fix: prevent .cargo volume/tmpfs mount conflict in chroot mode

[Claude]

Docker fails when the same path is mounted both as a volume and tmpfs. In chroot mode with credential hiding enabled (default), ~/.cargo was mounted twice:

• Volume mount at line 507 for Rust binary access
• Tmpfs mount at line 746 for credential protection

Changes

• Skip ~/.cargo volume mount when allowFullFilesystemAccess=false (default)
• Add comment explaining the conditional logic
• Add tests verifying no mount conflict in default security mode
• Add tests verifying mount behavior with allowFullFilesystemAccess=true

Behavior

Default (secure mode):

• ~/.cargo hidden via tmpfs only
• Rust binaries inaccessible (acceptable trade-off for credential protection)

With --allow-full-filesystem-access:

• Blanket /:/host:rw mount provides access to everything including ~/.cargo
• No tmpfs credential hiding (user opted out of security)

// Only mount .cargo when user explicitly disabled credential hiding
if (fs.existsSync(hostCargoDir) && config.allowFullFilesystemAccess) {
  agentVolumes.push(`${hostCargoDir}:/host${hostCargoDir}:ro`);
}

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

[github-actions]

Chroot tests failed Smoke Chroot failed - See logs for details.

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

[github-actions]

Chroot tests failed Smoke Chroot failed - See logs for details.

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

[Copilot]

Pull request overview

This pull request fixes a Docker mount conflict where ~/.cargo was being mounted as both a volume and tmpfs in chroot mode with credential hiding enabled (the default configuration). The PR also includes unrelated changes to stopContainers() that add fallback logic for cleaning up containers when the docker-compose.yml file is missing.

Changes:

• Conditional .cargo volume mount: only mount when allowFullFilesystemAccess=true to prevent conflict with tmpfs credential hiding
• Defensive stopContainers implementation: fall back to stopping containers by name if docker-compose.yml is missing

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/docker-manager.ts	Added config.allowFullFilesystemAccess check to .cargo volume mount (line 507) to prevent volume/tmpfs conflict; added fallback logic in stopContainers() to stop containers by name when compose file is missing (lines 1304-1333)
src/docker-manager.test.ts	Added two test cases verifying .cargo mount behavior with different allowFullFilesystemAccess settings (lines 658-694)

Comments suppressed due to low confidence (2)

src/docker-manager.ts:1330

• The fallback path only removes containers but doesn't clean up associated volumes and networks. The normal path uses docker compose down -v which removes volumes, but the fallback only uses docker rm -f which leaves volumes and networks orphaned. Consider also cleaning up the network (awf-net) and volumes in the fallback path, or document this limitation.

      // Stop and remove containers by name
      const containerNames = ['awf-agent', 'awf-squid'];
      for (const name of containerNames) {
        try {
          // Check if container exists
          const { stdout } = await execa('docker', ['ps', '-aq', '-f', `name=^${name}$`]);
          if (stdout.trim()) {
            logger.debug(`Stopping container: ${name}`);
            await execa('docker', ['rm', '-f', name], { stdio: 'inherit' });
          }
        } catch (err) {
          logger.debug(`Could not stop container ${name}:`, err);
        }
      }

src/docker-manager.ts:1330

• The new fallback logic in stopContainers (lines 1314-1330) lacks test coverage. Consider adding tests for scenarios where docker-compose.yml is missing or workDir doesn't exist, to verify the fallback container stopping logic works correctly.

      // Fallback: compose file missing, stop containers by name
      logger.debug('Compose file not found, stopping containers by name');

      // Stop and remove containers by name
      const containerNames = ['awf-agent', 'awf-squid'];
      for (const name of containerNames) {
        try {
          // Check if container exists
          const { stdout } = await execa('docker', ['ps', '-aq', '-f', `name=^${name}$`]);
          if (stdout.trim()) {
            logger.debug(`Stopping container: ${name}`);
            await execa('docker', ['rm', '-f', name], { stdio: 'inherit' });
          }
        } catch (err) {
          logger.debug(`Could not stop container ${name}:`, err);
        }
      }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The changes to stopContainers() are not mentioned in the PR title or description. The PR is titled "fix: prevent .cargo volume/tmpfs mount conflict in chroot mode" and the description only discusses the .cargo mount fix. The stopContainers changes appear to be a separate defensive improvement to handle missing docker-compose.yml files by falling back to stopping containers by name. Consider splitting this into a separate PR or updating the PR description to document this additional change.

This issue also appears in the following locations of the same file:

• line 1317
• line 1314

[Copilot]

Consider making the comment more explicit about WHY the mount is skipped. The current comment explains the condition but not the underlying reason. Suggestion: "SKIP if allowFullFilesystemAccess is false to avoid Docker conflict (credentials will be hidden via tmpfs mount instead - Docker doesn't allow the same path to be both a volume and tmpfs)"

Suggested change

	// SKIP if allowFullFilesystemAccess is false (credentials will be hidden via tmpfs)
	// SKIP if allowFullFilesystemAccess is false to avoid Docker conflict:
	// credentials will instead be hidden via a tmpfs mount, and Docker does not
	// allow the same path to be both a volume and a tmpfs.