From eb52197eeebb2d367b02ea81edbabde793d49e9b Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Sun, 20 Sep 2026 17:19:12 +0000
Subject: [PATCH] =?UTF-8?q?=E9=99=90=E5=88=B6=20OpenSandbox=20=E4=BB=85?=
 =?UTF-8?q?=E8=B0=83=E5=BA=A6=20VM?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 platform/sandbox-ci-runners/README.md          |  6 +++---
 platform/sandbox-ci-runners/kustomization.yaml | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/platform/sandbox-ci-runners/README.md b/platform/sandbox-ci-runners/README.md
index 93830c0..fd78991 100644
--- a/platform/sandbox-ci-runners/README.md
+++ b/platform/sandbox-ci-runners/README.md
@@ -1,8 +1,8 @@
 # OpenSandbox Gitea runner Pools
 
-本目录部署 `ci-vm` 和 `ci-pod` 两个零预热 Pool、sandbox 内的 SPIFFE identity
-controller，以及仅供内网 VyOS 转发的 OpenSandbox NodePort。`ci-vm` 使用
-`kata-clh-runtime-rs`，`ci-pod` 使用默认 runtime；两者均为单任务、用后删除。
+本目录只部署零预热的 `ci-vm` Pool、sandbox 内的 SPIFFE identity controller，以及仅供
+内网 VyOS 转发的 OpenSandbox NodePort。`ci-vm` 使用 `kata-clh-runtime-rs`，每个 VM
+执行单一任务并在结束后删除。普通 Pod job 直接运行在 homelab，不进入 OpenSandbox。
 
 Pool 中 task-executor 接收 Lifecycle API 下发的进程环境。guest-local SPIRE Agent 用
 Pod-bound PSAT 向中央 SPIRE 注册；identity controller 从 BatchSandbox allocation
diff --git a/platform/sandbox-ci-runners/kustomization.yaml b/platform/sandbox-ci-runners/kustomization.yaml
index 0d00954..35f85c2 100644
--- a/platform/sandbox-ci-runners/kustomization.yaml
+++ b/platform/sandbox-ci-runners/kustomization.yaml
@@ -6,3 +6,17 @@ resources:
   - rbac.yaml
   - identity-controller.yaml
   - pools.yaml
+patches:
+  # Pod jobs run directly in the homelab cluster. Keep OpenSandbox VM-only.
+  - target:
+      group: sandbox.opensandbox.io
+      version: v1alpha1
+      kind: Pool
+      name: ci-pod
+    patch: |-
+      apiVersion: sandbox.opensandbox.io/v1alpha1
+      kind: Pool
+      metadata:
+        name: ci-pod
+        namespace: opensandbox
+      $patch: delete