Run MCP gateway on 8080 and add explicit host mapping for non-root containers#27058
Merged
Run MCP gateway on 8080 and add explicit host mapping for non-root containers#27058
Conversation
5 tasks
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/83cc593e-22e3-45b4-9944-906025491df4 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Run MCP Gateway on port 8080 and update firewall rules
Run MCP gateway on 8080 and add host-gateway mapping for non-root containers
Apr 18, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates MCP gateway defaults and workflow generation so the gateway can run as non-root (non-privileged port) and reliably resolve host.docker.internal from inside the gateway container.
Changes:
- Changed the default MCP gateway port from
80to8080across constants, docs, and goldens. - Updated the generated gateway
docker runcommand to include--add-host host.docker.internal:host-gateway. - Updated unit tests and golden workflow fixtures to match the new defaults/command.
Show a summary per file
| File | Description |
|---|---|
| pkg/constants/constants.go | Switches default gateway port to 8080. |
| pkg/constants/spec_test.go | Updates spec test expectation for the new default port. |
| pkg/constants/README.md | Updates docs for the new default port. |
| pkg/workflow/mcp_gateway_constants.go | Updates gateway constants documentation comments to 8080. |
| pkg/workflow/mcp_gateway_config.go | Updates gateway config documentation comments/examples to 8080. |
| pkg/workflow/mcp_setup_generator.go | Adds --add-host host.docker.internal:host-gateway to generated docker run. |
| pkg/workflow/mcp_setup_generator_test.go | Asserts generated YAML includes port 8080 and --add-host snippet. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates expected generated workflow output (8080 + --add-host). |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Updates expected generated workflow output (8080 + --add-host). |
| actions/setup/js/mount_mcp_as_cli.cjs | Updates inline URL examples from :80 to :8080. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 10/10 changed files
- Comments generated: 3
|
|
||
| var containerCmd strings.Builder | ||
| containerCmd.WriteString("docker run -i --rm --network host") | ||
| containerCmd.WriteString(" --add-host host.docker.internal:host-gateway") |
There was a problem hiding this comment.
With --network host, mapping host.docker.internal to host-gateway may resolve to a non-loopback IP (e.g., 172.17.0.1). If any backend the gateway calls is bound only to 127.0.0.1, requests to host.docker.internal can fail even though host networking is enabled. Consider mapping host.docker.internal to 127.0.0.1 when using host networking, or switching to bridge networking + explicit -p mappings so host-gateway semantics match typical expectations.
Suggested change
| containerCmd.WriteString(" --add-host host.docker.internal:host-gateway") | |
| containerCmd.WriteString(" --add-host host.docker.internal:127.0.0.1") |
Comment on lines
+698
to
+699
| containerCmd.WriteString("docker run -i --rm --network host") | ||
| containerCmd.WriteString(" --add-host host.docker.internal:host-gateway") |
There was a problem hiding this comment.
The host-gateway token requires sufficiently new Docker Engine support; on older Docker versions this can cause docker run to fail outright. To keep generated workflows broadly compatible, consider generating a small runtime check in the shell (e.g., detect support via docker run --help / docker version) and only append --add-host host.docker.internal:host-gateway when supported, otherwise omit it or fall back to resolving the host IP another way.
| // - Write mcp-scripts config to ${RUNNER_TEMP}/gh-aw/mcp-scripts/ | ||
| // - Start mcp-scripts HTTP server on port 3000 | ||
| // - Start MCP Gateway on port 80 | ||
| // - Start MCP Gateway on port 8080 |
There was a problem hiding this comment.
This comment states a fixed port, but the gateway port appears to be configurable (via constants/config/env). To avoid misleading documentation, adjust wording to reflect that 8080 is the default (e.g., 'Start MCP Gateway (default port 8080)' or 'Start MCP Gateway on configured port').
Suggested change
| // - Start MCP Gateway on port 8080 | |
| // - Start MCP Gateway (default port 8080) |
Collaborator
|
@copilot address this review feedback #27058 (review) |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6d325ed7-55ed-486a-8c49-e58f6415c308 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6d325ed7-55ed-486a-8c49-e58f6415c308 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Contributor
Author
Addressed the linked review feedback in commit I updated MCP gateway host mapping to Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
Run MCP gateway on 8080 and add host-gateway mapping for non-root containers
Run MCP gateway on 8080 and add explicit host mapping for non-root containers
Apr 18, 2026
lpcox
added a commit
that referenced
this pull request
Apr 18, 2026
PR #27058 moved the MCP gateway from port 80 to 8080 (non-privileged), but AWF's --enable-host-access only allows traffic on ports 80 and 443 by default. This caused the agent inside AWF to be unable to reach the gateway, resulting in safe-output and MCP tool-call timeouts. Add --allow-host-ports 80,443,<gateway-port> to the compiled AWF command so the firewall's iptables rules allow traffic to the MCP gateway. Respects custom sandbox.mcp.port configuration if set. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
lpcox
added a commit
that referenced
this pull request
Apr 18, 2026
…27080) * fix: add --allow-host-ports to AWF command for MCP gateway port 8080 PR #27058 moved the MCP gateway from port 80 to 8080 (non-privileged), but AWF's --enable-host-access only allows traffic on ports 80 and 443 by default. This caused the agent inside AWF to be unable to reach the gateway, resulting in safe-output and MCP tool-call timeouts. Add --allow-host-ports 80,443,<gateway-port> to the compiled AWF command so the firewall's iptables rules allow traffic to the MCP gateway. Respects custom sandbox.mcp.port configuration if set. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: gate --allow-host-ports by minimum AWF version Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b06a522a-2ce7-4f3b-9d25-8a61cd422322 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * chore: clarify allow-host-ports version gate messaging Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b06a522a-2ce7-4f3b-9d25-8a61cd422322 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Running the MCP gateway container as non-root failed because gh-aw generated a privileged bind (
0.0.0.0:80), and HTTP backends usinghost.docker.internalwere not reliably resolvable inside the gateway container. This updates the generated gateway runtime defaults/command to use a non-privileged port and explicit host mapping.Gateway runtime defaults
80to8080(pkg/constants/constants.go).Gateway container launch
docker runcommand to include:--add-host host.docker.internal:127.0.0.1host-gatewaycompatibility issues on older engines.Generated output + expectations
export MCP_GATEWAY_PORT="8080"--add-host host.docker.internal:127.0.0.1Start MCP Gateway (default port 8080)).:80to:8080where they document gateway URLs.> [!WARNING]
>
>