--- apiVersion: sandbox.opensandbox.io/v1alpha1 kind: Pool metadata: name: ci-vm namespace: opensandbox labels: app.kubernetes.io/name: gitea-ci-vm app.kubernetes.io/component: runner-pool spec: capacitySpec: bufferMax: 0 bufferMin: 0 poolMax: 2 poolMin: 0 recycleStrategy: type: Delete template: metadata: labels: app.kubernetes.io/name: gitea-ci-vm ci.ddupan.top/backend: vm spec: runtimeClassName: kata-clh-runtime-rs serviceAccountName: gitea-ci restartPolicy: Never terminationGracePeriodSeconds: 30 shareProcessNamespace: true securityContext: fsGroup: 2000 fsGroupChangePolicy: OnRootMismatch initContainers: - name: task-executor-installer image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0 command: [/bin/sh, -c] args: - cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor volumeMounts: - name: opensandbox-bin mountPath: /opt/opensandbox - name: execd-installer image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22 command: [/bin/sh, -c] args: - cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh volumeMounts: - name: opensandbox-bin mountPath: /opt/opensandbox containers: - name: sandbox image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:325d75a208b1a1c6f3b4d4705e47bbc58b34733edcd12f689c60769ab6772a59 imagePullPolicy: IfNotPresent command: [/opt/opensandbox/task-executor] args: - -listen-addr=0.0.0.0:5758 - -log-dir=/tmp - -data-dir=/tmp/tasks env: - name: SANDBOX_MAIN_CONTAINER value: sandbox - name: EXECD_ENVS value: /opt/opensandbox/.env - name: EXECD value: /opt/opensandbox/execd - name: GITEA_INSTANCE_URL value: https://git.ddupan.top - name: HOME value: /data ports: - name: task-executor containerPort: 5758 securityContext: privileged: true runAsNonRoot: true runAsUser: 2000 runAsGroup: 2000 resources: requests: cpu: "2" memory: 3Gi limits: cpu: "2" memory: 3Gi volumeMounts: - name: opensandbox-bin mountPath: /opt/opensandbox - name: runner-data mountPath: /data - name: runner-workspace mountPath: /workspace - name: spire-socket mountPath: /run/spire/agent-sockets - name: spire-agent image: ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff args: [-config, /run/spire/config/agent.conf] securityContext: allowPrivilegeEscalation: false capabilities: drop: [ALL] volumeMounts: - name: spire-config mountPath: /run/spire/config readOnly: true - name: spire-bundle mountPath: /run/spire/bundle readOnly: true - name: spire-token mountPath: /run/spire/tokens readOnly: true - name: spire-data mountPath: /run/spire/data - name: spire-socket mountPath: /run/spire/agent-sockets volumes: - name: opensandbox-bin emptyDir: {} - name: runner-data emptyDir: {} - name: runner-workspace emptyDir: {} - name: spire-data emptyDir: medium: Memory - name: spire-socket emptyDir: medium: Memory - name: spire-config configMap: name: gitea-ci-spire-agent - name: spire-bundle configMap: name: spire-bundle-pem - name: spire-token projected: sources: - serviceAccountToken: audience: spire-server expirationSeconds: 3600 path: token --- apiVersion: sandbox.opensandbox.io/v1alpha1 kind: Pool metadata: name: ci-pod namespace: opensandbox labels: app.kubernetes.io/name: gitea-ci-pod app.kubernetes.io/component: runner-pool spec: capacitySpec: bufferMax: 0 bufferMin: 0 poolMax: 4 poolMin: 0 recycleStrategy: type: Delete template: metadata: labels: app.kubernetes.io/name: gitea-ci-pod ci.ddupan.top/backend: pod spec: serviceAccountName: gitea-ci restartPolicy: Never terminationGracePeriodSeconds: 30 shareProcessNamespace: true securityContext: fsGroup: 2000 fsGroupChangePolicy: OnRootMismatch initContainers: - name: task-executor-installer image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0 command: [/bin/sh, -c] args: - cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor volumeMounts: - name: opensandbox-bin mountPath: /opt/opensandbox - name: execd-installer image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22 command: [/bin/sh, -c] args: - cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh volumeMounts: - name: opensandbox-bin mountPath: /opt/opensandbox containers: - name: sandbox image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:325d75a208b1a1c6f3b4d4705e47bbc58b34733edcd12f689c60769ab6772a59 imagePullPolicy: IfNotPresent command: [/opt/opensandbox/task-executor] args: - -listen-addr=0.0.0.0:5758 - -log-dir=/tmp - -data-dir=/tmp/tasks env: - name: SANDBOX_MAIN_CONTAINER value: sandbox - name: EXECD_ENVS value: /opt/opensandbox/.env - name: EXECD value: /opt/opensandbox/execd - name: GITEA_INSTANCE_URL value: https://git.ddupan.top - name: HOME value: /data - name: DOCKER_HOST value: unix:///run/docker/docker.sock ports: - name: task-executor containerPort: 5758 securityContext: allowPrivilegeEscalation: false capabilities: drop: [ALL] runAsNonRoot: true runAsUser: 2000 runAsGroup: 2000 volumeMounts: - name: opensandbox-bin mountPath: /opt/opensandbox - name: runner-data mountPath: /data - name: runner-workspace mountPath: /workspace - name: docker-socket mountPath: /run/docker - name: spire-socket mountPath: /run/spire/agent-sockets - name: spire-agent image: ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff args: [-config, /run/spire/config/agent.conf] securityContext: allowPrivilegeEscalation: false capabilities: drop: [ALL] volumeMounts: - name: spire-config mountPath: /run/spire/config readOnly: true - name: spire-bundle mountPath: /run/spire/bundle readOnly: true - name: spire-token mountPath: /run/spire/tokens readOnly: true - name: spire-data mountPath: /run/spire/data - name: spire-socket mountPath: /run/spire/agent-sockets - name: docker image: docker.io/library/docker:29.1.5-dind command: [/bin/sh, -c] args: - test -e /dev/kmsg || mknod /dev/kmsg c 1 11; exec dockerd --host=unix:///run/docker/docker.sock --group=2000 --storage-driver=overlay2 securityContext: privileged: true volumeMounts: - name: docker-socket mountPath: /run/docker - name: docker-data mountPath: /var/lib/docker volumes: - name: opensandbox-bin emptyDir: {} - name: runner-data emptyDir: {} - name: runner-workspace emptyDir: {} - name: docker-data emptyDir: {} - name: docker-socket emptyDir: medium: Memory - name: spire-data emptyDir: medium: Memory - name: spire-socket emptyDir: medium: Memory - name: spire-config configMap: name: gitea-ci-spire-agent - name: spire-bundle configMap: name: spire-bundle-pem - name: spire-token projected: sources: - serviceAccountToken: audience: spire-server expirationSeconds: 3600 path: token