Problem
When a DinD (Docker-in-Docker) sidecar is configured at the workflow scope (e.g., DOCKER_HOST=tcp://localhost:2375), AWF-compiled workflows fail during container startup with:
[INFO] Set DOCKER_API_VERSION=1.54 (server current)
Error: Port 80 is not exposed from the container
Error: Add port mapping: -p <host_port>:80
Context
Original report: github/gh-aw#25511
Repro configuration:
services:
dind:
image: docker:dind
options: --privileged
ports:
- 2375:2375
env:
DOCKER_TLS_CERTDIR: ""
env:
DOCKER_HOST: tcp://localhost:2375Root Cause
When DOCKER_HOST points to a DinD daemon, the AWF docker compose commands run against the DinD daemon. The DinD daemon's port mapping behavior differs from the default Docker socket (/var/run/docker.sock): published ports are only accessible within the DinD network, not from the host runner. The AWF-generated docker-compose.yml does not expose port 80 as a host-mapped port (it's only used internally in the overlay network 172.30.0.0/24), but the DinD networking layer raises this error when attempting to set up port forwarding for its internal routing.
The getLocalDockerEnv() function in src/docker-manager.ts (line 69-84) clones process.env and normalizes DOCKER_HOST, but does not detect or adapt for DinD-mode Docker daemons.
Proposed Solution
- Detect DinD mode in
src/docker-manager.ts: In getLocalDockerEnv(), when DOCKER_HOST is set to a TCP address (e.g., tcp://localhost:2375), set a dind flag on the config.
- Adapt network configuration for DinD: When in DinD mode, modify the generated
docker-compose.yml in generateDockerCompose() (or src/docker-manager.ts) to:
- Use
network_mode: host for containers that need host-accessible ports, or
- Add explicit port mappings, or
- Use a DinD-compatible bridge network configuration.
- Add documentation: In
docs/environment.md, document the DinD compatibility flag and any required workflow configuration when using DinD sidecars alongside AWF.
- Integration test: Add a test case that validates AWF container startup when
DOCKER_HOST is set to a TCP address.
Generated by Firewall Issue Dispatcher · ● 2.1M · ◷
Problem
When a DinD (Docker-in-Docker) sidecar is configured at the workflow scope (e.g.,
DOCKER_HOST=tcp://localhost:2375), AWF-compiled workflows fail during container startup with:Context
Original report: github/gh-aw#25511
Repro configuration:
Root Cause
When
DOCKER_HOSTpoints to a DinD daemon, the AWFdocker composecommands run against the DinD daemon. The DinD daemon's port mapping behavior differs from the default Docker socket (/var/run/docker.sock): published ports are only accessible within the DinD network, not from the host runner. The AWF-generateddocker-compose.ymldoes not expose port 80 as a host-mapped port (it's only used internally in the overlay network172.30.0.0/24), but the DinD networking layer raises this error when attempting to set up port forwarding for its internal routing.The
getLocalDockerEnv()function insrc/docker-manager.ts(line 69-84) clonesprocess.envand normalizesDOCKER_HOST, but does not detect or adapt for DinD-mode Docker daemons.Proposed Solution
src/docker-manager.ts: IngetLocalDockerEnv(), whenDOCKER_HOSTis set to a TCP address (e.g.,tcp://localhost:2375), set adindflag on the config.docker-compose.ymlingenerateDockerCompose()(orsrc/docker-manager.ts) to:network_mode: hostfor containers that need host-accessible ports, ordocs/environment.md, document the DinD compatibility flag and any required workflow configuration when using DinD sidecars alongside AWF.DOCKER_HOSTis set to a TCP address.