fix(ci): preserve published image job identity

.gitea/workflows/pod-smoke.yml

@@ -1,5 +1,7 @@
+---
 name: dynamic Pod smoke test
 
+# yamllint disable-line rule:truthy
 on:
   workflow_dispatch:
 
@@ -17,3 +19,24 @@ jobs:
             -socketPath /run/spire/agent-sockets/spire-agent.sock \
             >/dev/null
           test "$(id -u)" = 2000
+
+      - name: Build and run image
+        shell: bash
+        run: |
+          set -euo pipefail
+          findmnt /var/lib/docker
+          context=$(mktemp -d)
+          cleanup() {
+            docker image rm --force pod-docker-smoke:test \
+              >/dev/null 2>&1 || true
+            rm -rf -- "$context"
+          }
+          trap cleanup EXIT
+          printf '%s\n' \
+            'FROM alpine:3.22' \
+            'RUN printf pod-docker-ok >/result' \
+            >"$context/Dockerfile"
+          docker build --tag pod-docker-smoke:test "$context"
+          output=$(docker run --rm pod-docker-smoke:test cat /result)
+          test "$output" = pod-docker-ok
+          test "$(docker info --format '{{.Driver}}')" = overlay2

.gitea/workflows/publish-images.yml

@@ -1,26 +1,22 @@
 ---
-name: publish images
+name: publish controller image
 
 on:
   push:
     branches: [main]
     paths:
       - '.gitea/workflows/publish-images.yml'
-      - 'config/**'
-      - 'container/**'
+      - 'container/controller.Dockerfile'
       - 'cmd/**'
       - 'internal/**'
-      - 'scripts/**'
-      - 'src/**'
+      - 'scripts/publish-image'
       - 'go.mod'
       - 'go.sum'
-      - 'pyproject.toml'
-      - 'README.md'
   workflow_dispatch:
 
 jobs:
   publish-images:
-    name: publish-images
+    name: publish-controller
     runs-on: [self-hosted, vm]
     timeout-minutes: 45
     permissions:
@@ -28,101 +24,13 @@ jobs:
     env:
       PUSH_REGISTRY: zot-push.ad.ddupan.top
       PULL_REGISTRY: zot.ad.ddupan.top
-      CONTROLLER_REPOSITORY: panxiao81/gitea-dynamic-runner-controller
-      RUNNER_REPOSITORY: panxiao81/gitea-dynamic-runner-runner
+      IMAGE_NAME: controller
+      IMAGE_REPOSITORY: panxiao81/gitea-dynamic-runner-controller
+      IMAGE_DOCKERFILE: container/controller.Dockerfile
       SPIRE_AGENT_SOCKET: /run/spire/agent-sockets/spire-agent.sock
     steps:
       - uses: actions/checkout@v4
 
-      - name: Test source
-        shell: bash
-        run: |
-          set -euo pipefail
-          go test ./...
-          go vet ./...
-          python3 -m pip install --break-system-packages -e '.[test]'
-          pytest -q
-          python3 -m compileall -q src tests
-          apt-get update
-          apt-get install --yes --no-install-recommends shellcheck
-          shellcheck scripts/*
-
       - name: Build and publish
         shell: bash
-        run: |
-          set -euo pipefail
-          set +x
-
-          : "${GITHUB_SHA:?GITHUB_SHA is required}"
-          image_tag="sha-${GITHUB_SHA}"
-          docker_config=$(mktemp -d)
-          jwt_file=$(mktemp)
-          cleanup() {
-            docker buildx rm ci-builder >/dev/null 2>&1 || true
-            rm -rf -- "$docker_config" "$jwt_file"
-          }
-          trap cleanup EXIT
-          export DOCKER_CONFIG="$docker_config"
-
-          /opt/spire/bin/spire-agent api fetch jwt \
-            -audience zot \
-            -socketPath "$SPIRE_AGENT_SOCKET" \
-            -output json >"$jwt_file"
-          # shellcheck disable=SC2016
-          jq -er '.[0].svids[0].svid' "$jwt_file" | \
-            docker login "$PUSH_REGISTRY" --username zot --password-stdin
-
-          docker buildx create \
-            --name ci-builder \
-            --driver docker-container \
-            --use
-
-          publish() {
-            local repository=$1
-            local dockerfile=$2
-            local metadata=$3
-            docker buildx build \
-              --builder ci-builder \
-              --platform linux/amd64 \
-              --file "$dockerfile" \
-              --tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \
-              --tag "${PUSH_REGISTRY}/${repository}:main" \
-              --provenance=mode=max \
-              --sbom=true \
-              --metadata-file "$metadata" \
-              --push \
-              .
-          }
-
-          publish \
-            "$CONTROLLER_REPOSITORY" \
-            container/controller.Dockerfile \
-            controller-metadata.json
-          publish \
-            "$RUNNER_REPOSITORY" \
-            container/runner.Dockerfile \
-            runner-metadata.json
-
-          controller_digest=$(
-            # shellcheck disable=SC2016
-            jq -er '."containerimage.digest"' controller-metadata.json
-          )
-          runner_digest=$(
-            # shellcheck disable=SC2016
-            jq -er '."containerimage.digest"' runner-metadata.json
-          )
-          controller_ref="${PULL_REGISTRY}/${CONTROLLER_REPOSITORY}@${controller_digest}"
-          runner_ref="${PULL_REGISTRY}/${RUNNER_REPOSITORY}@${runner_digest}"
-
-          printf 'controller=%s\nrunner=%s\n' "$controller_ref" "$runner_ref"
-          if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
-            {
-              printf '## Published images\n\n'
-              # shellcheck disable=SC2016
-              printf -- '- Controller: `%s`\n' "$controller_ref"
-              # shellcheck disable=SC2016
-              printf -- '- Runner: `%s`\n' "$runner_ref"
-              # shellcheck disable=SC2016
-              printf -- '- Source: `%s`\n' "$GITHUB_SHA"
-            } >>"$GITHUB_STEP_SUMMARY"
-          fi
+        run: scripts/publish-image

.gitea/workflows/publish-runner-image.yml

@@ -0,0 +1,26 @@
+---
+name: publish runner image
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish-images:
+    name: publish-runner
+    runs-on: [self-hosted, vm]
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    env:
+      PUSH_REGISTRY: zot-push.ad.ddupan.top
+      PULL_REGISTRY: zot.ad.ddupan.top
+      IMAGE_NAME: runner
+      IMAGE_REPOSITORY: panxiao81/gitea-dynamic-runner-runner
+      IMAGE_DOCKERFILE: container/runner.Dockerfile
+      SPIRE_AGENT_SOCKET: /run/spire/agent-sockets/spire-agent.sock
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build and publish
+        shell: bash
+        run: scripts/publish-image

.gitea/workflows/vm-kind-smoke.yml

@@ -7,51 +7,21 @@ on:
 
 jobs:
   kind:
-    runs-on: [self-hosted, vm-dev]
+    runs-on: [self-hosted, vm]
     steps:
-      - name: Start job-local Docker
+      - name: Prepare nested kubelet device
         shell: bash
         run: |
           set -euo pipefail
-          sudo install -d /var/lib/docker
-          sudo truncate -s 20G /tmp/docker-data.img
-          sudo mkfs.ext4 -F /tmp/docker-data.img
-          sudo mount -o loop /tmp/docker-data.img /var/lib/docker
-
-          # A nested systemd needs a domain cgroup namespace. This is the
-          # cgroup v2 nesting initialization performed by the official DinD
-          # entrypoint, kept here because the shared runner image deliberately
-          # does not carry a second DinD-specific entrypoint.
-          if [[ -f /sys/fs/cgroup/cgroup.controllers ]]; then
-            sudo sh -c '
-              mkdir -p /sys/fs/cgroup/init
-              while read -r pid; do
-                printf "%s\n" "$pid" \
-                  >/sys/fs/cgroup/init/cgroup.procs 2>/dev/null || true
-              done </sys/fs/cgroup/cgroup.procs
-              sed -e "s/ / +/g" -e "s/^/+/" \
-                /sys/fs/cgroup/cgroup.controllers \
-                >/sys/fs/cgroup/cgroup.subtree_control
-            '
+          if [[ ! -e /dev/kmsg ]]; then
+            sudo mknod /dev/kmsg c 1 11
           fi
 
