Add compiler support for AWF `--network-isolation` topology mode (ARC/DinD-compatible egress) by Copilot · Pull Request #41088 · github/gh-aw

Copilot · 2026-06-23T18:15:27Z

AWF added an opt-in topology-based egress model (--network-isolation) that avoids host iptables/NET_ADMIN, which is required for ARC runners with DinD. This PR teaches the compiler to emit isolation-aware workflow/config/runtime wiring for gateway and DIFC/CLI proxy paths.

Frontmatter + compiler threading
- Added sandbox.agent.network-isolation to workflow schema and parsing.
- Threaded the flag through sandbox/engine workflow data so generation paths can switch behavior deterministically.
AWF config emission (awf --config)
- Extended emitted AWF network config with:
  - network.isolation: true
  - network.topologyAttach: [...]
- Added topology attach list generation for MCP gateway and CLI proxy containers when applicable.
AWF argument behavior under isolation
- In isolation mode, compiler now omits host-network assumptions:
  - no --enable-host-access
  - no --allow-host-ports ...
- Switches CLI-proxy target from host loopback addressing to internal topology addressing:
  - --difc-proxy-host awmg-cli-proxy:18443
Gateway + DIFC/CLI proxy runtime topology
- MCP gateway container switches from --network host to bridge mode under isolation.
- Host loopback host-injection (--add-host host.docker.internal:127.0.0.1) is skipped in isolation mode.
- Internal MCP gateway addressing is used (awmg-mcpg) when isolation is enabled.
- DIFC/CLI proxy startup scripts now support isolation-mode bridge launch with localhost-published 18443 for host pre-steps.
Schema sync
- Updated embedded AWF config schema to include network.isolation and network.topologyAttach, including the topologyAttach => isolation=true constraint.

# workflow frontmatter
sandbox:
  agent:
    id: awf
    network-isolation: true

// emitted awf-config.json fragment
{
  "network": {
    "allowDomains": ["github.com"],
    "isolation": true,
    "topologyAttach": ["awmg-mcpg", "awmg-cli-proxy"]
  }
}

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Pull request overview

This PR adds compiler support for AWF’s opt-in --network-isolation topology mode, threading a new sandbox.agent.network-isolation frontmatter flag through workflow data so generation can emit isolation-aware AWF config, arguments, MCP gateway wiring, and proxy startup behavior (ARC/DinD-friendly; avoids host iptables/NET_ADMIN).

Changes:

Added sandbox.agent.network-isolation to parsing + workflow schema, and threaded it through generation paths.
Updated MCP gateway generation to use internal container addressing (awmg-mcpg) and bridge networking when isolation is enabled.
Extended emitted awf --config JSON with network.isolation and network.topologyAttach, and adjusted AWF args / proxy scripts for isolation mode.

Show a summary per file

File	Description
pkg/workflow/schemas/awf-config.schema.json	Adds `network.isolation` and `network.topologyAttach` with a schema constraint tying topology attachments to isolation.
pkg/workflow/sandbox.go	Extends `AgentSandboxConfig` with `NetworkIsolation` frontmatter field.
pkg/workflow/mcp_setup_generator.go	Switches MCP gateway domain + docker network mode based on isolation flag.
pkg/workflow/mcp_setup_generator_test.go	Adds an integration test covering isolation-mode MCP gateway command/domain output.
pkg/workflow/frontmatter_extraction_security.go	Parses `sandbox.agent.network-isolation` from frontmatter object format.
pkg/workflow/frontmatter_extraction_security_test.go	Adds a unit test for `network-isolation` extraction.
pkg/workflow/firewall.go	Introduces `isAWFNetworkIsolationEnabled` helper used by generation.
pkg/workflow/firewall_default_enablement_test.go	Adds tests for `isAWFNetworkIsolationEnabled`.
pkg/workflow/compiler_difc_proxy.go	Threads an isolation env var into DIFC/CLI proxy startup steps.
pkg/workflow/awf_helpers.go	Adjusts AWF arg emission under isolation (skip host-access flags; use internal CLI proxy target).
pkg/workflow/awf_helpers_test.go	Adds tests for isolation behavior in AWF arg generation.
pkg/workflow/awf_config.go	Emits `network.isolation` and `network.topologyAttach` into generated AWF config JSON.
pkg/workflow/awf_config_test.go	Adds tests for isolation-mode AWF config JSON and topology attach list.
pkg/parser/schemas/main_workflow_schema.json	Adds `sandbox.agent.network-isolation` to the main workflow schema.
actions/setup/sh/start_difc_proxy.sh	Adds isolation-mode bridge launch with localhost-published 18443.
actions/setup/sh/start_cli_proxy.sh	Adds isolation-mode bridge launch with localhost-published 18443.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 16/16 changed files
Comments generated: 3

Copilot · 2026-06-23T20:24:05Z

 	if domain == "" {
 		if workflowData.SandboxConfig.Agent != nil && workflowData.SandboxConfig.Agent.Disabled {
 			domain = "localhost"
+		} else if isAWFNetworkIsolationEnabled(workflowData) {
+			domain = "awmg-mcpg"
 		} else {
 			domain = "host.docker.internal"
 		}


Fixed in commit Fix network-isolation issues: host domain, port publishing, container cleanup. The hostDomain logic now also forces "localhost" when isAWFNetworkIsolationEnabled(workflowData) is true, so MCP_GATEWAY_HOST_DOMAIN is always "localhost" in isolation mode while MCP_GATEWAY_DOMAIN remains "awmg-mcpg" for container-to-container routing.

Copilot · 2026-06-23T20:24:05Z

+	containerCmd.WriteString("docker run -i --rm")
+	if isAWFNetworkIsolationEnabled(workflowData) {
+		containerCmd.WriteString(" --network bridge")
+	} else {
+		containerCmd.WriteString(" --network host")
+	}


Fixed in the same commit. When isolation is enabled the docker run command now includes -p 127.0.0.1:${MCP_GATEWAY_PORT}:${MCP_GATEWAY_PORT} immediately after --network bridge, so host-side clients (Gemini CLI, etc.) can reach the gateway at localhost:${MCP_GATEWAY_PORT}.

Copilot · 2026-06-23T20:24:05Z

 echo "Starting DIFC proxy container: $CONTAINER_IMAGE"

-docker run -d --name awmg-proxy --network host \
+DOCKER_NETWORK_ARGS=(--network host)
+if [ "${GH_AW_NETWORK_ISOLATION:-false}" = "true" ]; then
+  DOCKER_NETWORK_ARGS=(--network bridge -p 127.0.0.1:18443:18443)
+fi
+
+docker run -d --name awmg-proxy "${DOCKER_NETWORK_ARGS[@]}" \


Fixed in the same commit. Added docker rm -f awmg-proxy 2>/dev/null || true before the docker run, so any leftover container from a cancelled or retried job is cleaned up before the new one starts.

pelikhan · 2026-06-23T20:06:55Z

@copilot run pr-finisher skill

… cleanup Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-23T20:24:14Z

@copilot run pr-finisher skill

Done. Addressed all three review threads:

MCP_GATEWAY_HOST_DOMAIN in isolation mode — now always set to "localhost" when isolation is enabled, so Gemini CLI and other host-side tools resolve correctly.
Gateway port not published to host — added -p 127.0.0.1:${MCP_GATEWAY_PORT}:${MCP_GATEWAY_PORT} to the bridge-mode docker run so host clients can reach the gateway.
awmg-proxy name conflict on retried jobs — added docker rm -f awmg-proxy 2>/dev/null || true before container start in start_difc_proxy.sh.

Local validation (fmt, lint, test-unit, recompile) all pass. CI needs a human re-trigger after the push.

Initial plan

4920ee7

Copilot AI assigned Copilot and lpcox Jun 23, 2026

Copilot started work on behalf of lpcox June 23, 2026 18:15 View session

Add AWF network-isolation compiler support

073b13f

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add compiler support for AWF --network-isolation~~ Add compiler support for AWF --network-isolation topology mode (ARC/DinD-compatible egress) Jun 23, 2026

Copilot finished work on behalf of lpcox June 23, 2026 18:43

Copilot AI requested a review from lpcox June 23, 2026 18:43

github-actions Bot mentioned this pull request Jun 23, 2026

[aw] No-Op Runs #39849

Open

pelikhan marked this pull request as ready for review June 23, 2026 19:59

Copilot AI review requested due to automatic review settings June 23, 2026 19:59

Merge branch 'main' into copilot/add-network-isolation-support

38f01e7

Copilot started reviewing on behalf of pelikhan June 23, 2026 20:00 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan June 23, 2026 20:07 View session

Fix network-isolation issues: host domain, port publishing, container…

ee93964

… cleanup Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 23, 2026 20:24

Copilot AI requested a review from pelikhan June 23, 2026 20:24

github-actions Bot mentioned this pull request Jun 23, 2026

[Contribution Check Report] Contribution Check — 2026-06-23 #40912

Open

lpcox merged commit 3e56ea8 into main Jun 23, 2026
29 checks passed

lpcox deleted the copilot/add-network-isolation-support branch June 23, 2026 21:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add compiler support for AWF `--network-isolation` topology mode (ARC/DinD-compatible egress)#41088

Add compiler support for AWF `--network-isolation` topology mode (ARC/DinD-compatible egress)#41088
lpcox merged 4 commits into
mainfrom
copilot/add-network-isolation-support

Copilot AI commented Jun 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jun 23, 2026

Uh oh!

Copilot AI Jun 23, 2026

Uh oh!

Copilot AI Jun 23, 2026

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

Copilot AI commented Jun 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

Copilot AI commented Jun 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jun 23, 2026 •

edited

Loading