feat: hide /tmp/gh-aw/mcp-logs/ from agent containers by Copilot · Pull Request #706 · github/gh-aw-firewall

Copilot · 2026-02-12T02:13:42Z

MCP server logs in /tmp/gh-aw/mcp-logs/ may contain sensitive workflow data. This PR adds the directory to the credential hiding mechanism via /dev/null overlay mounts.

Changes

src/docker-manager.ts

Added /tmp/gh-aw/mcp-logs to credentialFiles array (normal mode)
Added /dev/null:/host/tmp/gh-aw/mcp-logs:ro to chrootCredentialFiles array (chroot mode)

tests/integration/credential-hiding.test.ts

Test 13: Verifies normal mode hiding (expects "Not a directory" error)
Test 14: Verifies chroot mode hiding at /host path
Test 15: Verifies file access within directory fails

When /dev/null is mounted over a directory path, any attempt to access it returns "Not a directory" because /dev/null is a character device, effectively hiding all contents from the agent container in both filesystem access modes.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

github-actions · 2026-02-12T02:17:20Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-12T02:17:24Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-12T02:20:39Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

All C++ projects built successfully with CMake and make.

AI generated by Build Test C++

github-actions · 2026-02-12T02:20:49Z

Bun Build Test Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS ✅

All Bun projects successfully installed dependencies and passed tests.

AI generated by Build Test Bun

github-actions · 2026-02-12T02:20:49Z

Smoke Test Results

Last 2 merged PRs:

fix(docker): mount CLI state directories in chroot mode for Copilot and Claude #702: fix(docker): mount CLI state directories in chroot mode for Copilot and Claude
[agentics] CI Doctor failed #701: fix: restrict /proc/self/environ and docker-compose.yml secret exposure

Test Results:

✅ GitHub MCP: Retrieved PR list
✅ Playwright: Navigated to github.com, title confirmed
✅ File Write: Created test file successfully
✅ Bash: File verified

Status: PASS

AI generated by Smoke Claude

github-actions · 2026-02-12T02:20:55Z

Node.js Build Test Results

Project	Install	Tests	Status
clsx	✅	PASS	PASS
execa	✅	PASS	PASS
p-limit	✅	PASS	PASS

Overall: PASS ✅

All Node.js projects successfully installed dependencies and passed their test suites.

AI generated by Build Test Node.js

github-actions · 2026-02-12T02:21:04Z

Go Build Test Results

Project	Download	Tests	Status
color	✅	1/1	PASS
env	✅	1/1	PASS
uuid	✅	1/1	PASS

Overall: PASS ✅

All Go projects built and tested successfully.

AI generated by Build Test Go

github-actions · 2026-02-12T02:21:05Z

Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

All Deno tests completed successfully.

AI generated by Build Test Deno

github-actions · 2026-02-12T02:21:22Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS ✅

All .NET projects successfully restored, built, and ran with expected output.

AI generated by Build Test .NET

github-actions · 2026-02-12T02:21:24Z

Build Test: Rust - Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: PASS ✅

All Rust projects built successfully and all tests passed.

AI generated by Build Test Rust

github-actions · 2026-02-12T02:21:24Z

Smoke Test Results

Last 2 Merged PRs:

PR fix(docker): mount CLI state directories in chroot mode for Copilot and Claude #702: fix(docker): mount CLI state directories in chroot mode for Copilot and Claude
PR feat: implement selective mounting to prevent credential exfiltration #681: feat: implement selective mounting to prevent credential exfiltration

Test Results:

✅ GitHub MCP: Retrieved merged PRs
✅ Playwright: Page title contains "GitHub"
✅ File Write: Created smoke test file
✅ Bash Tool: Verified file content

Overall Status: PASS

cc @Copilot

AI generated by Smoke Copilot

github-actions · 2026-02-12T02:21:46Z

Build Test: Java - Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS ✅

All Java projects compiled successfully and all tests passed.

AI generated by Build Test Java

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-02-12T04:22:52Z

Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

All Deno tests completed successfully.

AI generated by Build Test Deno

github-actions · 2026-02-12T04:22:59Z

Smoke Test Results

Last 2 Merged PRs:

fix: use tmpfs to hide /tmp/gh-aw/mcp-logs directory from containers #709: fix: use tmpfs to hide /tmp/gh-aw/mcp-logs directory from containers
fix: use 0o777 permissions for mcp-logs and squid-logs directories #710: fix: use 0o777 permissions for mcp-logs and squid-logs directories

Test Results:

✅ GitHub MCP: Retrieved merged PRs
✅ Playwright: Page title contains "GitHub"
✅ File Write: Created test file successfully
✅ Bash Tool: Verified file content

Overall Status: PASS

cc: @lpcox @Copilot

AI generated by Smoke Copilot

github-actions · 2026-02-12T04:23:01Z

Build Test: Bun - Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS ✅

All Bun projects built and tested successfully.

AI generated by Build Test Bun

github-actions · 2026-02-12T04:23:03Z

Build Test: Go - Results

All Go projects tested successfully! ✅

Project	Download	Tests	Status
color	✅	1/1	PASS
env	✅	1/1	PASS
uuid	✅	1/1	PASS

Overall: PASS

AI generated by Build Test Go

github-actions · 2026-02-12T04:23:11Z

Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: PASS ✅

All Rust projects built and tested successfully.

AI generated by Build Test Rust

github-actions · 2026-02-12T04:23:11Z

Build Test: Node.js - Results

Project	Install	Tests	Status
clsx	✅	PASS	PASS
execa	✅	PASS	PASS
p-limit	✅	PASS	PASS

Overall: PASS ✅

All Node.js projects built and tested successfully.

AI generated by Build Test Node.js

github-actions · 2026-02-12T04:23:13Z

.NET Build Test Results

All .NET projects built and ran successfully! ✅

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

Details

hello-world

Restore: ✅ Completed in 82ms
Build: ✅ 0 warnings, 0 errors (5.37s)
Run: ✅ Output: "Hello, World!"

json-parse

Restore: ✅ Completed in 703ms
Build: ✅ 0 warnings, 0 errors (1.27s)
Run: ✅ Successfully parsed JSON and displayed: "Name: AWF Test, Success: True"

AI generated by Build Test .NET

github-actions · 2026-02-12T04:23:18Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

All C++ projects built successfully.

AI generated by Build Test C++

github-actions · 2026-02-12T04:23:26Z

Smoke test results:
GitHub MCP (merged PRs: fix: use 0o777 permissions for mcp-logs and squid-logs directories; fix: use tmpfs to hide /tmp/gh-aw/mcp-logs directory from containers): ✅
safeinputs gh pr list: ✅
Playwright github.com title: ✅
Tavily search: ❌
File write: ✅
Bash cat: ✅
Discussion comment: ✅
Build npm ci && npm run build: ✅
Overall: FAIL

AI generated by Smoke Codex

github-actions · 2026-02-12T04:24:08Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	3.12.12	3.12.3	❌ NO
Node.js	v24.13.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall Status: ❌ Tests did not pass (2 mismatches detected)

The chroot mode is using Ubuntu 22.04 binaries which differ from the GitHub Actions runner's newer versions. This is expected behavior - chroot mode provides access to host-installed binaries for compatibility.

AI generated by Smoke Chroot

lpcox · 2026-02-12T04:36:40Z

@Mossaka can you take a look and merge? this prevents leaks from the mcp logs into awf

Copilot

Pull request overview

This PR aims to prevent sensitive MCP server logs under /tmp/gh-aw/mcp-logs/ from being readable inside agent containers by masking that path in the container filesystem.

Changes:

Add Docker Compose tmpfs mounts to shadow /tmp/gh-aw/mcp-logs (and /host/tmp/gh-aw/mcp-logs in chroot mode).
Ensure the host-side /tmp/gh-aw/mcp-logs directory exists with permissive permissions for log writers.
Add integration/unit tests to verify the directory is effectively unreadable from the agent container.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
`src/docker-manager.ts`	Adds tmpfs-based masking of the MCP logs directory and creates the host log directory with `0777`.
`tests/integration/credential-hiding.test.ts`	Adds integration coverage asserting MCP logs paths are not readable in normal and chroot modes.
`src/docker-manager.test.ts`	Adds a unit test asserting `/tmp/gh-aw/mcp-logs` is created with world-writable permissions.
`examples/basic-curl.sh`	Adds a minimal usage example script for running `curl` through AWF.

Comments suppressed due to low confidence (2)

src/docker-manager.ts:731

In normal mode with --allow-full-filesystem-access, the host is mounted at /host (/:/host:rw), but the tmpfs only covers /tmp/gh-aw/mcp-logs. That means the agent can still read the real logs via /host/tmp/gh-aw/mcp-logs. If the goal is to hide MCP logs regardless of mount mode, add a tmpfs entry for /host/tmp/gh-aw/mcp-logs whenever /host is mounted (e.g., when allowFullFilesystemAccess is true).

    tmpfs: config.enableChroot
      ? [
          '/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
          '/host/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
        ]
      : ['/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m'],

src/docker-manager.ts:730

The tmpfs mount options omit nodev. Even with capabilities dropped, adding nodev is a low-cost defense-in-depth hardening step for tmpfs mounts (prevents device nodes if capabilities/config change later).

          '/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
          '/host/tmp/gh-aw/mcp-logs:rw,noexec,nosuid,size=1m',
        ]

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-12T04:38:13Z

src/docker-manager.ts

+    // Hide /tmp/gh-aw/mcp-logs directory using tmpfs (empty in-memory filesystem)
+    // This prevents the agent from accessing MCP server logs while still allowing
+    // the host to write logs to /tmp/gh-aw/mcp-logs/ (e.g., /tmp/gh-aw/mcp-logs/safeoutputs/)
+    // For normal mode: hide /tmp/gh-aw/mcp-logs
+    // For chroot mode: hide both /tmp/gh-aw/mcp-logs and /host/tmp/gh-aw/mcp-logs
+    tmpfs: config.enableChroot


The PR description says this is hidden via /dev/null overlay mounts, but the implementation here uses Docker Compose tmpfs mounts. Please update the PR description (and any related docs) to match the actual behavior, or switch the implementation back to /dev/null if that’s the intended design.

This issue also appears in the following locations of the same file:

line 726

line 728

@copilot apply changes based on this feedback

Copilot · 2026-02-12T04:38:13Z

src/docker-manager.test.ts

+    it('should create /tmp/gh-aw/mcp-logs directory with world-writable permissions', async () => {
+      const config: WrapperConfig = {
+        allowedDomains: ['github.com'],
+        agentCommand: 'echo test',
+        logLevel: 'info',
+        keepContainers: false,
+        workDir: testDir,
+      };
+
+      try {
+        await writeConfigs(config);
+      } catch {
+        // May fail, but directory should still be created
+      }
+
+      // Verify /tmp/gh-aw/mcp-logs directory was created
+      expect(fs.existsSync('/tmp/gh-aw/mcp-logs')).toBe(true);
+      const stats = fs.statSync('/tmp/gh-aw/mcp-logs');
+      expect(stats.isDirectory()).toBe(true);
+      // Verify permissions are 0o777 (rwxrwxrwx) to allow non-root users to create subdirectories
+      expect((stats.mode & 0o777).toString(8)).toBe('777');
+    });


This test writes to a global host path (/tmp/gh-aw/mcp-logs) and assumes it can enforce 0777 permissions, which can be flaky if the directory already exists from prior runs (possibly owned by root) or tests run in parallel. Consider mocking fs.mkdirSync/chmodSync to assert the intended calls, or adding a test-only hook/config to redirect the MCP logs dir to a per-test temp directory.

