feat: mount /usr/lib shared libraries for AWF container utilities #12085

Copilot · 2026-01-27T18:51:14Z

Warning

GitHub's Secret Scanning detected potential secrets in the added content. We attempted to remediate the issue by updating the code or redacting.

Original prompt

This section details on the original issue you should resolve

<issue_title>[plan] Implement selective /usr/lib mounting for shared libraries</issue_title>
<issue_description>## Objective

Design and implement a mechanism to mount essential shared libraries from /usr/lib into the agent container to support utilities that depend on system libraries.

Context

The agent container currently mounts specific binaries from /usr/bin, but many utilities depend on shared libraries in /usr/lib and /usr/lib/x86_64-linux-gnu. Without these libraries, some utilities may fail with "library not found" errors.

Approach

Identify which mounted /usr/bin utilities require shared libraries (use ldd command)

Create a helper function to determine library dependencies for a given binary

Design a mounting strategy:

Option A: Mount entire /usr/lib (simple but large)

Option B: Mount only required library directories (more selective)

Option C: Copy required libraries to a shared location

Implement the chosen strategy in the engine files (copilot_engine_execution.go, claude_engine.go, codex_engine.go)

Add tests to verify library mounting works correctly

Files to Modify

Modify: pkg/workflow/copilot_engine_execution.go (add library mounts)

Modify: pkg/workflow/claude_engine.go (add library mounts)

Modify: pkg/workflow/codex_engine.go (add library mounts)

Create: pkg/workflow/library_mounts.go (shared library mounting logic)

Create: pkg/workflow/library_mounts_test.go (test library detection)

Acceptance Criteria

Shared library dependencies are correctly identified for all mounted binaries

Library mounting mechanism works across all engine types (copilot, claude, codex)

Tests verify that mounted binaries can execute successfully

Documentation explains the library mounting approach and tradeoffs

Implementation minimizes security surface area (avoid mounting unnecessary libraries)
Related to epic: build/test environment for agentic workflow #11970

AI generated by Plan Command for #11970

Comments on the Issue (you are @copilot in this section)

Fixes [plan] Implement selective /usr/lib mounting for shared libraries #11972

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

- Create pkg/workflow/library_mounts.go with centralized mount logic - GetLibraryMountArgs() for shared library directories - GetBinaryMountArgs() for /usr/bin utilities - GetAllUtilityMountArgs() combining both for engines - Add pkg/workflow/library_mounts_test.go with comprehensive tests - Update copilot_engine_execution.go to use centralized mount functions - Update claude_engine.go to use library and binary mounts - Update codex_engine.go to use library and binary mounts - Add tests for library mounts across all engine types in gh_cli_mount_test.go - Recompile all workflows with new library mounts Library directories mounted (read-only): - /usr/lib/x86_64-linux-gnu: Primary shared library location - /lib/x86_64-linux-gnu: Alternative library location This enables mounted /usr/bin utilities (curl, grep, jq, etc.) to access their shared library dependencies inside the AWF container. Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

github-actions · 2026-01-28T00:37:21Z

🔍 PR Triage Results

Category: feature | Risk: high | Priority: 45/100

Scores Breakdown

Impact: 30/50 - New feature - enhances capabilities
Urgency: 5/30 - Recent PR
Quality: 10/20 - CI status unknown

📋 Recommended Action: batch_review

This PR mounts essential shared libraries (/usr/lib and /lib) into the AWF agent container to support utilities that depend on system libraries.

Implementation:

New library_mounts.go module with centralized mount configuration
Updates all three engines (Copilot, Claude, Codex)
Read-only selective directory mounting for security

Risk: High due to scope (142 files changed) and security implications of library mounting, but necessary for utility functionality.

Related PRs: Builds on #12062 (binary mounting) and enables #12130 (parity tests).

Triaged by PR Triage Agent on 2026-01-28T00:34:49Z

AI generated by PR Triage Agent

Mossaka · 2026-01-28T01:11:21Z

@copilot merge origin/main and regenerate

Copilot

Pull request overview

This PR ensures mounted /usr/bin utilities (e.g., curl, jq, grep) work inside AWF containers by also mounting the host shared-library directories they depend on.

