[Repo Assist] fix(config): skip port-mapping check for host-networked containers in --validate-env

[github-actions]

🤖 This PR is from Repo Assist, an automated AI assistant for this repository.

Closes #14053

Root Cause

run_containerized.sh's validate_port_mapping already skips port-mapping validation when a container's HostConfig.NetworkMode is "host" (fixed in #7684 for #7647), but the Go validator that run_containerized.sh now delegates to via --validate-env (ValidateContainerizedEnvironmentForRuntime in internal/config/validation_env.go) never got the same exception.

Docker discards published port mappings for --network host containers, so NetworkSettings.Ports is always empty and CheckPortMapping always fails — regressing #7647 for anyone using --validate-env under host networking, exactly as reported in #14053.

Fix

• Added sys.IsHostNetworkMode(containerID) in internal/sys/docker.go, which inspects HostConfig.NetworkMode the same way run_containerized.sh's bash fix does.
• ValidateContainerizedEnvironmentForRuntime now checks host networking first and skips the NetworkSettings.Ports validation when detected, treating the port requirement as satisfied (matching the bash-side behavior). Bridge-networked containers are completely unaffected.
• If the network-mode check itself fails (e.g., docker inspect error), we fall back to running the original port-mapping check and surface a warning, so we never silently skip validation when we can't determine the mode.

Trade-offs

• No security impact: this exactly mirrors an existing, already-shipped bash-side exception; it does not relax any check for bridge-networked containers.
• No new dependencies.

Test Status

✅ Build: go build ./... passes
✅ Unit tests: added TestIsHostNetworkMode in internal/sys/docker_test.go (mirrors existing TestCheckPortMapping coverage: empty ID, invalid ID, unreachable docker socket cases); go test ./internal/sys/... ./internal/config/... passes
✅ make agent-finished: full pipeline (format, build, lint, all Go + Rust guard tests) passes clean

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

• example.com
• nonexistent.local
• slow.example.com
• thishostdoesnotexist12345.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "nonexistent.local"
    - "slow.example.com"
    - "thishostdoesnotexist12345.com"

See Network Configuration for more information.

Generated by Repo Assist · copilot · auto · 370.9 AIC · ⊞ 18.7K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Copilot review overview

🟡 Changes recommended

The regression-fixing host-network branch lacks direct automated coverage.

Review effort: Balanced
Findings: 1

Open (1)

• Add tests covering host network success and fallback behavior · New

What changed in this PR

Adds host-network awareness to containerized environment validation, preventing false port-mapping failures.

Changes:

• Detects Docker host-network mode.
• Skips port validation for host-networked containers.
• Adds error-path tests for network detection.

File	Description
internal/​sys/​docker.go	Adds host-network detection.
internal/​sys/​docker_test.go	Tests detection error paths.
internal/​config/​validation_env.go	Bypasses port checks for host networking.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Added mocked coverage for host networking, bridge networking, and network-mode inspect failure with port-mapping fallback. Commit: COMMIT_HASH.

[lpcox]

@copilot merge main and fix conflicts

[Copilot]

@copilot merge main and fix conflicts

Merged main and resolved the validator/test conflicts using the upstream implementations. The merge commit is 8acf013.