Skip to content

Split Demo 1 guides by platform #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
justinyoo merged 2 commits into from
Aug 28, 2026
Merged

Split Demo 1 guides by platform #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd5f594
Split Demo 1 guides by platform
justinyoo Aug 27, 2026
087228b
Update sandbox demo documentation
justinyoo Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# GitHub Copilot Sandbox

Presentation materials and demo automation for running GitHub Copilot CLI in Docker Sandboxes and Azure Container Apps (ACA) Sandboxes.
Presentation materials and demo for running GitHub Copilot CLI in Docker Sandboxes and Azure Container Apps (ACA) Sandboxes.

The primary presentation was prepared for various conferences and meetups, and covers local microVM isolation, remote sandbox lifecycle automation, and Java application modernization with GitHub Copilot CLI.
The primary presentation was prepared for various conferences and meetups, and covers local microVM isolation, remote sandbox lifecycle automation, and Java/.NET application modernization with GitHub Copilot CLI.

## Repository contents

Expand All @@ -19,13 +19,13 @@ The primary presentation was prepared for various conferences and meetups, and c

## Demo guides

The [demo documentation index](docs/README.md) provides two complete,
sequential walkthroughs:
The [demo documentation index](docs/README.md) provides two complete, sequential walkthroughs:

| Demo | Setup | Runbook | Validation and recovery |
| ----------------------------------------- | ----------------------------- | --------------------------------- | ---------------------------------------------------- |
| 1. Java modernization in a Docker Sandbox | [Setup](docs/demo-1-setup.md) | [Runbook](docs/demo-1-runbook.md) | [Validation](docs/demo-1-validation-and-recovery.md) |
| 2. Copilot CLI in an ACA Sandbox | [Setup](docs/demo-2-setup.md) | [Runbook](docs/demo-2-runbook.md) | [Validation](docs/demo-2-validation-and-recovery.md) |
| Demo | Setup | Runbook | Validation and recovery |
| ----------------------------------------- | ----------------------------- | ---------------------------------------- | ----------------------------------------------------------- |
| 1. Java modernization in a Docker Sandbox | [Setup](docs/demo-1-setup.md) | [Runbook](docs/demo-1-runbook-java.md) | [Validation](docs/demo-1-validation-and-recovery-java.md) |
| 1. .NET modernization in a Docker Sandbox | [Setup](docs/demo-1-setup.md) | [Runbook](docs/demo-1-runbook-dotnet.md) | [Validation](docs/demo-1-validation-and-recovery-dotnet.md) |
| 2. Copilot CLI in an ACA Sandbox | [Setup](docs/demo-2-setup.md) | [Runbook](docs/demo-2-runbook.md) | [Validation](docs/demo-2-validation-and-recovery.md) |