-          sudo nohup dockerd \
-            --host=unix:///var/run/docker.sock \
-            --storage-driver=overlay2 \
-            >/tmp/dockerd.log 2>&1 &
-          for _ in {1..60}; do
-            if docker info >/dev/null 2>&1; then
-              exit 0
-            fi
-            sleep 1
-          done
-          cat /tmp/dockerd.log
-          exit 1
-
       - name: Verify Docker
         shell: bash
         run: |
           set -euo pipefail
+          findmnt /var/lib/docker
           docker info
           echo '### runner cgroup'
           cat /proc/self/cgroup
@@ -137,5 +107,25 @@ jobs:
             exit "$status"
           }
           trap diagnose_and_cleanup EXIT
-          /tmp/kind create cluster --name smoke --wait 180s --retain
+          # Nested Kata + Docker + kind cold starts can take longer than
+          # kubeadm's one-minute API-call default even after the static pods
+          # have been accepted. Give the API server enough time to become
+          # responsive before kubeadm creates its initial RBAC objects.
+          cat >/tmp/kind-config.yml <<'EOF'
+          kind: Cluster
+          apiVersion: kind.x-k8s.io/v1alpha4
+          nodes:
+            - role: control-plane
+              kubeadmConfigPatches:
+                - |
+                  apiVersion: kubeadm.k8s.io/v1beta4
+                  kind: InitConfiguration
+                  timeouts:
+                    kubernetesAPICall: 5m0s
+          EOF
+          /tmp/kind create cluster \
+            --name smoke \
+            --config /tmp/kind-config.yml \
+            --wait 300s \
+            --retain
           /tmp/kind get clusters | grep -Fx smoke

.gitea/workflows/vm-runtime-smoke.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   runtime:
-    runs-on: [self-hosted, vm-dev]
+    runs-on: [self-hosted, vm]
     steps:
       - name: Verify workload identity socket
         shell: bash

README.md

@@ -36,8 +36,9 @@ runs-on: [self-hosted, vm]
   entry；不持有 OpenSandbox API key、Gitea token 或 Bao 凭据。身份与 Pool 契约见
   [`docs/opensandbox-runner.md`](docs/opensandbox-runner.md)。
 - Pod executor：在 Kubernetes 中创建一次性 privileged Pod；Pod 内的 workflow 使用
-  host executor，Docker、BuildKit 和 kind 等工具由 pipeline 按需 setup。Runner 固定在
-  支持原生 job hooks 的 3.x 版本，在 workflow 第一步前等待实际任务对应的 SVID。
+  host executor。Runner 固定在支持原生 job hooks 的 3.x 版本，在 workflow 第一步前
+  等待实际任务对应的 SVID，并启动 job-local Docker daemon；workflow 可直接使用与
+  GitHub-hosted runner 相同的 Docker/BuildKit action。
 - `jwt-broker`：早期共享 Kubernetes runner 的过渡实验；目标架构不部署它，每个
   动态 Pod 或 VM 直接取得自己的 SPIFFE 身份。
 

container/runner.Dockerfile

@@ -29,6 +29,7 @@ COPY --from=spire /opt/spire/bin/spire-agent /opt/spire/bin/spire-agent
 COPY config/runner.yaml /etc/gitea-runner/config.yaml
 COPY --chmod=0755 scripts/gitea-job-started /usr/local/libexec/gitea-job-started
 COPY --chmod=0755 scripts/gitea-opensandbox-runner /usr/local/libexec/gitea-opensandbox-runner
+COPY --chmod=0755 scripts/setup-job-docker /usr/local/libexec/setup-job-docker
 
 VOLUME ["/data"]
 ENV HOME=/home/runner

docs/opensandbox-runner.md

@@ -42,8 +42,8 @@ UID attestation 的临时 Agent 失去父级。
 
 - runner 镜像包含 Gitea Runner、Node.js action userspace、SPIRE CLI、Docker 工具和
   identity gate；Pod 与 VM backend 使用同一个镜像；
-- runner UID 2000；SPIRE Agent 独立运行，需要 Docker 的 workflow 通过 sudo 在
-  privileged executor 内启动 job-local daemon；
+- runner UID 2000；SPIRE Agent 独立运行；job-started hook 在第一步 workflow 之前
+  启动 job-local Docker daemon，业务 workflow 不负责 runner 基础设施初始化；
 - Kata VM 中 Docker 数据使用 guest 内的 loop-backed ext4，并随 sandbox 一起删除；
 - `self-hosted` 必须是所有 runner labels 的前缀；
 - ephemeral/once runner 完成一项任务后退出。

