platform/dynamic-runner/README.md

@@ -1,8 +1,7 @@
 # Gitea dynamic runner
 
-本目录部署单副本 Go controller，默认在同一进程运行 RunnerService scheduler、原生
-Kubernetes Pod worker 和 SPIFFE mTLS facade。首轮生产 canary 只启用
-`scheduler,pod-worker`，OpenSandbox VM worker 保持关闭：
+本目录部署单副本 Go controller，在同一进程运行 RunnerService scheduler、原生
+Kubernetes Pod worker、OpenSandbox VM worker 和 SPIFFE mTLS facade：
 
 ```text
 Gitea RunnerService -> scheduler -> JetStream ci.runner.pod
@@ -86,9 +85,10 @@ kubectl -n dynamic-runner logs deploy/dynamic-runner-controller -f
 4. 官方 runner v3.5.0 经 facade claim 精确 task，Gitea 实时收到日志和终态；
 5. terminal gate 释放后才领取下一条任务。
 
-当前代码尚未完成 ACK 后 backend lifecycle reconciler，因此 canary 成功后可能留下
-Completed Pod/ClusterStaticEntry。首次测试要人工核对并删除已终态资源；在完整自动清理
-通过前不得提高并发或启用 VM worker。
+Pod 与 VM 都在 Gitea 接受终态后先把 terminal marker 写入各自 backend metadata，再由
+lifecycle reconciler 删除执行器。首次 VM 测试仍须观察 BatchSandbox、Pod 与
+ClusterStaticEntry 全部消失；完整自动清理通过前不得提高 `POD_CAPACITY`、`VM_CAPACITY`
+或 scheduler single-flight 并发。
 
 ## 回滚
 

platform/dynamic-runner/deployment.yaml

@@ -38,12 +38,12 @@ spec:
               mountPath: /trust
       containers:
         - name: controller
-          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:91ef82f49e0117d8973a3c22fbfcc5eab8ac74dc6eb22d70d871ac2998fd0795
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:01324db5e030afa8d8c1289f3802ca9f1d24d8eb5d1f95c46d1f8ae5886442fe
           imagePullPolicy: IfNotPresent
           args: [controller]
           env:
             - name: COMPONENTS
-              value: scheduler,pod-worker
+              value: scheduler,pod-worker,vm-worker
             - name: GITEA_INSTANCE_URL
               value: https://git.ddupan.top
             - name: GITEA_RUNNER_UUID_FILE
@@ -80,6 +80,16 @@ spec:
               value: "2000"
             - name: POD_CAPACITY
               value: "1"
+            - name: OPENSANDBOX_API
+              value: http://10.60.0.13:8080
+            - name: OPENSANDBOX_API_KEY_FILE
+              value: /run/dynamic-runner-secrets/opensandbox-api-key
+            - name: OPENSANDBOX_POOL
+              value: ci-vm
+            - name: VM_CAPACITY
+              value: "1"
+            - name: VM_TIMEOUT_SECONDS
+              value: "14400"
             - name: SPIRE_CLUSTER
               value: homelab
             - name: SPIRE_CLASS

platform/sandbox-ci-runners/pools.yaml

@@ -48,7 +48,7 @@ spec:
               mountPath: /opt/opensandbox
       containers:
         - name: sandbox
-          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:a45875fd2d0e67429b0b7bc3914735581669c705bb4e1a05d712134d2bceb86f
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:08f83c9993645dce376140fdde7e29e809795166b2bb32e50cebdbefaf3cf303
           imagePullPolicy: IfNotPresent
           command: [/opt/opensandbox/task-executor]
           args: