Fix browser library ABI compatibility across runner chroots by Copilot · Pull Request #10402 · github/gh-aw-firewall

Copilot · 2026-10-21T13:59:34Z

AWF injected Ubuntu 26.04 browser libraries into an Ubuntu 24.04 runner chroot, causing Chrome launch to fail on unavailable GLIBC_2.43 symbols.

Compatible payload: Build browser dependencies separately on pinned Ubuntu 22.04, the oldest supported runner. Capture the complete dependency closure, including base-image packages, while excluding libc, its loader, and compiler runtimes.
Fallback-only staging: Stage only libraries missing inside the chroot, preserving newer runner libraries and tools. Keep native image packages for non-chroot execution.
Regression coverage: Add real-chroot Chrome launches on Ubuntu 22.04 and 24.04, covering native libraries, forced fallback staging, and runner GLib compatibility.

Firewall, proxy, and capability restrictions remain unchanged.

Fixes Browser library injection requires GLIBC_2.43 on an older chroot runtime (AWF v0.28.70) #10385

Copilot

🔵 Needs a closer look

Session-wide library resolution changes need human review of supported host compatibility and real-chroot validation.

3 open issues

What changed in this PR

Addresses browser ABI mismatches between AWF’s agent image and runner chroots by separating fallback libraries from native image dependencies.

Changes:

Builds the fallback browser payload on pinned Ubuntu 22.04.
Adds missing-library staging while retaining native packages for non-chroot execution.
Adds real Chrome launch coverage and compatibility documentation.

File	Description
`tests/integration/chroot-browser.test.ts`	Tests native and forced-fallback Chrome launches.
`tests/entrypoint-phase-functions.test.sh`	Checks payload staging and native-library preservation.
`scripts/ci/agent-dockerfile-browser-deps.test.ts`	Checks payload construction and dependency capture.
`docs/troubleshooting.md`	Documents recovery from browser libc mismatches.
`docs/agent-images.md`	Explains fallback payload compatibility.
`docs-site/src/content/docs/reference/agent-images.md`	Updates published browser-library guidance.
`containers/agent/entrypoint.sh`	Selectively stages fallback libraries.
`containers/agent/Dockerfile`	Builds an independent Ubuntu 22.04 payload.
`.github/workflows/test-chroot.yml`	Adds browser testing on Ubuntu 22.04 and 24.04.

_{Review effort: Max}

+        # Resolve symlinks inside the chroot, not against the image filesystem.
+        if chroot /host /bin/test -f "$lib" 2>/dev/null; then
+          continue
+        fi


+    apt-get -o Acquire::Retries=3 update && \
+    apt-get -o Acquire::Retries=3 install -y --no-install-recommends $BROWSER_PKGS && \


+    [ -z "${BROWSER_LD_LIBRARY_PATH}" ]
+    [ ! -e "${staged_lib}" ]
+    [ "$(cat "${host_root}${fake_lib}")" = "newer-runner-library" ]


lpcox · 2026-10-21T15:05:48Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-21T15:11:44Z

@copilot address review feedback

Addressed in commit 0a476ef.

github-actions · 2026-10-21T15:33:14Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-21T15:33:35Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-10402 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit cb187fa

github-actions · 2026-10-21T15:40:40Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.39%	93.39%	➡️ +0.00%
Statements	91.83%	91.83%	➡️ +0.00%
Functions	90.98%	90.98%	➡️ +0.00%
Branches	85.87%	85.87%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/enclave/host-executor-server.ts`	91.0% → 91.0% (+0.00%)	89.7% → 90.0% (+0.29%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

lpcox · 2026-10-21T16:11:01Z

@copilot merge main and resolve conflicts

…-issue Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-21T16:14:52Z

@copilot merge main and resolve conflicts

Merged main into the branch in merge commit 6bbbe7f; there were no conflicts.

lpcox · 2026-10-21T16:39:55Z

@copilot fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/39633049989/job/119336266750?pr=10402

Copilot · 2026-10-21T16:54:21Z

@copilot fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/39633049989/job/119336266750?pr=10402

Updated the browser integration test to match the runner’s loader-resolved native library path. Commit: 0f1d1a0.

Initial plan

15303b1

Copilot AI assigned Copilot and lpcox Oct 21, 2026

Copilot started work on behalf of lpcox October 21, 2026 13:59

View session

Copilot AI linked an issue Oct 21, 2026 that may be closed by this pull request

Browser library injection requires GLIBC_2.43 on an older chroot runtime (AWF v0.28.70) #10385

Closed

Copilot AI added 2 commits October 21, 2026 14:07

fix: build staged browser libraries for supported runner libc

5140ba1

fix: preserve runner libraries and stage complete browser fallbacks

c886a78

Copilot AI changed the title ~~[WIP] Fix browser library injection ABI mismatch for AWF~~ Fix browser library ABI compatibility across runner chroots Oct 21, 2026

Copilot finished work on behalf of lpcox October 21, 2026 14:30

Copilot AI requested a review from lpcox October 21, 2026 14:30

lpcox marked this pull request as ready for review October 21, 2026 14:37

Copilot AI max review requested due to automatic review settings October 21, 2026 14:37

Copilot started reviewing on behalf of lpcox October 21, 2026 14:42

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Copilot started work on behalf of lpcox October 21, 2026 15:06

View session

fix: resolve browser fallbacks by loader soname

0a476ef

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 21, 2026 15:14

Copilot started work on behalf of lpcox October 21, 2026 16:11

View session

Merge remote-tracking branch 'origin/main' into copilot/resolve-glibc…

6bbbe7f

…-issue Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 21, 2026 16:15

Copilot started work on behalf of lpcox October 21, 2026 16:40

View session

test: align browser library assertion with loader path

0f1d1a0

Copilot finished work on behalf of lpcox October 21, 2026 16:54

lpcox merged commit bb3de8d into main Oct 21, 2026
32 of 33 checks passed

lpcox deleted the copilot/resolve-glibc-issue branch October 21, 2026 17:26

Navigation Menu

Repository navigation

Fix browser library ABI compatibility across runner chroots - #10402

Fix browser library ABI compatibility across runner chroots#10402
lpcox merged 6 commits into
mainfrom
copilot/resolve-glibc-issue

Copilot AI commented Oct 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

lpcox commented Oct 21, 2026

Uh oh!

Copilot AI commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

lpcox commented Oct 21, 2026

Uh oh!

Copilot AI commented Oct 21, 2026

Uh oh!

lpcox commented Oct 21, 2026

Uh oh!

Copilot AI commented Oct 21, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		apt-get -o Acquire::Retries=3 update && \
		apt-get -o Acquire::Retries=3 install -y --no-install-recommends $BROWSER_PKGS && \

Conversation

Copilot AI commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

lpcox commented Oct 21, 2026

Uh oh!

Copilot AI commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

lpcox commented Oct 21, 2026

Uh oh!

Copilot AI commented Oct 21, 2026

Uh oh!

lpcox commented Oct 21, 2026

Uh oh!

Copilot AI commented Oct 21, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Oct 21, 2026 •

edited

Loading

github-actions Bot commented Oct 21, 2026 •

edited

Loading

github-actions Bot commented Oct 21, 2026 •

edited

Loading

github-actions Bot commented Oct 21, 2026 •

edited

Loading