From 1ddec3414967e6888b8190db9e7a5f1f62bbb42d Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Mon, 21 Sep 2026 11:48:57 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=B8=BA=20Kata=20DinD=20=E4=BD=BF?=
 =?UTF-8?q?=E7=94=A8=20guest=20ext4=20=E6=95=B0=E6=8D=AE=E7=9B=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 platform/sandbox-ci-runners/README.md  |  5 +++++
 platform/sandbox-ci-runners/pools.yaml | 12 +++++-------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/platform/sandbox-ci-runners/README.md b/platform/sandbox-ci-runners/README.md
index 79f7719..15e8feb 100644
--- a/platform/sandbox-ci-runners/README.md
+++ b/platform/sandbox-ci-runners/README.md
@@ -68,3 +68,8 @@ kubectl -n opensandbox logs deploy/opensandbox-identity -f
   cleaning`：确认 `docker` sidecar 通过 `dockerd-entrypoint.sh` 启动。直接执行
   `dockerd` 会绕过官方 DinD cgroup v2 nesting 初始化，使子容器的私有 cgroup
   namespace 根变成 `threaded`，systemd 无法创建 domain cgroup。
+- kind 的 kubeadm 卡在 `CreateContainer`，而 nested containerd goroutine 停在
+  `bbolt` 的 `fdatasync`：不要直接把 Kata shared mount 用作 Docker 数据目录。
+  `ci-vm` 在 guest 内创建稀疏 ext4 镜像并 loop-mount 到 `/var/lib/docker`；该镜像
+  随 Sandbox 删除，不得在节点侧遗留。临时启动安装 `e2fsprogs` 仅用于首次集成
+  验证，验证后应固化到自有 DinD 镜像。
diff --git a/platform/sandbox-ci-runners/pools.yaml b/platform/sandbox-ci-runners/pools.yaml
index b6bc741..f02777b 100644
--- a/platform/sandbox-ci-runners/pools.yaml
+++ b/platform/sandbox-ci-runners/pools.yaml
@@ -113,20 +113,18 @@ spec:
           command: [/bin/sh, -c]
           args:
             - |
+              set -eu
               test -e /dev/kmsg || mknod /dev/kmsg c 1 11
+              apk add --no-cache e2fsprogs
+              truncate -s 20G /tmp/docker-data.img
+              mkfs.ext4 -F /tmp/docker-data.img
+              mount -o loop /tmp/docker-data.img /var/lib/docker
               exec dockerd-entrypoint.sh dockerd \
                 --host=unix:///run/docker/docker.sock \
                 --group=2000 \
                 --storage-driver=overlay2
           securityContext:
             privileged: true
-          resources:
-            requests:
-              cpu: "2"
-              memory: 3Gi
-            limits:
-              cpu: "2"
-              memory: 3Gi
           volumeMounts:
             - name: docker-socket
               mountPath: /run/docker