## Preview the presentation

Expand Down Expand Up @@ -57,4 +57,4 @@ sequential walkthroughs:
npx serve .
```

1. Open a web browser and navigate to `http://localhost:3000` to see the presentation.
1. Open a web browser and navigate to `http://localhost:3000` to see the presentation.
47 changes: 15 additions & 32 deletions docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,48 +1,33 @@
# AI agent sandboxing demo guides

These documents support the live demos in
[`ai-agent-sandboxing.md`](../ai-agent-sandboxing.md).
These documents support the live demos in [`ai-agent-sandboxing.md`](../ai-agent-sandboxing.md).

## Demo 1: Java modernization in a Docker Sandbox
## Demo 1: App modernization in a Docker Sandbox

1. [Environment setup](demo-1-setup.md) - install `sbx`, prepare credentials,
clone the sample, and establish a clean baseline.
2. [Live demo runbook](demo-1-runbook.md) - create the clone-mode sandbox,
modernize the Java application, and show the isolation evidence.
3. [Validation and recovery](demo-1-validation-and-recovery.md) - inspect,
preserve, troubleshoot, and clean up the result.

## Demo 2: Copilot CLI in an ACA Sandbox

1. [Environment setup](demo-2-setup.md) - install `aca`, prepare Azure RBAC and
credentials, and verify the Copilot disk image.
2. [Live demo runbook](demo-2-runbook.md) - create the managed sandbox,
generate a UI design plan, and prove that state survives stop and resume.
3. [Validation and recovery](demo-2-validation-and-recovery.md) - export
evidence, snapshot state, troubleshoot failures, and clean up Azure
resources.
1. [Environment setup](demo-1-setup.md) - install `sbx`, prepare credentials, clone either sample, and establish a clean baseline.
2. Choose the [Java live demo runbook](demo-1-runbook-java.md) or the [.NET live demo runbook](demo-1-runbook-dotnet.md).
3. Continue with [Java validation and recovery](demo-1-validation-and-recovery-java.md) or [.NET validation and recovery](demo-1-validation-and-recovery-dotnet.md).

## Demo 1 outcome

The demo should make four points visible:

- Copilot CLI runs inside an isolated microVM.
- The modernization agent assesses, plans, and executes the Java upgrade.
- The modernization agent assesses, plans, and executes a Java or .NET upgrade.
- The agent uses a private Git clone and cannot write to the host repository.
- The sandbox has its own Docker daemon and policy-controlled network access.

The sample application is
[`UW-Madison-DoIT/uportal-messaging`](https://github.com/UW-Madison-DoIT/uportal-messaging).
Its current baseline makes the change easy to explain: Java 8, Spring Boot
1.5.9.RELEASE, Maven, WAR packaging, and an OpenJDK 8 Travis CI build.
The sample applications are [`UW-Madison-DoIT/uportal-messaging`](https://github.com/UW-Madison-DoIT/uportal-messaging) for Java and [`Azure-Samples/dotnet-migration-copilot-samples`](https://github.com/Azure-Samples/dotnet-migration-copilot-samples) for .NET.

## Demo 2: Copilot CLI in an ACA Sandbox

1. [Environment setup](demo-2-setup.md) - install `aca`, prepare Azure RBAC and credentials, and verify the Copilot disk image.
2. [Live demo runbook](demo-2-runbook.md) - create the managed sandbox, generate a UI design plan, and prove that state survives stop and resume.
3. [Validation and recovery](demo-2-validation-and-recovery.md) - export evidence, snapshot state, troubleshoot failures, and clean up Azure resources.

## Demo 2 outcome

Demo 2 runs Copilot CLI in an Azure Container Apps Sandbox, asks it to create a
design-only plan for
[`devkimchi/battle-school-lunch`](https://github.com/devkimchi/battle-school-lunch),
stops the remote sandbox, and resumes the same sandbox with its filesystem
state intact.
Demo 2 runs Copilot CLI in an Azure Container Apps Sandbox, asks it to create a design-only plan for [`devkimchi/battle-school-lunch`](https://github.com/devkimchi/battle-school-lunch), stops the remote sandbox, and resumes the same sandbox with its filesystem state intact.

## References

Expand All @@ -51,6 +36,4 @@ state intact.
- [Docker Sandbox installation](https://docs.docker.com/ai/sandboxes/install/)
- [Docker Sandbox isolation](https://docs.docker.com/ai/sandboxes/security/isolation/)
- [Modernize Java apps with GitHub Copilot modernization](https://learn.microsoft.com/azure/developer/java/migration/github-copilot-app-modernization-for-java-copilot-cli)

Commands and prerequisites were checked against the linked documentation on
August 24, 2026.
- [Assess and migrate a .NET project with GitHub Copilot modernization for .NET](https://learn.microsoft.com/dotnet/azure/migration/appmod/quickstart?pivots=copilot-cli)
244 changes: 244 additions & 0 deletions docs/demo-1-runbook-dotnet.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,244 @@
# Demo 1: .NET app modernization in a Docker Sandbox

This runbook follows the Demo 1 sequence in [`ai-agent-sandboxing.md`](../ai-agent-sandboxing.md). Use two terminals: Terminal A for Copilot CLI and Terminal B for inspection.

> [!IMPORTANT]
> Run this demo in clone mode. Direct mode protects the host operating system, but it gives the agent read-write access to the host working tree.

## What the demo proves

- Copilot CLI runs inside an isolated microVM.
- The modernization agent assesses, plans, and executes the .NET upgrade.
- The agent works in a private clone and cannot write to the host repository.
- The sandbox has its own Docker daemon and policy-controlled network access.

## Before you begin

Complete the [Demo 1 environment setup](demo-1-setup.md) for .NET. Confirm that:

- `sbx`, GitHub CLI, and Git are available.
- Docker and GitHub authentication succeed.
- The **Balanced** network policy is active.
- The host checkout is `dotnet-migration-copilot-samples`.

## 1. Start Copilot in a private clone

> [!NOTE]
> Copilot's Docker Sandbox template starts with its approval-skipping mode. This does not remove the microVM, workspace, credential, Docker daemon, or network boundaries.

From the host checkout of `dotnet-migration-copilot-samples`, run in Terminal A:

```bash
sbx secret set github --command 'gh auth token'
sbx run --clone --name dotnet-appmod copilot .
```

On first use, choose the **Balanced** network preset when prompted.

`--clone` is the important boundary:

- `/run/sandbox/source` is a read-only mount of the host repository.
- Copilot works in a separate read-write clone inside the microVM.
- `sbx` adds a `sandbox-dotnet-appmod` Git remote to the host repository.
- Nothing reaches the host working tree until an explicit fetch, checkout, or push.

Run the following command in Terminal B to confirm the `sandbox-dotnet-appmod` remote:

```bash
git remote -v
```

Enter the sandbox from Terminal B and check whether the .NET SDK is installed:

```bash
sbx exec -it dotnet-appmod bash
dotnet --list-sdks
```

If it is not installed, install the .NET 10 SDK inside the sandbox:

```bash
sudo apt update && \
sudo apt install -y dotnet-sdk-10.0
```

Then exit the inspection shell and restart the sandbox and Copilot CLI session:

```bash
# Terminal B
exit
sbx stop dotnet-appmod

# Terminal A
sbx run --name dotnet-appmod
```

## 2. Prepare the modernization agent

### Install the plugin

In the Copilot CLI session, enter:

```text
/plugin marketplace add microsoft/github-copilot-modernization
/plugin install github-copilot-modernization@github-copilot-modernization
```

If the MCP server included with the plugin fails to start, enter:

```text
Starting `appmod-mcp-server` fails. Fix it.
```

Once it is fixed, restart GitHub Copilot CLI:

```text
/restart
```

Check that the MCP server is running:

```text
/mcp show
```

Then list the installed plugins:

```text
/plugin list
```

Confirm that the list contains:

```text
github-copilot-modernization@github-copilot-modernization
```

### Select the orchestrator

Enter `/agent`, then select:

```text
github-copilot-modernization:modernize
```

Do not run the upgrade with the default Copilot agent. The `modernize` agent provides the assessment, planning, specialized executors, retries, and per-task commits used in this demo.

## 3. Run the modernization

Use this prompt:

```text
modernize my application
```

The expected workflow is:

1. **Assessment** - discovers the .NET version, framework, dependencies, and risks; writes `.github/modernize/assessment/`.
2. **Planning** - writes `.github/modernize/<app>/plan.md` and `tasks.json`.
3. **Execution** - delegates tasks, updates the application, verifies the build, and creates detailed task commits.

A specific upgrade prompt can go directly to planning and execution. Asking for assessment explicitly keeps all three phases visible for the demo.

## 4. Inspect the sandbox while the agent works

In Terminal B:

```bash
sbx ls
sbx policy ls
sbx exec -it dotnet-appmod bash
```

Inside the sandbox shell:

```bash
pwd
node --version
dotnet --info
git branch --show-current
git status --short
docker info
find .github/modernize -maxdepth 3 -type f -print 2>/dev/null
```

Show that the host source mount is read-only:

```bash
touch /run/sandbox/source/__sandbox-write-test
```

The command should fail with a read-only filesystem error. Do not use a path inside the private clone for this test; the private clone is intentionally writable.

Show the isolated Docker daemon without changing the host:

```bash
docker run hello-world
docker ps -a
```

Exit the inspection shell:

```bash
exit
```

Run `sbx` with no arguments on the host to open the dashboard. Switch to its network panel to show allowed and denied outbound connections and the rules that made each decision.

## 5. Prove that the host stayed clean

While the agent's commits remain in the private clone, run from the host checkout:

```bash
git status --short
git branch --show-current
git remote --verbose
```

Expected result:

- `git status --short` prints nothing.
- The host remains on `main`.
- The `sandbox-dotnet-appmod` remote is present.

## 6. Verify the result

After the modernization agent finishes, use the inspection shell or ask the agent to report:

```bash
git branch --show-current
git status --short
git --no-pager log --oneline --decorate -15
find .github/modernize -maxdepth 3 -type f -print
```

Confirm that the branch is `modernize/dotnet-*`, the expected assessment and plan artifacts exist, verification results are reported, and task commits are present.

> [!NOTE]
> `*` may refer to a timestamp or a random string

## 7. Preserve evidence and clean up

Continue with [Demo 1 .NET validation and recovery](demo-1-validation-and-recovery-dotnet.md) to:

1. Fetch the private modernization branch.
2. Review application, build, CI, and modernization artifacts.
3. Materialize only the reviewed branch on the host.
4. Stop and remove the sandbox after its work is preserved.

## Troubleshooting

Use the [Demo 1 .NET troubleshooting guide](demo-1-validation-and-recovery-dotnet.md#troubleshooting) for plugin installation, .NET discovery, network policy, build failures, sandbox mode, and fetch failures.

## References

- [Get started with Docker Sandboxes](https://docs.docker.com/ai/sandboxes/get-started/)
- [Run GitHub Copilot in a Docker Sandbox](https://docs.docker.com/ai/sandboxes/agents/copilot/)
- [Docker Sandbox isolation](https://docs.docker.com/ai/sandboxes/security/isolation/)
- [Use Git with Docker Sandboxes](https://docs.docker.com/ai/sandboxes/workflows/git/)
- [Assess and migrate a .NET project with GitHub Copilot modernization for .NET](https://learn.microsoft.com/dotnet/azure/migration/appmod/quickstart?pivots=copilot-cli)

## Navigation

[Previous: Demo 1 environment setup](demo-1-setup.md) |
[Next: Demo 1 .NET validation and recovery](demo-1-validation-and-recovery-dotnet.md)
Loading