Nested stdio MCP containers run as root on arc-dind, so the runner cannot rewrite safeoutputs files #72898

Split from #66926 (findings 3 and 4), as requested in #66926 (comment). The two belong together: (4) only ever existed as a blocker for the (3) workaround.

Summary

On arc-dind the safeoutputs stdio container runs as root and appends to ${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl. The runner user then owns neither the file nor the right to rewrite it, so secret redaction cannot rewrite what the container wrote.

State at v0.92.0 — the symptom is fixed, the cause is not

Since v0.91.2 (#66160) redaction attempts atomic replacement of a non-writable file and, where that fails, removes the source and fails rather than warning and retaining it. That is the right behaviour and it closes the dangerous half of what we reported: the original v0.89.x path warned and let safe_outputs publish unredacted output. We have taken the upgrade and deleted our own fail-closed post-step, which the same release also forbids via the safe-output access rule.

So finding (4) is resolved for us — with the post-step gone the compiler rule no longer applies and we are on v0.92.0. We are not asking for that rule to be weakened.

What remains is the cause. We still carry this, because without it the redaction now correctly fails closed and we lose every safe output on the run:

steps:
  - name: Pre-create the files the safeoutputs container writes
    run: |
      mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" /tmp/gh-aw/mcp-logs/safeoutputs
      touch "${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl" /tmp/gh-aw/mcp-logs/safeoutputs/server.log
      chmod 666 "${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl" /tmp/gh-aw/mcp-logs/safeoutputs/server.log

Pre-creating the files as the runner user, world-writable, is what keeps the container's appends rewritable afterwards.

Ask

Propagate the runner's UID/GID to nested stdio MCP containers in the MCP gateway, so the files they create are owned by the user that has to redact them. Acceptance for us: delete the pre-create step and still get redacted safe outputs on arc-dind.

Worth verifying alongside it: child UID/GID, parent directory writability, and that atomic replacement actually succeeds on this topology rather than falling through to the remove-and-fail path on every run. We have not yet observed which of those two happens for us on v0.92.0 — that is part of what we will report back.

Evidence

Run 37600156028 (expired from our Actions history; reproducible on demand).