From fef7e5a21403e4a2ea6793fb53482512827d0a7f Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Mon, 21 Sep 2026 12:00:55 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20=E7=94=B1=20VM=20=E4=BB=BB=E5=8A=A1?=
 =?UTF-8?q?=E5=90=AF=E5=8A=A8=E6=9C=AC=E5=9C=B0=20Docker=20daemon?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/vm-kind-smoke.yml | 39 ++++++++++++++++++++++++++++++
 docs/opensandbox-runner.md         |  8 +++---
 2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/vm-kind-smoke.yml b/.gitea/workflows/vm-kind-smoke.yml
index d6fa4fd..387a240 100644
--- a/.gitea/workflows/vm-kind-smoke.yml
+++ b/.gitea/workflows/vm-kind-smoke.yml
@@ -9,6 +9,45 @@ jobs:
   kind:
     runs-on: [self-hosted, vm-dev]
     steps:
+      - name: Start job-local Docker
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo install -d /var/lib/docker
+          sudo truncate -s 20G /tmp/docker-data.img
+          sudo mkfs.ext4 -F /tmp/docker-data.img
+          sudo mount -o loop /tmp/docker-data.img /var/lib/docker
+
+          # A nested systemd needs a domain cgroup namespace. This is the
+          # cgroup v2 nesting initialization performed by the official DinD
+          # entrypoint, kept here because the shared runner image deliberately
+          # does not carry a second DinD-specific entrypoint.
+          if [[ -f /sys/fs/cgroup/cgroup.controllers ]]; then
+            sudo sh -c '
+              mkdir -p /sys/fs/cgroup/init
+              while read -r pid; do
+                printf "%s\n" "$pid" \
+                  >/sys/fs/cgroup/init/cgroup.procs 2>/dev/null || true
+              done </sys/fs/cgroup/cgroup.procs
+              sed -e "s/ / +/g" -e "s/^/+/" \
+                /sys/fs/cgroup/cgroup.controllers \
+                >/sys/fs/cgroup/cgroup.subtree_control
+            '
+          fi
+
+          sudo nohup dockerd \
+            --host=unix:///var/run/docker.sock \
+            --storage-driver=overlay2 \
+            >/tmp/dockerd.log 2>&1 &
+          for _ in {1..60}; do
+            if docker info >/dev/null 2>&1; then
+              exit 0
+            fi
+            sleep 1
+          done
+          cat /tmp/dockerd.log
+          exit 1
+
       - name: Verify Docker
         shell: bash
         run: |
diff --git a/docs/opensandbox-runner.md b/docs/opensandbox-runner.md
index 7919a19..6bfba8d 100644
--- a/docs/opensandbox-runner.md
+++ b/docs/opensandbox-runner.md
@@ -40,9 +40,11 @@ UID attestation 的临时 Agent 失去父级。
 
 `ci-vm` 使用 `kata-clh-runtime-rs`；`ci-pod` 使用默认 runc。两者都要求：
 
-- runner 镜像包含 Gitea Runner、Node.js action userspace、SPIRE CLI 和 identity gate；
-- runner UID 2000，SPIRE Agent 与 privileged dockerd 使用不同 UID；
-- Docker socket 通过 group 2000 共享，Docker 数据仅存在于 sandbox emptyDir；
+- runner 镜像包含 Gitea Runner、Node.js action userspace、SPIRE CLI、Docker 工具和
+  identity gate；Pod 与 VM backend 使用同一个镜像；
+- runner UID 2000；SPIRE Agent 独立运行，需要 Docker 的 workflow 通过 sudo 在
+  privileged executor 内启动 job-local daemon；
+- Kata VM 中 Docker 数据使用 guest 内的 loop-backed ext4，并随 sandbox 一起删除；
 - `self-hosted` 必须是所有 runner labels 的前缀；
 - ephemeral/once runner 完成一项任务后退出。