归档：Kata / microVM runner 实验（2026-09-17 工作区快照）

从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17
stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。
被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。

Co-Authored-By: Claude Opus 5.5 <[email protected]>

infrastructure/kata-lxc-lab/runner/namespace.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea-actions
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kata-ephemeral-runner-config
+  namespace: gitea-actions
+data:
+  config.yaml: |
+    log:
+      level: info
+    runner:
+      file: /runner-state/.runner
+      capacity: 1
+      envs:
+        DOCKER_HOST: tcp://host.docker.internal:2375
+      timeout: 3h
+      shutdown_timeout: 5m
+      labels:
+        - kata-poc:docker://docker.io/library/alpine:3.22
+    cache:
+      enabled: false
+    container:
+      network: ""
+      options: --add-host=host.docker.internal:host-gateway
+      docker_host: tcp://127.0.0.1:2375
+      require_docker: true
+      docker_timeout: 5m
+      force_pull: true
+      bind_workdir: false

infrastructure/kata-lxc-lab/runner/runner.yaml

@@ -0,0 +1,111 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  generateName: kata-ephemeral-runner-
+  namespace: gitea-actions
+  labels:
+    app.kubernetes.io/name: kata-ephemeral-runner
+spec:
+  runtimeClassName: kata
+  restartPolicy: Never
+  terminationGracePeriodSeconds: 330
+  automountServiceAccountToken: false
+  initContainers:
+    # Native sidecar: startupProbe gates the runner, and kubelet terminates this
+    # container after the ephemeral runner exits so the Kata sandbox can end.
+    - name: docker
+      image: zot.ad.ddupan.top/panxiao81/dind-fuse:29.7.1
+      imagePullPolicy: Never
+      restartPolicy: Always
+      env:
+        - name: DOCKER_TLS_CERTDIR
+          value: ""
+        - name: DIND_LOOPBACK_SIZE
+          value: 6G
+        - name: DIND_LOOPBACK_FILE
+          value: /loopback/docker.img
+      args:
+        - --host=tcp://0.0.0.0:2375
+        - --tls=false
+        - --mtu=1450
+        - --default-network-opt=bridge=com.docker.network.driver.mtu=1450
+      securityContext:
+        privileged: true
+      resources:
+        requests:
+          cpu: 250m
+          memory: 512Mi
+          ephemeral-storage: 1Gi
+        limits:
+          cpu: "4"
+          memory: 6Gi
+          ephemeral-storage: 8Gi
+      volumeMounts:
+        - name: docker-data
+          mountPath: /var/lib/docker
+        - name: loopback-data
+          mountPath: /loopback
+      startupProbe:
+        tcpSocket:
+          port: 2375
+        periodSeconds: 2
+        failureThreshold: 150
+      readinessProbe:
+        tcpSocket:
+          port: 2375
+        periodSeconds: 5
+  containers:
+    - name: runner
+      image: docker.io/gitea/runner:2.3.0
+      imagePullPolicy: Never
+      env:
+        - name: CONFIG_FILE
+          value: /config/config.yaml
+        - name: DOCKER_HOST
+          value: tcp://127.0.0.1:2375
+        - name: GITEA_INSTANCE_URL
+          value: https://git.ddupan.top
+        - name: GITEA_RUNNER_EPHEMERAL
+          value: "1"
+        - name: GITEA_RUNNER_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: GITEA_RUNNER_LABELS
+          value: kata-poc:docker://docker.io/library/alpine:3.22
+        - name: GITEA_RUNNER_REGISTRATION_TOKEN_FILE
+          value: /registration/token
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "1"
+          memory: 1Gi
+      volumeMounts:
+        - name: config
+          mountPath: /config
+          readOnly: true
+        - name: registration
+          mountPath: /registration
+          readOnly: true
+        - name: runner-state
+          mountPath: /runner-state
+  volumes:
+    - name: config
+      configMap:
+        name: kata-ephemeral-runner-config
+    - name: registration
+      secret:
+        secretName: gitea-runner-registration
+    - name: runner-state
+      emptyDir:
+        medium: Memory
+        sizeLimit: 16Mi
+    - name: docker-data
+      emptyDir:
+        sizeLimit: 8Gi
+    - name: loopback-data
+      emptyDir:
+        medium: Memory
+        sizeLimit: 6Gi