From 274b23148495fc60ae3f78a172d68b79a848e8ac Mon Sep 17 00:00:00 2001
From: JacobPEvans <20714140+JacobPEvans-personal@users.noreply.github.com>
Date: Fri, 24 Jul 2026 14:10:49 -0400
Subject: [PATCH] docs: require off-node runner image builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The github_runner image build (ansible-proxmox-apps #1253) must happen
off-node and `docker load` onto the runner host — a heavy in-place build can
overload a hypervisor node that also runs production guests. Add it to the
on-prem runner requirements.

Assisted-by: Claude:claude-fable-5
Claude-Session: https://claude.ai/code/session_01V9WZuovdDZq7jPaBHjcFei
---
 infrastructure/cicd/policy.mdx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/infrastructure/cicd/policy.mdx b/infrastructure/cicd/policy.mdx
index e71d7e2..79f251d 100644
--- a/infrastructure/cicd/policy.mdx
+++ b/infrastructure/cicd/policy.mdx
@@ -91,6 +91,7 @@ On-prem self-hosted runners are a single point of failure when the job has E2E c
 3. **Expose a process-level healthcheck** (Docker `healthcheck:`, systemd `WatchdogSec`, or equivalent) so failed state surfaces in standard inspection tools.
 4. **Emit a periodic heartbeat** to a dead-man's-switch endpoint (healthchecks.io or equivalent) so silent death pages someone.
 5. **Pre-flight check the secret-injection step** so it fails loud when required secrets are missing.
+6. **Build the runner image off-node** — build it on a dedicated build host and `docker load` it onto the runner host, never build it in-place on a hypervisor node. A heavy image build can overload the node that also runs production guests.
 
 Reference implementation: `orbstack-kubernetes/docker/actions-runner/` — see that repo's `Makefile` `runner-*` targets and `TESTING.md`.