🩺 Runner Doctor UpdateRunner Doctor: new failure mode D5 — stale gVisor release pin returns 404 (PR #6143)

[github-actions]

Summary

• Scan window: 2026-07-10 to 2026-07-12
• Items reviewed: 1 PR (fix: update gVisor release pin from 20250623.0 to 20250707.0 #6143, the only item updated in the scan window)
• New lessons: 1 (new failure mode D5)

---

Proposed knowledge-base changes

.github/workflows/shared/self-hosted-failure-modes.md

Add new row D5 to the Category D table (after the existing D4 row):

| D5 | gVisor install step exits with HTTP 404 / download failure; runsc binary not found; AWF exits with runtime 'gvisor' is not available or compose up fails immediately after --container-runtime gvisor | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. 20250623.0); Google removes old releases from storage.googleapis.com, so the download returns 404 | Update gVisor lock files to the latest pinned release (20250707.0 or newer): in your AWF config set gvisor.releaseTag to the newest valid tag, or upgrade to the AWF version after PR #6143 which bumped all smoke-test lock files | curl -sI (storage.googleapis.com/redacted) — HTTP 404 confirms a stale pin; replace tag with 20250707.0` and retry | #6143 |

Add new entry to the Error-string quick lookup table:

| HTTP 404 / 404 Not Found downloading runsc from storage.googleapis.com during gVisor install | D5 |

---

Proposed doctor changes

.github/workflows/self-hosted-runner-doctor.md

No change — the playbook does not need updating; the new mode will surface via the shared catalog.

---

Proposed portable agent changes

.github/agents/self-hosted-runner-doctor.md

Add the same D5 row to the embedded Category D table (after D4):

| D5 | gVisor install step exits with HTTP 404 / download failure; runsc binary not found; AWF exits with runtime 'gvisor' is not available or compose up fails immediately after --container-runtime gvisor | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. 20250623.0); Google removes old releases from storage.googleapis.com, so the download returns 404 | Update gVisor lock files to the latest pinned release (20250707.0 or newer); upgrade to the AWF version after PR #6143 | `curl -sI (storage.googleapis.com/redacted) — HTTP 404 confirms a stale pin | #6143 |

Add the same error-string lookup entry to the embedded quick-lookup table:

| HTTP 404 / 404 Not Found downloading runsc from storage.googleapis.com during gVisor install | D5 |

---

Source issues and PRs

• fix: update gVisor release pin from 20250623.0 to 20250707.0 #6143 — fix: update gVisor release pin from 20250623.0 to 20250707.0 (merged 2026-07-12)
  • Symptom: AWF-compiler-generated gVisor install step used release 20250623.0 which was removed from storage.googleapis.com, causing a 404 download failure and preventing gVisor from being installed.
  • Fix: Updated all gVisor smoke-test lock files to release 20250707.0.
  • Why new: D1 covers gVisor runtime compatibility (AWF not starting / isolation ineffective under gVisor); D5 is a separate, distinct failure — gVisor cannot even be installed because the pinned release tag is stale. D1 citations ([research] Supporting alternative container runtimes (gVisor, Kata Containers) in AWF #3264, feat: gVisor runtime support #6093) do not cover this scenario.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Runner Doctor Updater · 97.6 AIC · ⊞ 14.3K · ◷

• expires on Aug 11, 2026, 7:23 PM UTC