Changes:

Added centralized helper functions to provide consistent binary + shared-library mount args.
Updated Copilot/Claude/Codex engines to use the centralized mount configuration.
Updated generated workflow “lock” YAMLs to include the new shared-library mounts in AWF invocations.

Reviewed changes

Copilot reviewed 142 out of 142 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/workflow/library_mounts.go	Introduces shared helper functions for `/usr/bin` and library-directory mounts.
pkg/workflow/copilot_engine_execution.go	Replaces inline utility mounts with centralized helper output.
pkg/workflow/claude_engine.go	Adds centralized utility + library mounts for Claude engine AWF execution.
pkg/workflow/codex_engine.go	Adds centralized utility + library mounts for Codex engine AWF execution.
.github/workflows/workflow-health-manager.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/workflow-generator.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/terminal-stylist.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/technical-doc-writer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/super-linter.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/sub-issue-closer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/smoke-codex.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/security-review.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/security-fix-pr.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/security-compliance.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/secret-scanning-triage.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/repository-quality-improver.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/repo-tree-map.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/repo-audit-analyzer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/q.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/pr-triage-agent.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/pr-nitpick-reviewer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/portfolio-analyst.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/poem-bot.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/plan.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/pdf-summary.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/notion-issue-summary.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/metrics-collector.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/issue-triage-agent.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/issue-monster.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/issue-arborist.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/grumpy-reviewer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/example-permissions-warning.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/example-custom-error-patterns.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/duplicate-code-detector.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/dictation-prompt.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/dev.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/dependabot-go-checker.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/dependabot-bundler.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/deep-report.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-team-status.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-semgrep-scan.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-secrets-analysis.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-regulatory.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-performance-summary.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-observability-report.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-issues-report.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-firewall-report.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-fact.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/daily-assign-issue-to-user.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/craft.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/copilot-pr-merged-report.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/code-simplifier.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/code-scanning-fixer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/ci-doctor.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/ci-coach.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/chroma-issue-indexer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/changeset.lock.yml	Adds `/usr/bin/*` and shared-library mounts to AWF command in locked workflow.
.github/workflows/brave.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/archie.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/ai-moderator.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/agent-persona-explorer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.
.github/workflows/agent-performance-analyzer.lock.yml	Adds shared-library mounts to AWF command in locked workflow.

Comments suppressed due to low confidence (5)

pkg/workflow/library_mounts.go:1

These mount paths are hard-coded for Debian/Ubuntu x86_64 multiarch layouts. On other architectures (e.g., arm64) or distros (e.g., lib64 layouts), these directories may not exist, causing mounted utilities to still fail (or the container invocation to fail if AWF requires the source path to exist). Consider selecting library directories based on runtime.GOARCH/platform conventions and/or making the mounted library roots configurable (e.g., via a config/env override), while defaulting to the current Ubuntu runner paths.
pkg/workflow/library_mounts.go:1
These mount paths are hard-coded for Debian/Ubuntu x86_64 multiarch layouts. On other architectures (e.g., arm64) or distros (e.g., lib64 layouts), these directories may not exist, causing mounted utilities to still fail (or the container invocation to fail if AWF requires the source path to exist). Consider selecting library directories based on runtime.GOARCH/platform conventions and/or making the mounted library roots configurable (e.g., via a config/env override), while defaulting to the current Ubuntu runner paths.
pkg/workflow/library_mounts.go:1
Building the mount arg list via many append calls is verbose and easy to drift when updating the list. Consider defining the mount specs in a []string (or a small table of paths) and generating the []string{\"--mount\", spec, ...} output in a short loop, or returning a []string literal directly. This reduces duplication and makes future edits less error-prone.
pkg/workflow/library_mounts.go:1
Mounting entire system library directories into the sandbox increases the exposed host surface area compared to mounting only the specific .so files required by the mounted utilities. If the intent is to keep mounts as selective as possible, consider deriving a minimal allowlist of required shared libraries (e.g., from the known mounted binaries’ dependency graph) and mounting only those files (still read-only), rather than whole directories.
pkg/workflow/library_mounts.go:1
Mounting entire system library directories into the sandbox increases the exposed host surface area compared to mounting only the specific .so files required by the mounted utilities. If the intent is to keep mounts as selective as possible, consider deriving a minimal allowlist of required shared libraries (e.g., from the known mounted binaries’ dependency graph) and mounting only those files (still read-only), rather than whole directories.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot · 2026-01-28T01:19:58Z

