From 762ce6458df90b736cb5f565e86048c6c85f2bcb Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Mon, 21 Sep 2026 06:10:59 +0000
Subject: [PATCH] =?UTF-8?q?=E5=90=AF=E7=94=A8=20OpenSandbox=20VM=20Runner?=
 =?UTF-8?q?=20canary?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 platform/dynamic-runner/README.md       | 12 ++++++------
 platform/dynamic-runner/deployment.yaml | 14 ++++++++++++--
 platform/sandbox-ci-runners/pools.yaml  |  2 +-
 3 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md
index 097f424..1b241bf 100644
--- a/platform/dynamic-runner/README.md
+++ b/platform/dynamic-runner/README.md
@@ -1,8 +1,7 @@
 # Gitea dynamic runner
 
-本目录部署单副本 Go controller，默认在同一进程运行 RunnerService scheduler、原生
-Kubernetes Pod worker 和 SPIFFE mTLS facade。首轮生产 canary 只启用
-`scheduler,pod-worker`，OpenSandbox VM worker 保持关闭：
+本目录部署单副本 Go controller，在同一进程运行 RunnerService scheduler、原生
+Kubernetes Pod worker、OpenSandbox VM worker 和 SPIFFE mTLS facade：
 
 ```text
 Gitea RunnerService -> scheduler -> JetStream ci.runner.pod
@@ -86,9 +85,10 @@ kubectl -n dynamic-runner logs deploy/dynamic-runner-controller -f
 4. 官方 runner v3.5.0 经 facade claim 精确 task，Gitea 实时收到日志和终态；
 5. terminal gate 释放后才领取下一条任务。
 
-当前代码尚未完成 ACK 后 backend lifecycle reconciler，因此 canary 成功后可能留下
-Completed Pod/ClusterStaticEntry。首次测试要人工核对并删除已终态资源；在完整自动清理
-通过前不得提高并发或启用 VM worker。
+Pod 与 VM 都在 Gitea 接受终态后先把 terminal marker 写入各自 backend metadata，再由
+lifecycle reconciler 删除执行器。首次 VM 测试仍须观察 BatchSandbox、Pod 与
+ClusterStaticEntry 全部消失；完整自动清理通过前不得提高 `POD_CAPACITY`、`VM_CAPACITY`
+或 scheduler single-flight 并发。
 
 ## 回滚
 
diff --git a/platform/dynamic-runner/deployment.yaml b/platform/dynamic-runner/deployment.yaml
index ffba79d..e7cd07b 100644
--- a/platform/dynamic-runner/deployment.yaml
+++ b/platform/dynamic-runner/deployment.yaml
@@ -38,12 +38,12 @@ spec:
               mountPath: /trust
       containers:
         - name: controller
-          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:91ef82f49e0117d8973a3c22fbfcc5eab8ac74dc6eb22d70d871ac2998fd0795
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:01324db5e030afa8d8c1289f3802ca9f1d24d8eb5d1f95c46d1f8ae5886442fe
           imagePullPolicy: IfNotPresent
           args: [controller]
           env:
             - name: COMPONENTS
-              value: scheduler,pod-worker
+              value: scheduler,pod-worker,vm-worker
             - name: GITEA_INSTANCE_URL
               value: https://git.ddupan.top
             - name: GITEA_RUNNER_UUID_FILE
@@ -80,6 +80,16 @@ spec:
               value: "2000"
             - name: POD_CAPACITY
               value: "1"
+            - name: OPENSANDBOX_API
+              value: http://10.60.0.13:8080
+            - name: OPENSANDBOX_API_KEY_FILE
+              value: /run/dynamic-runner-secrets/opensandbox-api-key
+            - name: OPENSANDBOX_POOL
+              value: ci-vm
+            - name: VM_CAPACITY
+              value: "1"
+            - name: VM_TIMEOUT_SECONDS
+              value: "14400"
             - name: SPIRE_CLUSTER
               value: homelab
             - name: SPIRE_CLASS
diff --git a/platform/sandbox-ci-runners/pools.yaml b/platform/sandbox-ci-runners/pools.yaml
index 40b6868..781a6f4 100644
--- a/platform/sandbox-ci-runners/pools.yaml
+++ b/platform/sandbox-ci-runners/pools.yaml
@@ -48,7 +48,7 @@ spec:
               mountPath: /opt/opensandbox
       containers:
         - name: sandbox
-          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:a45875fd2d0e67429b0b7bc3914735581669c705bb4e1a05d712134d2bceb86f
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:08f83c9993645dce376140fdde7e29e809795166b2bb32e50cebdbefaf3cf303
           imagePullPolicy: IfNotPresent
           command: [/opt/opensandbox/task-executor]
           args: