Claude-on-Copilot still emits unreachable host gateway with docker-sudo-iptables host-access sandbox #72756

Summary

engine: claude with GitHub Copilot inference fails before model inference when using the docker-sudo-iptables sandbox profile together with GitHub Actions services such as PostgreSQL.

This appears to be a remaining edge case after #66788 / #66957.

The generated Claude environment receives:

ANTHROPIC_BASE_URL=http://host.docker.internal:10002

However, the AWF Copilot API proxy is running inside the sandbox network and is not reachable through host.docker.internal:10002.

As a result, the Claude pre-flight health check fails before the Claude harness can resolve the correct Copilot endpoint through /reflect.

Environment

• gh-aw: v1.0.1
• Engine: claude
• Model: copilot/auto
• Authentication: COPILOT_GITHUB_TOKEN
• Sandbox: docker-sudo-iptables
• GitHub Actions service: PostgreSQL
• Firewall/network isolation: enabled
• No Anthropic API key

Host access is required because the agent needs to connect to the PostgreSQL GitHub Actions service.

Observed failure

The Copilot proxy starts successfully:

[INFO] API proxy enabled: OpenAI=false, Anthropic=false, Copilot=true (github-token), Gemini=false

Claude then fails during pre-flight:

[health-check] Checking Anthropic API proxy configuration...
[health-check] ✓ Anthropic credentials NOT in agent environment (correct)
[health-check] Testing connectivity to Anthropic API proxy at http://host.docker.internal:10002...
[health-check][ERROR] Cannot connect to Anthropic API proxy at http://host.docker.internal:10002
[health-check][ERROR] Proxy may not be running or network is blocked

The agent never reaches model inference:

• execution state is not_started
• token usage is empty
• no inference request is made

Root cause

docker-sudo-iptables supports both:

• network isolation
• host access

Host access is required for external GitHub Actions services such as PostgreSQL.

The current gateway-selection logic appears to treat SupportsHostAccess=true as a reason to use:

host.docker.internal:10002

for the Claude/Copilot gateway.

But host access for PostgreSQL does not mean the AWF internal API proxy is published or reachable through the host gateway.

These are separate networking concerns.

For example:

PostgreSQL:
host.docker.internal:5432
✅ Correct and required

AWF/Copilot API proxy:
host.docker.internal:10002
❌ Not reachable

Why the existing fix does not fully cover this

#66788 / #66957 addressed Claude-on-Copilot gateway routing for isolated agents.

However, docker-sudo-iptables also supports host access, so it still falls into the host-gateway path even though the Copilot API proxy remains internal to the AWF sandbox network.

This leaves the host-access sandbox profile with an invalid Claude bootstrap gateway.

Expected behavior

When using:

• engine: claude
• model: copilot/auto
• docker-sudo-iptables

the Claude/AWF pre-flight should use the actual AWF/Copilot internal gateway.

At the same time:

• PostgreSQL access through host.docker.internal:5432 must continue to work.
• No Anthropic API key should be required.
• Sandbox and firewall protections must remain enabled.
• No broad network access should be added.
• The AWF proxy should not need to be exposed publicly or broadly on host port 10002.

Suggested fix direction

LLM gateway routing should be determined independently from generic sandbox host-access capability.

SupportsHostAccess=true should not automatically imply that the AWF inference proxy is available through host.docker.internal.

For Claude using Copilot inference, use the AWF-local/internal Copilot gateway whenever the proxy is running inside the sandbox network, even when host access is enabled for unrelated services such as PostgreSQL.

Additional compiler limitation

A possible repo-level workaround was:

engine:
  id: claude
  env:
    ANTHROPIC_BASE_URL: ""

However, the current empty-string YAML serialization produces a bare empty value / YAML null rather than a quoted empty string, causing schema validation issues.

So a clean repo-level bootstrap override is also currently blocked.

This is secondary to the gateway-routing bug, but may be worth fixing separately.

Acceptance criteria

The following configuration should work:

• engine: claude
• model: copilot/auto
• docker-sudo-iptables
• GitHub Actions PostgreSQL service

And:

• Claude pre-flight succeeds.
• Agent execution progresses beyond not_started.
• At least one Copilot-backed inference succeeds.
• PostgreSQL host access remains functional.
• No Anthropic key is required.
• Network isolation remains enabled.
• No broad firewall relaxation is required.
• Regression coverage is added for this host-access + internal Copilot proxy topology.

Related

• Claude on Copilot fails AWF pre-flight: provider gateway URL ignores network isolation #66788 — Claude-on-Copilot gateway/pre-flight issue
• Use AWF-local gateways for isolated agents #66957 — AWF-local gateway fix for isolated agents