internal/podbackend/client.go

@@ -8,6 +8,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -76,16 +77,25 @@ func (c *Client) CreatePod(ctx context.Context, manifest PodManifest) (Pod, erro
 			Containers: []corev1.Container{{
 				Name: "executor", Image: manifest.Image, Args: manifest.Args, Env: environment,
 				SecurityContext: &corev1.SecurityContext{Privileged: boolPointer(true)},
-				VolumeMounts: []corev1.VolumeMount{{
-					Name: "spire-agent-socket", MountPath: "/run/spire/agent-sockets", ReadOnly: true,
-				}},
-			}},
-			Volumes: []corev1.Volume{{
-				Name: "spire-agent-socket",
-				VolumeSource: corev1.VolumeSource{CSI: &corev1.CSIVolumeSource{
-					Driver: "csi.spiffe.io", ReadOnly: boolPointer(true),
-				}},
+				VolumeMounts: []corev1.VolumeMount{
+					{Name: "spire-agent-socket", MountPath: "/run/spire/agent-sockets", ReadOnly: true},
+					{Name: "docker-data", MountPath: "/var/lib/docker"},
+				},
 			}},
+			Volumes: []corev1.Volume{
+				{
+					Name: "spire-agent-socket",
+					VolumeSource: corev1.VolumeSource{CSI: &corev1.CSIVolumeSource{
+						Driver: "csi.spiffe.io", ReadOnly: boolPointer(true),
+					}},
+				},
+				{
+					Name: "docker-data",
+					VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{
+						SizeLimit: resourceQuantity("20Gi"),
+					}},
+				},
+			},
 		},
 	}
 	created, err := c.Kubernetes.CoreV1().Pods(manifest.Namespace).Create(ctx, document, metav1.CreateOptions{})
@@ -169,6 +179,11 @@ func podFromKubernetes(pod corev1.Pod) Pod {
 
 func boolPointer(value bool) *bool { return &value }
 
+func resourceQuantity(value string) *resource.Quantity {
+	quantity := resource.MustParse(value)
+	return &quantity
+}
+
 func stringMap(values map[string]string) map[string]any {
 	result := make(map[string]any, len(values))
 	for key, value := range values {

internal/podbackend/client_test.go

@@ -37,6 +37,12 @@ func TestClientPodLifecycleUsesTypedClient(t *testing.T) {
 	if got := pod.Spec.Containers[0].Env; len(got) != 1 || got[0].Name != "CI_RUNNER_CAPABILITY" || got[0].Value != "capability" {
 		t.Fatalf("environment = %#v", got)
 	}
+	if got := pod.Spec.Containers[0].VolumeMounts; len(got) != 2 || got[1].Name != "docker-data" || got[1].MountPath != "/var/lib/docker" {
+		t.Fatalf("volume mounts = %#v", got)
+	}
+	if got := pod.Spec.Volumes; len(got) != 2 || got[1].EmptyDir == nil || got[1].EmptyDir.SizeLimit == nil || got[1].EmptyDir.SizeLimit.String() != "20Gi" {
+		t.Fatalf("volumes = %#v", got)
+	}
 	if err := client.LabelPod(context.Background(), "gitea-actions", created.Name, map[string]string{terminalLabel: "true"}); err != nil {
 		t.Fatal(err)
 	}

scripts/gitea-job-started

@@ -10,6 +10,7 @@ while [ "$(date +%s)" -lt "$deadline" ]; do
         -audience ci-job-ready \
         -socketPath "$socket" \
         >/dev/null 2>&1; then
+        /usr/local/libexec/setup-job-docker
         exit 0
     fi
     sleep 1

scripts/publish-image

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -euo pipefail
+set +x
+
+: "${GITHUB_SHA:?GITHUB_SHA is required}"
+: "${IMAGE_NAME:?IMAGE_NAME is required}"
+: "${IMAGE_REPOSITORY:?IMAGE_REPOSITORY is required}"
+: "${IMAGE_DOCKERFILE:?IMAGE_DOCKERFILE is required}"
+: "${PUSH_REGISTRY:?PUSH_REGISTRY is required}"
+: "${PULL_REGISTRY:?PULL_REGISTRY is required}"
+: "${SPIRE_AGENT_SOCKET:?SPIRE_AGENT_SOCKET is required}"
+
+# Bootstrap the image that first introduces automatic Docker setup. Once that
+# runner is deployed, the job-started hook makes this an idempotent no-op.
+sudo scripts/setup-job-docker
+
+image_tag="sha-${GITHUB_SHA}"
+metadata="${IMAGE_NAME}-metadata.json"
+docker_config=$(mktemp -d)
+jwt_file=$(mktemp)
+cleanup() {
+  docker buildx rm ci-builder >/dev/null 2>&1 || true
+  rm -rf -- "$docker_config" "$jwt_file"
+}
+trap cleanup EXIT
+export DOCKER_CONFIG="$docker_config"
+
+/opt/spire/bin/spire-agent api fetch jwt \
+  -audience zot \
+  -socketPath "$SPIRE_AGENT_SOCKET" \
+  -output json >"$jwt_file"
+# shellcheck disable=SC2016
+jq -er '.[0].svids[0].svid' "$jwt_file" | \
+  docker login "$PUSH_REGISTRY" --username zot --password-stdin
+
+docker buildx create \
+  --name ci-builder \
+  --driver docker-container \
+  --use
+
+docker buildx build \
+  --builder ci-builder \
+  --platform linux/amd64 \
+  --file "$IMAGE_DOCKERFILE" \
+  --tag "${PUSH_REGISTRY}/${IMAGE_REPOSITORY}:${image_tag}" \
+  --tag "${PUSH_REGISTRY}/${IMAGE_REPOSITORY}:main" \
+  --provenance=mode=max \
+  --sbom=true \
+  --metadata-file "$metadata" \
+  --push \
+  .
+
+image_digest=$(
+  # shellcheck disable=SC2016
+  jq -er '."containerimage.digest"' "$metadata"
+)
+image_ref="${PULL_REGISTRY}/${IMAGE_REPOSITORY}@${image_digest}"
+
+printf '%s=%s\n' "$IMAGE_NAME" "$image_ref"
+if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+  {
+    printf '## Published image\n\n'
+    # shellcheck disable=SC2016
+    printf -- '- %s: `%s`\n' "$IMAGE_NAME" "$image_ref"
+    # shellcheck disable=SC2016
+    printf -- '- Source: `%s`\n' "$GITHUB_SHA"
+  } >>"$GITHUB_STEP_SUMMARY"
+fi

scripts/setup-job-docker

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if docker info >/dev/null 2>&1; then
+  printf '%s\n' 'job Docker daemon is already ready'
+  exit 0
+fi
+
+storage_size=${DOCKER_DATA_SIZE:-20G}
+storage_driver=${DOCKER_STORAGE_DRIVER:-overlay2}
+wait_seconds=${DOCKER_START_WAIT_SECONDS:-60}
+
+sudo install -d /var/lib/docker
+if ! mountpoint --quiet /var/lib/docker; then
+  printf '%s\n' "preparing ${storage_size} loop-backed Docker storage"
+  if [[ ! -e /dev/loop-control ]]; then
+    sudo mknod /dev/loop-control c 10 237
+  fi
+  for minor in {0..7}; do
+    if [[ ! -e "/dev/loop${minor}" ]]; then
+      sudo mknod "/dev/loop${minor}" b 7 "$minor"
+    fi
+  done
+  sudo truncate -s "$storage_size" /tmp/docker-data.img
+  sudo mkfs.ext4 -F /tmp/docker-data.img
+  loop_device=$(sudo losetup --find --show /tmp/docker-data.img)
+  sudo mount "$loop_device" /var/lib/docker
+else
+  printf '%s\n' 'using mounted Docker storage at /var/lib/docker'
+fi
+
+if [[ -f /sys/fs/cgroup/cgroup.controllers ]]; then
+  sudo sh -c '
+    mkdir -p /sys/fs/cgroup/init
+    while read -r pid; do
+      printf "%s\n" "$pid" \
+        >/sys/fs/cgroup/init/cgroup.procs 2>/dev/null || true
+    done </sys/fs/cgroup/cgroup.procs
+    sed -e "s/ / +/g" -e "s/^/+/" \
+      /sys/fs/cgroup/cgroup.controllers \
+      >/sys/fs/cgroup/cgroup.subtree_control
+  '
+fi
+
+sudo sh -c 'exec nohup dockerd "$@" >/tmp/dockerd.log 2>&1' sh \
+  --host=unix:///var/run/docker.sock \
+  --storage-driver="$storage_driver" &
+printf '%s\n' 'waiting for job Docker daemon'
+for ((attempt = 0; attempt < wait_seconds; attempt++)); do
+  if docker info >/dev/null 2>&1; then
+    findmnt /var/lib/docker
+    docker info --format \
+      '{{json .ServerVersion}} {{json .Driver}} {{json .CgroupVersion}}'
+    exit 0
+  fi
+  sleep 1
+done
+
+cat /tmp/dockerd.log
+exit 1