Initial cursor-devbox: image, deploy manifests, and Flux SHA automation.

Owns Dockerfile/CI and node1 workload YAML; ImagePolicy elects run_number-sha tags and ImageUpdateAutomation commits them into deploy/.
2026-09-20 12:57:44 +00:00
commit 05ea40562c
8 changed files with 459 additions and 0 deletions
@@ -0,0 +1,113 @@
+# StatefulSet: OpenSSH workspace + DinD sidecar.
+# Image tag is updated by Flux ImageUpdateAutomation (SHA-bearing run_number-sha tags).
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: cursor-devbox
+  namespace: cursor-devbox
+spec:
+  serviceName: cursor-devbox
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cursor-devbox
+  template:
+    metadata:
+      labels:
+        app: cursor-devbox
+      annotations:
+        linkerd.io/inject: disabled
+    spec:
+      terminationGracePeriodSeconds: 30
+      imagePullSecrets:
+        - name: dcr-registry-auth-ro
+      containers:
+        - name: ssh
+          image: dcr.trinitysan.by/infra/cursor-devbox:latest # {"$imagepolicy": "flux-system:cursor-devbox"}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: ssh
+              containerPort: 22
+            - name: http
+              containerPort: 8080
+          env:
+            - name: DOCKER_HOST
+              value: tcp://127.0.0.1:2375
+            - name: HOME
+              value: /home/developer
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - SYS_PTRACE
+          resources:
+            requests:
+              cpu: "750m"
+              memory: 3Gi
+            limits:
+              cpu: "4"
+              memory: 8Gi
+          readinessProbe:
+            tcpSocket:
+              port: ssh
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: ssh
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          volumeMounts:
+            - name: home
+              mountPath: /home/developer
+              subPath: home
+            - name: authorized-keys
+              mountPath: /etc/ssh-authorized-keys
+              readOnly: true
+        - name: dind
+          image: docker:27-dind
+          imagePullPolicy: IfNotPresent
+          args:
+            - --host=tcp://0.0.0.0:2375
+            - --tls=false
+          env:
+            - name: DOCKER_TLS_CERTDIR
+              value: ""
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: "250m"
+              memory: 1Gi
+            limits:
+              cpu: "2"
+              memory: 4Gi
+          readinessProbe:
+            tcpSocket:
+              port: 2375
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          volumeMounts:
+            - name: home
+              mountPath: /var/lib/docker
+              subPath: docker
+            - name: dind-run
+              mountPath: /var/run
+      volumes:
+        - name: authorized-keys
+          configMap:
+            name: cursor-devbox-authorized-keys
+        - name: dind-run
+          emptyDir: {}
+  volumeClaimTemplates:
+    - metadata:
+        name: home
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-storage
+        resources:
+          requests:
+            storage: 30Gi