@copilot merge origin/main and regenerate

Merged origin/main and regenerated all lock files. The commit 13b65ae includes the merge with all 141 workflows recompiled with the library mounts.

github-actions · 2026-01-28T06:18:16Z

🔍 PR Triage Results

Category: feature | Risk: high | Priority: 42/100

Scores Breakdown

Impact: 30/50 - New feature enhances AWF container capabilities with shared library mounting
Urgency: 5/30 - PR is 11 hours old, standard urgency
Quality: 7/20 - Draft status, large changeset (24,049 lines changed across 239 files)

📋 Recommended Action: defer

Rationale: This is a high-risk PR that implements selective /usr/lib mounting for shared libraries needed by container utilities. The massive changeset (15,422 additions, 8,627 deletions across 239 files) requires careful review. Should remain deferred until out of draft and CI validation is complete. Security implications of library mounting need thorough assessment.

Next steps: Mark as ready for review when CI is stable, security review is complete, and the scope of file changes is explained.

Triaged by PR Triage Agent on 2026-01-28

AI generated by PR Triage Agent

Copilot AI and others added 7 commits January 27, 2026 17:25

Initial plan

417bb7f

Initial plan for mounting binaries in agent container

eb68b0a

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Add utility binary mounts to AWF container for workflows

953648c

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Fix test logic for utility mount read-only verification

4d14f8f

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

e9a3cb9

Merge branch 'main' into copilot/mount-recommended-binaries

24af4ea

Initial plan

d93018b

Copilot AI assigned Copilot and Mossaka Jan 27, 2026

Copilot started work on behalf of Mossaka January 27, 2026 18:51 View session

Copilot AI changed the title ~~[WIP] Implement selective mounting for /usr/lib shared libraries~~ feat: mount /usr/lib shared libraries for AWF container utilities Jan 27, 2026

Copilot AI requested a review from Mossaka January 27, 2026 19:15

Copilot finished work on behalf of Mossaka January 27, 2026 19:15

This was referenced Jan 28, 2026

Add agent-runner environment parity test suite #12130

Draft

Mount recommended binaries into AWF agent container #12062

Merged

Mossaka requested a review from Copilot January 28, 2026 01:07

Copilot started reviewing on behalf of Mossaka January 28, 2026 01:07 View session

Base automatically changed from copilot/mount-recommended-binaries to main January 28, 2026 01:10

Copilot AI reviewed Jan 28, 2026

View reviewed changes

Copilot started work on behalf of Mossaka January 28, 2026 01:11 View session

Merge origin/main and regenerate lock files with library mounts

13b65ae

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Copilot finished work on behalf of Mossaka January 28, 2026 01:20

github-actions bot added pr-action:defer pr-agent:copilot pr-priority:medium pr-risk:high labels Jan 28, 2026

github-actions bot added the pr-type:feature label Jan 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: mount /usr/lib shared libraries for AWF container utilities #12085

feat: mount /usr/lib shared libraries for AWF container utilities #12085

Copilot AI commented Jan 27, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

Mossaka commented Jan 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

feat: mount /usr/lib shared libraries for AWF container utilities #12085

Are you sure you want to change the base?

feat: mount /usr/lib shared libraries for AWF container utilities #12085

Conversation

Copilot AI commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Approach

Files to Modify

Acceptance Criteria

Comments on the Issue (you are @copilot in this section)

Uh oh!

github-actions bot commented Jan 28, 2026

🔍 PR Triage Results

Scores Breakdown

📋 Recommended Action: batch_review

Uh oh!

Mossaka commented Jan 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

🔍 PR Triage Results

Scores Breakdown

📋 Recommended Action: defer

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 27, 2026 •

edited

Loading