fix: add --allow-host-ports to AWF command for MCP gateway port 8080#27080
Merged
fix: add --allow-host-ports to AWF command for MCP gateway port 8080#27080
Conversation
PR #27058 moved the MCP gateway from port 80 to 8080 (non-privileged), but AWF's --enable-host-access only allows traffic on ports 80 and 443 by default. This caused the agent inside AWF to be unable to reach the gateway, resulting in safe-output and MCP tool-call timeouts. Add --allow-host-ports 80,443,<gateway-port> to the compiled AWF command so the firewall's iptables rules allow traffic to the MCP gateway. Respects custom sandbox.mcp.port configuration if set. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
❌ Smoke CI failed. Please review the logs for details. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes AWF host-access networking for the MCP gateway after the gateway default port moved from 80 to 8080, ensuring the agent container can reach host.docker.internal:<gateway-port> without firewall timeouts.
Changes:
- Add
--allow-host-ports 80,443,<mcpGatewayPort>to the generated AWF args (defaulting to 8080, honoringsandbox.mcp.port). - Add unit tests covering default/custom MCP gateway port behavior and nil sandbox config.
- Regenerate workflow lock files and golden fixtures to reflect the updated AWF command.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/awf_helpers.go | Adds --allow-host-ports to AWF args using the MCP gateway port. |
| pkg/workflow/awf_helpers_test.go | Adds tests validating --allow-host-ports output for default/custom ports. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates expected compiled command output to include --allow-host-ports 80,443,8080. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Updates expected compiled command output to include --allow-host-ports 80,443,8080. |
| .github/workflows/*.lock.yml | Regenerated locked workflows to include --allow-host-ports 80,443,8080 in AWF commands. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 145/199 changed files
- Comments generated: 1
Comment on lines
+259
to
+270
| // AWF's --enable-host-access defaults to ports 80,443. The MCP gateway now | ||
| // listens on port 8080 (non-privileged), so we must explicitly allow it. | ||
| // Without this, iptables drops traffic from the agent container to the | ||
| // gateway, causing tool-call timeouts (safe-outputs, GitHub MCP, etc.). | ||
| mcpGatewayPort := int(DefaultMCPGatewayPort) | ||
| if config.WorkflowData != nil && config.WorkflowData.SandboxConfig != nil && | ||
| config.WorkflowData.SandboxConfig.MCP != nil && config.WorkflowData.SandboxConfig.MCP.Port > 0 { | ||
| mcpGatewayPort = config.WorkflowData.SandboxConfig.MCP.Port | ||
| } | ||
| hostPorts := fmt.Sprintf("80,443,%d", mcpGatewayPort) | ||
| awfArgs = append(awfArgs, "--allow-host-ports", hostPorts) | ||
| awfHelpersLog.Printf("Added --allow-host-ports %s for MCP gateway access", hostPorts) |
Collaborator
Author
|
@copilot address this review feedback #27080 (review) |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b06a522a-2ce7-4f3b-9d25-8a61cd422322 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/b06a522a-2ce7-4f3b-9d25-8a61cd422322 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Contributor
Addressed in Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot merge main and recompile |
…rt-8080 # Conflicts: # .github/workflows/smoke-ci.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Done in Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
PR #27058 moved the MCP gateway from port 80 to 8080 (non-privileged), but AWF's
--enable-host-accessonly allows traffic on ports 80 and 443 by default. This causes the agent inside AWF to be unable to reach the gateway viahost.docker.internal:8080, resulting in safe-output and MCP tool-call timeouts.Evidence from run 24612668312:
Host access enabled: allowing traffic to gateway IPs 172.30.0.1, 172.17.0.1 on ports 80, 443host.docker.internal:8080times out — port 8080 is blocked by iptablesFix
Add
--allow-host-ports 80,443,<gateway-port>to the compiled AWF command inBuildAWFArgs(). This uses AWF v0.25.24's existing--allow-host-portsflag to explicitly allow traffic to port 8080 (or a customsandbox.mcp.portif configured).Changes
pkg/workflow/awf_helpers.go: After--enable-host-access, add--allow-host-portswith 80, 443, and the MCP gateway port (default 8080, respects customsandbox.mcp.port)pkg/workflow/awf_helpers_test.go: 3 test cases — default port, custom port, nil SandboxConfig--allow-host-ports 80,443,8080flag