From 834fdcb7719409ea291777e5b95483c47e09e6b5 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Mon, 21 Sep 2026 11:14:52 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=81=A2=E5=A4=8D=20Kata=20DinD=20cgrou?= =?UTF-8?q?p=20=E5=88=9D=E5=A7=8B=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/sandbox-ci-runners/README.md | 4 ++++ platform/sandbox-ci-runners/pools.yaml | 7 ++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/platform/sandbox-ci-runners/README.md b/platform/sandbox-ci-runners/README.md index fd78991..79f7719 100644 --- a/platform/sandbox-ci-runners/README.md +++ b/platform/sandbox-ci-runners/README.md @@ -64,3 +64,7 @@ kubectl -n opensandbox logs deploy/opensandbox-identity -f - runner 等待 SVID：核对 allocation Pod UID、ClusterStaticEntry parentID、guest Agent 日志； - runner 等待 token：核对 `192.168.10.127:8787` 的 sandbox 到 homelab 路由； - Docker 任务失败：检查 `docker` sidecar 和 `/run/docker/docker.sock` 的 group 2000。 +- kind node 的 systemd 报 `Failed to create /init.scope` 或 `Structure needs + cleaning`：确认 `docker` sidecar 通过 `dockerd-entrypoint.sh` 启动。直接执行 + `dockerd` 会绕过官方 DinD cgroup v2 nesting 初始化，使子容器的私有 cgroup + namespace 根变成 `threaded`，systemd 无法创建 domain cgroup。 diff --git a/platform/sandbox-ci-runners/pools.yaml b/platform/sandbox-ci-runners/pools.yaml index 781a6f4..1caf345 100644 --- a/platform/sandbox-ci-runners/pools.yaml +++ b/platform/sandbox-ci-runners/pools.yaml @@ -112,7 +112,12 @@ spec: image: docker.io/library/docker:29.1.5-dind command: [/bin/sh, -c] args: - - test -e /dev/kmsg || mknod /dev/kmsg c 1 11; exec dockerd --host=unix:///run/docker/docker.sock --group=2000 --storage-driver=overlay2 + - | + test -e /dev/kmsg || mknod /dev/kmsg c 1 11 + exec dockerd-entrypoint.sh dockerd \ + --host=unix:///run/docker/docker.sock \ + --group=2000 \ + --storage-driver=overlay2 securityContext: privileged: true volumeMounts: -- 2.54.0