fix: eliminate host binary dependency in setup-iptables for chroot mode #456
Conversation
Replace `head -n 1` with awk's NR==1 to avoid GLIBC version mismatch when running in chroot mode. In chroot mode, host binaries are mounted at /host/*, and setup-iptables.sh runs before the chroot happens. The host's head binary may require a newer GLIBC than available in the container (Ubuntu 22.04 has GLIBC 2.35, GitHub Actions runners have GLIBC 2.38+). This fixes the error: head: /lib/x86_64-linux-gnu/libc.so.6: version 'GLIBC_2.38' not found Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
|
@copilot please merge origin/main |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
✅ Coverage Check PassedOverall Coverage
Coverage comparison generated by |
Smoke Test Results (Claude)Last 2 Merged PRs:
Test Results:
Overall: FAIL (Playwright test could not run)
|
❌ Chroot Smoke Test FailedThe
AnalysisExpected behavior: When Actual behavior: The agent container is using its own installed binaries (Python 3.13.11, Node v24.13.0), not the host's. Possible Causes
Next StepsThis test failure needs investigation to determine why the chroot feature is not working as expected. The feature should provide transparent host binary access to avoid version mismatches between host and container environments.
|
Smoke Test ResultsLast 2 Merged PRs:
Tests:
Status: PASS cc @Mossaka
|
There was a problem hiding this comment.
Pull request overview
This PR fixes a binary compatibility issue in chroot mode by eliminating the dependency on the head command in setup-iptables.sh. When --enable-chroot is enabled and host binaries with different GLIBC versions are mounted at /host/*, external commands like head can fail. The fix consolidates line filtering into awk, reducing external dependencies.
Changes:
- Replaced
| awk '{ print $1 }' | head -n 1withawk 'NR==1 { print $1 }'to eliminate theheadbinary dependency in chroot mode
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Resolve Squid hostname to IP | ||
| SQUID_IP=$(getent hosts "$SQUID_HOST" | awk '{ print $1 }' | head -n 1) | ||
| # Use awk's NR to get first line to avoid host binary dependency in chroot mode | ||
| SQUID_IP=$(getent hosts "$SQUID_HOST" | awk 'NR==1 { print $1 }') |
There was a problem hiding this comment.
The awk command should include an exit statement after printing the first line to match the behavior of head -n 1 and avoid unnecessarily processing remaining input. Change awk 'NR==1 { print $1 }' to awk 'NR==1 { print $1; exit }'. While this is a minor efficiency issue since getent hosts typically returns few lines, it's a best practice and makes the intent clearer.
| SQUID_IP=$(getent hosts "$SQUID_HOST" | awk 'NR==1 { print $1 }') | |
| SQUID_IP=$(getent hosts "$SQUID_HOST" | awk 'NR==1 { print $1; exit }') |
The Smoke Chroot workflow fails when
setup-iptables.shcallshead, which resolves to the host's binary (GLIBC 2.38) before chroot enters, but the container only has GLIBC 2.35.Changes
head -n 1with awk's built-inNR==1line filtering incontainers/agent/setup-iptables.shContext
When
--enable-chrootis enabled, host binaries are mounted at/host/*beforesetup-iptables.shruns (line 115 of entrypoint.sh). Without absolute paths, commands can resolve to incompatible host binaries.This eliminates the GLIBC dependency chain and makes the script more portable across host/container boundary scenarios.
Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.