diff --git a/platform/sandbox-ci-runners/README.md b/platform/sandbox-ci-runners/README.md
index fd78991..79f7719 100644
--- a/platform/sandbox-ci-runners/README.md
+++ b/platform/sandbox-ci-runners/README.md
@@ -64,3 +64,7 @@ kubectl -n opensandbox logs deploy/opensandbox-identity -f
 - runner 等待 SVID：核对 allocation Pod UID、ClusterStaticEntry parentID、guest Agent 日志；
 - runner 等待 token：核对 `192.168.10.127:8787` 的 sandbox 到 homelab 路由；
 - Docker 任务失败：检查 `docker` sidecar 和 `/run/docker/docker.sock` 的 group 2000。
+- kind node 的 systemd 报 `Failed to create /init.scope` 或 `Structure needs
+  cleaning`：确认 `docker` sidecar 通过 `dockerd-entrypoint.sh` 启动。直接执行
+  `dockerd` 会绕过官方 DinD cgroup v2 nesting 初始化，使子容器的私有 cgroup
+  namespace 根变成 `threaded`，systemd 无法创建 domain cgroup。
diff --git a/platform/sandbox-ci-runners/pools.yaml b/platform/sandbox-ci-runners/pools.yaml
index 781a6f4..1caf345 100644
--- a/platform/sandbox-ci-runners/pools.yaml
+++ b/platform/sandbox-ci-runners/pools.yaml
@@ -112,7 +112,12 @@ spec:
           image: docker.io/library/docker:29.1.5-dind
           command: [/bin/sh, -c]
           args:
-            - test -e /dev/kmsg || mknod /dev/kmsg c 1 11; exec dockerd --host=unix:///run/docker/docker.sock --group=2000 --storage-driver=overlay2
+            - |
+              test -e /dev/kmsg || mknod /dev/kmsg c 1 11
+              exec dockerd-entrypoint.sh dockerd \
+                --host=unix:///run/docker/docker.sock \
+                --group=2000 \
+                --storage-driver=overlay2
           securityContext:
             privileged: true
           volumeMounts: