ADR-0007 — Daytona 0.0.26 uses Kubernetes-assigned privileged Docker and Sysbox runners

Status: Accepted, corrected 2026-07-16

Context

Official chart hard-codes daytona-sandbox-c=true on runner DaemonSet. Live proof showed zero matching nodes, No available runners, and pending snapshots. Chart default installer also mounts broad host runtime paths. Runner image constructs Docker client and passes CONTAINER_RUNTIME as Docker runtime name.

Decision

Keep runnermanager and required runner DaemonSet.
Use VM145 as sole agent-execution node.
Require chart, workload, and verified-runtime labels before sync.
Set CONTAINER_RUNTIME=sysbox-runc.
Treat the infrastructure runner registration token as Daytona runtime state, not AgentSquad identity. A read-only compatibility hook resolves the one VM145 runner record, verifies /runners/me, and projects only its API key into an exact Kubernetes Secret. The runner mounts that key as a read-only 0600 file, so Pod rolls recover without a host token or admin API fallback.
Add only the exact /var/run/docker.sock Assembly volume. Do not add another broad /var/run mount.
Disable chart installer. Assembly host bootstrap owns Debian Docker, Sysbox, and Harbor CA trust.
Taint node sandbox=true:NoSchedule; runner and placeholder tolerate it.
Run read-only PreSync gate. Zero or multiple eligible nodes fail deployment.

The unmodified upstream runner remains privileged with hostNetwork, hostPID, containerd socket, read-only host root and Docker data, and writable runner state mounts. Chart 0.0.26 has no values to remove these required surfaces. FractalOps accepts and contract-tests them on the isolated runner node instead of forking the chart; removing them requires an upstream capability or native per-sandbox Pods.

Consequences

Agent sandboxes share one dedicated host Docker plane, but no longer start on arbitrary storage/general nodes.
Compromise of the upstream runner is equivalent to compromise of VM145. No general workload may schedule on that tainted node.
Runner restart remains sandbox failure-domain. Native per-sandbox Pod migration remains future work.
Stale runner records remain reaper input; agent profile, worktree, mailbox, and context continuity never depend on a Daytona runner record.
/mnt/token.txt is forbidden legacy state. The registration key stays in the Kubernetes Secret plane and is re-resolved from Daytona’s database on sync.
Host runtime and CA rotation use one Assembly operation: platform/k8s/apps/daytona/reconcile_runner_node.sh apply.

Evidence

CUE generates environment-specific runner placement and installer state.
Chart render test checks exact added socket, upstream privileged host surfaces, Sysbox, affinity, and missing installer.
Live VM145 verification checks Docker, Sysbox, Harbor CA, taint, labels, and runner DaemonSet readiness.
Disposable AgentSquad canary consumes release-bound tag and records exact build digest because Daytona 0.184 rejects OCI tag@digest snapshot input.

Revision History

2026-07-16: Corrected native-Pod claim and added verified VM145 runner contract.
2026-07-16: Replaced host/pod-local registration state with a read-only Kubernetes Secret projection and exact runtime reconciliation.