionality. After this change, agents connect only to remote MCP servers and cannot spawn local Docker containers from within the agent container.

Deleted Files

• containers/agent/docker-wrapper.sh — Docker command interceptor
• tests/integration/docker-egress.test.ts — DinD security tests
• examples/docker-in-docker.sh — DinD example

Core Changes

• Dockerfile: Remove Docker CLI installation and wrapper symlink
• entrypoint.sh: Remove Docker socket setup and docker group logic
• docker-manager.ts: Remove socket mount, DOCKER_HOST/DOCKER_CONTEXT env vars, .docker config dir creation

CI/CD

• Remove test-docker-egress job from test-integration.yml
• Remove docker-in-docker test from test-examples.yml

Documentation

Updated 14 files across docs/, docs-site/, CLAUDE.md, AGENTS.md, README.md, and workflow/skill files to remove all DinD references.

Security Impact

Eliminates attack surface:

• No Docker socket exposure
• No container escape via Docker API
• No privilege escalation via docker group

Original prompt

Plan: Complete Removal of Docker-in-Docker (DinD) Support

Overview

This plan details the complete removal of docker-in-docker functionality from gh-aw-firewall. After this change, agents will only connect to remote MCP servers and will not be able to spawn local Docker containers from within the agent container.

Scope Summary

• Files to DELETE: 3 files
• Files to MODIFY: 10+ files
• Test files to REMOVE: 1 test suite (350 lines)
• Documentation to UPDATE: 4+ files

---

Phase 1: Remove Core DinD Implementation

1.1 DELETE containers/agent/docker-wrapper.sh

File: containers/agent/docker-wrapper.sh (101 lines)

This script intercepts docker run commands and injects network/proxy configuration. Remove entirely.

1.2 MODIFY containers/agent/Dockerfile

File: containers/agent/Dockerfile

Remove Docker CLI installation (lines 19-25):

# DELETE: Install Docker CLI for MCP servers that run as containers
install -m 0755 -d /etc/apt/keyrings && \
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
...
apt-get install -y docker-ce-cli && \

Remove docker-wrapper setup (lines 39-49):

# DELETE: Copy iptables setup script, docker wrapper, and PID logger
COPY docker-wrapper.sh /usr/local/bin/docker-wrapper.sh
...
# DELETE: Install docker wrapper to intercept docker commands
RUN mv /usr/bin/docker /usr/bin/docker-real && \
    ln -s /usr/local/bin/docker-wrapper.sh /usr/bin/docker

1.3 MODIFY containers/agent/entrypoint.sh

File: containers/agent/entrypoint.sh

Remove Docker socket setup (lines 101-114):

# DELETE: Setup Docker socket permissions if Docker socket is mounted
# This allows MCP servers that run as Docker containers to work
# Store DOCKER_GID once to avoid redundant stat calls
DOCKER_GID=""
if [ -S /var/run/docker.sock ]; then
  echo "[entrypoint] Configuring Docker socket access..."
  # Get the GID of the docker socket (store once)
  DOCKER_GID=$(stat -c '%g' /var/run/docker.sock)
  # Create docker group with same GID as host's docker socket
  if ! getent group docker > /dev/null 2>&1; then
    groupadd -g "$DOCKER_GID" docker || true
  fi
  echo "[entrypoint] Docker socket configured (GID: $DOCKER_GID)"
fi

Remove DISABLE_DOCKER_ACCESS handling and docker group assignment (lines 129-145):

# DELETE: Add awfuser to docker group for Docker socket access
# This must be done after the docker group is created
# Security note: This grants awfuser access to the Docker daemon, which provides
# significant privileges. To disable this for untrusted workloads, set DISABLE_DOCKER_ACCESS=true
if [ "${DISABLE_DOCKER_ACCESS}" = "true" ]; then
  if [ -S /var/run/docker.sock ]; then
    echo "[entrypoint] Docker socket detected, but DISABLE_DOCKER_ACCESS is set to 'true'. Skipping docker group addition for awfuser."
  fi
else
  if [ -S /var/run/docker.sock ] && [ -n "$DOCKER_GID" ]; then
    if getent group docker > /dev/null 2>&1; then
      usermod -aG docker awfuser 2>/dev/null || true
      echo "[entrypoint] Added awfuser to docker group (GID: $DOCKER_GID)"
      echo "[entrypoint] NOTE: awfuser has Docker socket access. Set DISABLE_DOCKER_ACCESS=true to prevent this."
    fi
  fi
fi

1.4 MODIFY src/docker-manager.ts

File: src/docker-manager.ts

Remove from EXCLUDED_ENV_VARS set (lines 203-205):

// DELETE:
'DOCKER_HOST',    // Must use container's socket path
'DOCKER_CONTEXT', // Must use default context
'DOCKER_CONFIG',  // Must use clean config

Remove DOCKER_HOST and DOCKER_CONTEXT env vars (lines 224-225):

// DELETE:
DOCKER_HOST: 'unix:///var/run/docker.sock',
DOCKER_CONTEXT: 'default',

Remove Docker socket mount (lines 267-268):

// DELETE: Mount Docker socket for MCP servers that need to run containers
'/var/run/docker.sock:/var/run/docker.sock:rw',

Remove clean Docker config mounts (lines 270-273):

// DELETE: Clean Docker config directory to prevent reading host context
`${config.workDir}/.docker:/workspace/.docker:rw`,
`${config.workDir}/.docker:${process.env.HOME}/.docker:rw`,

Remove Docker config directory creation (lines 381-396 in writeConfigs()):

// DELETE: Create a clean Docker config directory to prevent host's Docker context from being used
const dockerConfigDir = path.join(config.workDir, '.docker');
if (!fs.existsSync(dockerConfigDir)) {
  fs.mkdirSync(dockerConfigDir, { recursive: true });
}

// DELETE: Write a minimal Docker config that uses default context
const dockerConfig = {
  currentContext: 'default',
};
fs.writeFileSync(
  path.join(dockerConfigDir, 'config.json'),
  JSON.stringify(dockerConfig, null, 2)
);
logger.debug(`Docker config written to: ${dockerConfigDir}/config.json`);

---

Phase 2: Remove Tests

2.1 DELETE tests/integration/docker-egress.test.ts

File: `tests/in...

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Test Coverage Report

Metric	Coverage	Covered/Total
Lines	77.03%	1275/1655
Statements	77.09%	1306/1694
Functions	77.04%	141/183
Branches	69.24%	430/621

Coverage Thresholds

The project has the following coverage thresholds configured:

• Lines: 38%
• Statements: 38%
• Functions: 35%
• Branches: 30%

---

Coverage report generated by `npm run test:coverage`

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

Smoke Test Results

Last 2 Merged PRs:

• Merge pull request Improve links in readme to AW project #1 from githubnext/idan/improve-readme-aw-callout

Test Results:

• ✅ GitHub MCP: Retrieved PR history
• ✅ File Writing: Created test file successfully
• ✅ Bash Tool: Verified file contents

Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #205 🗺️

[Copilot]

Pull request overview

This PR removes all Docker-in-Docker (DinD) functionality from the firewall, transitioning to an architecture where agents only connect to remote MCP servers and cannot spawn local Docker containers. This change eliminates a significant attack surface by removing Docker socket exposure, container escape vectors, and privilege escalation opportunities via the docker group.

Changes:

• Removed Docker CLI installation, docker-wrapper.sh interception script, and all Docker socket mounting logic
• Deleted docker-egress.test.ts (349 lines) and docker-in-docker.sh example
• Updated 14 documentation files to remove DinD references and related troubleshooting
• Removed test-docker-egress CI job and docker-in-docker example test

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
containers/agent/Dockerfile	Removed Docker CLI installation and wrapper symlink setup
containers/agent/entrypoint.sh	Removed Docker socket permissions and docker group configuration
containers/agent/docker-wrapper.sh	Deleted Docker command interceptor script
src/docker-manager.ts	Removed Docker socket mount, DOCKER_HOST/DOCKER_CONTEXT env vars, and .docker config creation
src/docker-manager.test.ts	Removed test assertions for Docker socket mounts and .docker config
src/types.ts	Updated JSDoc to remove Docker socket reference
src/cli.ts	Updated --env-all help text to remove DOCKER_HOST reference
tests/integration/docker-egress.test.ts	Deleted entire DinD security test suite
tests/integration/volume-mounts.test.ts	Renumbered tests after removing Docker socket test
examples/docker-in-docker.sh	Deleted DinD example script
examples/README.md	Removed docker-in-docker.sh from examples table
docs/usage.md	Removed Docker-in-Docker examples and --network host warnings
docs/troubleshooting.md	Removed DinD troubleshooting section and docker-wrapper.log reference
docs/environment.md	Removed DOCKER_HOST/DOCKER_CONTEXT/DOCKER_CONFIG from excluded variables list
docs/architecture.md	Removed Docker CLI, socket mount, and wrapper references
docs-site/src/content/docs/reference/security-architecture.md	Removed docker-wrapper.sh section and spawned container bypass examples
docs-site/src/content/docs/reference/cli-reference.md	Removed Docker socket from default mounts list
README.md	Removed Docker-in-Docker support from features list
CLAUDE.md	Removed MCP configuration section and Docker wrapper references
AGENTS.md	Removed Docker CLI, socket mount, and wrapper references
.github/workflows/test-integration.yml	Removed test-docker-egress job
.github/workflows/test-examples.yml	Removed docker-in-docker.sh test
.github/workflows/security-guard.md	Removed Docker wrapper from security components list
.github/workflows/firewall-escape-test.md	Removed docker-wrapper.sh from source files list and wrapper question from architecture section
.claude/skills/debug-firewall/SKILL.md	Removed docker-wrapper.log references from troubleshooting

Comments suppressed due to low confidence (2)

docs-site/src/content/docs/reference/security-architecture.md:65

• The 'Spawned Containers' subgraph should be removed from the architecture diagram as docker-in-docker functionality is being eliminated. This includes the associated edges showing AGENT spawning CHILD and CHILD traffic routing.

            subgraph "Spawned Containers"
                CHILD["docker run ..."]
            end

docs-site/src/content/docs/reference/security-architecture.md:93

• The reference to 'containers we didn't create directly' and 'When the agent runs docker run, the spawned container joins awf-net' should be removed or reworded. With DinD removal, the agent no longer spawns containers. The description should focus on the DOCKER-USER chain enforcing rules for the awf-net network without mentioning spawned containers.

**Host iptables (DOCKER-USER chain)** — The outermost defense. Docker evaluates DOCKER-USER rules *before* container-specific chains, making it the right place to catch traffic from containers we didn't create directly. When the agent runs `docker run`, the spawned container joins `awf-net` and its egress hits DOCKER-USER where we route it through the proxy.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.