[awf] DIFC proxy: containers run as root causing permission denied on shared rpc-messages.jsonl

[lpcox]

Problem

When DIFC proxy is active, start_difc_proxy.sh and start_cli_proxy.sh launch their containers without a --user flag, defaulting to root (UID 0). The MCP Gateway runs with --user "$(id -u):$(id -g)" (UID 1001) and cannot write to the root-owned rpc-messages.jsonl in the shared /tmp/gh-aw/mcp-logs/ volume. The agent job succeeds but the "Parse MCP Gateway logs" post-step calls core.setFailed() on the zero-byte file.

Context

Original report: github/gh-aw#33892

Regression introduced in #22563 (DIFC proxy added without --user); became a hard failure in #33358 (zero-byte file now fatal).

Root Cause

actions/setup/sh/start_difc_proxy.sh:42 and actions/setup/sh/start_cli_proxy.sh:43 omit --user "$(id -u):$(id -g)" from docker run, so proxy containers create log files as root, blocking the runner-UID gateway from writing.

Proposed Solution

Add --user "$(id -u):$(id -g)" to both docker run invocations:

# start_difc_proxy.sh line 42 and start_cli_proxy.sh line 43
 docker run -d --name awmg-proxy --network host \
+  --user "$(id -u):$(id -g)" \
   -e GH_TOKEN \

This ensures the proxy containers write files as the runner UID, matching the MCP Gateway's ownership, eliminating the permission denied error.

Generated by Firewall Issue Dispatcher · sonnet46 1.6M · ◷

[github-actions]

👋 Hello! I noticed this issue might be a duplicate of an existing issue:

• [awf] DIFC proxy: containers run as root causing permission denied on shared rpc-messages.jsonl #3868 — [awf] DIFC proxy: containers run as root causing permission denied on shared rpc-messages.jsonl

Both issues have identical titles and describe the same root cause: start_difc_proxy.sh and start_cli_proxy.sh omitting --user "$(id -u):$(id -g)" from docker run, causing permission errors on rpc-messages.jsonl.

If #3868 already addresses your concern, please consider closing this issue as a duplicate. Otherwise, feel free to clarify how your issue differs!

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #3869 · sonnet46 608.9K · ◷

[lpcox]

this is a gh-aw problem github/gh-aw#35069