Document ARC and sandbox runtime architecture

[lpcox]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

Potential security threats were detected in the agent output.

Review the workflow run logs for details.

Overview

Updates the Security Architecture documentation to reflect the currently supported runner topologies and agent isolation runtimes: GitHub-hosted/self-hosted Linux runners, Actions Runner Controller (ARC) with a Docker-in-Docker (DinD) sidecar, gVisor (runsc), and Docker sbx (KVM microVM). No code changes — documentation only.

Key Changes

• docs/src/content/docs/introduction/architecture.mdx (modified, ~82 diff lines)
  • Rewrote the "Layer 1: Substrate-Level Trust" section to describe GitHub-hosted and Linux self-hosted runners, and ARC deployments where a privileged DinD sidecar (not the runner container) creates the agent, proxy, and MCP containers.
  • Clarified that the default agent runtime uses Docker container isolation, with gVisor (sandbox.agent.runtime: gvisor) and Docker sbx (sandbox.agent.runtime: docker-sbx) as alternative isolation boundaries on compatible runners.
  • Updated the isolation-layer architecture diagram label from "Network Egress Control" to "Docker, gVisor, or sbx Isolation".
  • Added a new "Runner Topologies and Agent Runtimes" section with a comparison table mapping runner topology → agent runtime → security boundary (GitHub-hosted/self-hosted+Docker, ARC DinD+Docker, compatible Linux+gVisor, KVM-capable Linux+Docker sbx).
  • Front-matter description updated to mention ARC/DinD, gVisor, and Docker sbx explicitly.

Impact

• Type: Documentation only (Diataxis explanation content).
• Breaking changes: None — additive/clarifying text, no config keys or APIs renamed or removed.
• Risk: Low; improves accuracy of security boundary documentation for operators choosing runner/runtime combinations.

Commits

• f85f9f294 docs: document runner and sandbox architecture
• f528bce63 Potential fix for pull request finding
• b24ee134b, fa7401424 Merge branch 'main' (sync commits)> Generated by PR Description Updater for Document ARC and sandbox runtime architecture #50667 · auto · 31.1 AIC · ⌖ 17.4 AIC · ⊞ 6.9K · ◷

[Copilot]

Pull request overview

Expands security architecture documentation for ARC/DinD and alternative agent runtimes.

Changes:

• Extends the substrate trust model across runner topologies.
• Documents Docker, gVisor, and Docker sbx isolation boundaries.
• Adds runtime compatibility guidance and related links.

Show a summary per file

File	Description
docs/src/content/docs/introduction/architecture.mdx	Updates architecture, topology, runtime, and security-layer documentation.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[gh-aw-bot]

@copilot please refresh this branch if it is behind main, then run the pr-finisher skill and push any follow-up fixes.

Generated by 👨🍳 PR Sous Chef · run: https://github.com/github/gh-aw/actions/runs/31045711597

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17.2 AIC · ⌖ 6.31 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please refresh this branch if it is behind main, then run the pr-finisher skill and push any follow-up fixes.

Generated by [👨🍳 PR Sous Chef](https://github.com/github/gh-aw/actio...

Branch was already up to date with main (merge commit b24ee13). Local validation passes:

• make fmt — no changes needed
• make golint — 0 issues
• make test-unit — no changed Go files, skipped (green)
• make agent-report-progress — pre-PR validation passed

The one review thread (compile-time vs runtime validation at line 194) is already resolved. No further code changes required.

[gh-aw-bot]

@copilot please review the latest PR feedback, refresh this branch if it is behind main, then run the pr-finisher skill and push any follow-up fixes.

Run: https://github.com/github/gh-aw/actions/runs/31050365846

Generated by PR Sous Chef.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.9 AIC · ⌖ 8.46 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please review the latest PR feedback, refresh this branch if it is behind main, then run the pr-finisher skill and push any follow-up fixes.

Run: https://github.com/github/gh-aw/actions/...

Branch is not behind main (0 commits behind, confirmed). Local validation passes:

• make fmt — clean
• make golint — 0 issues
• make test-unit — green (no changed Go files)

The PR Sous Chef run (31050365846) concluded success with no errors. The one review thread (line 194, compile-time vs runtime validation) is already resolved. No follow-up fixes required.