PR #706 hid /tmp/gh-aw/mcp-logs/ from agent containers using tmpfs mounts but missed /tmp/gh-aw/mcp-config/, which may contain MCP server configuration with tokens and credentials (CVE-003 from issue #197). Apply the same tmpfs hiding pattern for mcp-config in both normal and chroot modes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add --allow-full-filesystem-access flag to docs/usage.md - Add link to docs/selective-mounting.md in README.md - Update AGENTS.md container architecture to reflect selective mounting default - Update docs/architecture.md with security features: - Selective mounting and credential protection - One-shot token library (LD_PRELOAD) - MCP logs directory protection Changes sync documentation with code from PRs: - #681 (selective mounting) - #706, #709, #710 (mcp-logs hiding) - #604, #640 (one-shot token library)

Initial plan

0eff01a

Copilot AI assigned Copilot and lpcox Feb 12, 2026

Copilot started work on behalf of lpcox February 12, 2026 02:13 View session

github-actions bot added the build-test-cpp label Feb 12, 2026

github-actions bot mentioned this pull request Feb 12, 2026

[agentics] No-Op Runs #676

Closed

github-actions bot added build-test-bun smoke-claude labels Feb 12, 2026

github-actions bot added the build-test-node label Feb 12, 2026

github-actions bot added the build-test-go label Feb 12, 2026

github-actions bot added the build-test-deno label Feb 12, 2026

github-actions bot added the build-test-dotnet label Feb 12, 2026

github-actions bot added build-test-rust smoke-copilot labels Feb 12, 2026

github-actions bot added the build-test-java label Feb 12, 2026

Copilot AI and others added 2 commits February 12, 2026 02:22

feat: hide /tmp/gh-aw/mcp-logs/ directory from agent container

8203261

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

test: improve mcp-logs tests to verify mount protection

ade525e

Copilot AI changed the title ~~[WIP] Add /tmp/gh-aw/mcp-logs/ to volume mounts nullification~~ feat: hide /tmp/gh-aw/mcp-logs/ from agent containers Feb 12, 2026

Mossaka marked this pull request as ready for review February 12, 2026 04:34

Copilot AI review requested due to automatic review settings February 12, 2026 04:34

Copilot started reviewing on behalf of Mossaka February 12, 2026 04:34 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

Copilot started work on behalf of lpcox February 12, 2026 04:39 View session

Mossaka approved these changes Feb 12, 2026

View reviewed changes

Mossaka merged commit 8d65bc9 into main Feb 12, 2026
96 of 97 checks passed

Mossaka deleted the copilot/add-temp-log-volume-mount branch February 12, 2026 04:40

Copilot stopped work on behalf of lpcox due to an error February 12, 2026 04:40
The session was cancelled by the user.

This was referenced Feb 12, 2026

fix: hide /tmp/gh-aw/mcp-config/ from agent containers #716

Closed

feat: add release highlights generator agentic workflow #197

Merged

github-actions bot mentioned this pull request Feb 12, 2026

[docs] docs: sync with selective mounting and security features #742

Closed

Mossaka mentioned this pull request Feb 12, 2026

[Security] --allow-full-filesystem-access bypasses MCP log hiding via /host mount #764

Open

Conversation

Copilot AI commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Bun Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Node.js Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Go Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Deno Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

.NET Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Build Test: Rust - Results

Uh oh!

github-actions bot commented Feb 12, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Build Test: Java - Results

Uh oh!

github-actions bot commented Feb 12, 2026

Deno Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Build Test: Bun - Results

Uh oh!

github-actions bot commented Feb 12, 2026

Build Test: Go - Results

Uh oh!

github-actions bot commented Feb 12, 2026

Rust Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Build Test: Node.js - Results

Uh oh!

github-actions bot commented Feb 12, 2026

.NET Build Test Results

Details

Uh oh!

github-actions bot commented Feb 12, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Chroot Version Comparison Results

Uh oh!

lpcox commented Feb 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Copilot AI commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading