apiVersion: v1
kind: Pod
metadata:
  name: kata-fc-openclaw
  namespace: agent-runtime
  labels:
    app.kubernetes.io/name: kata-fc-openclaw
    app.kubernetes.io/part-of: firecracker-agent-lab
    cubesandbox-agent-adapter-client: "true"
spec:
  runtimeClassName: kata-fc-lab
  securityContext:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  terminationGracePeriodSeconds: 5
  containers:
    - name: openclaw
      image: docker.io/firecracker-lab/openclaw:2026.8.2-amd64
      imagePullPolicy: Never
      command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
      envFrom:
        - secretRef:
            name: firecracker-agent-model
      env:
        - name: CUBE_ADAPTER_URL
          value: http://cube-agent-adapter-cubesandbox-agent-adapter.agent-runtime.svc:18080
        - name: CUBE_ADAPTER_TOKEN
          valueFrom:
            secretKeyRef:
              name: cube-adapter-auth
              key: token
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          cpu: "2"
          memory: 2Gi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        seccompProfile:
          type: RuntimeDefault
      volumeMounts:
        - name: plugin
          mountPath: /opt/cube-plugin
          readOnly: true
        - name: workspace
          mountPath: /workspace
  volumes:
    - name: plugin
      configMap:
        name: firecracker-openclaw-plugin
    - name: workspace
      emptyDir: {}
---
apiVersion: v1
kind: Pod
metadata:
  name: kata-fc-dsh
  namespace: agent-runtime
  labels:
    app.kubernetes.io/name: kata-fc-dsh
    app.kubernetes.io/part-of: firecracker-agent-lab
    cubesandbox-agent-adapter-client: "true"
spec:
  runtimeClassName: kata-fc-lab
  securityContext:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  terminationGracePeriodSeconds: 5
  containers:
    - name: dsh
      image: docker.io/firecracker-lab/dsh:0.1.2-alpha.4-amd64
      imagePullPolicy: Never
      command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
      envFrom:
        - secretRef:
            name: firecracker-agent-model
      env:
        - name: CUBE_ADAPTER_URL
          value: http://cube-agent-adapter-cubesandbox-agent-adapter.agent-runtime.svc:18080
        - name: CUBE_ADAPTER_TOKEN
          valueFrom:
            secretKeyRef:
              name: cube-adapter-auth
              key: token
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          cpu: "2"
          memory: 2Gi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        seccompProfile:
          type: RuntimeDefault
      volumeMounts:
        - name: plugin
          mountPath: /opt/cube-plugin
          readOnly: true
        - name: workspace
          mountPath: /workspace
  volumes:
    - name: plugin
      configMap:
        name: firecracker-dsh-plugin
    - name: workspace
      emptyDir: {}
---
apiVersion: v1
kind: Pod
metadata:
  name: kata-fc-hermes
  namespace: agent-runtime
  labels:
    app.kubernetes.io/name: kata-fc-hermes
    app.kubernetes.io/part-of: firecracker-agent-lab
    cubesandbox-agent-adapter-client: "true"
spec:
  runtimeClassName: kata-fc-lab
  terminationGracePeriodSeconds: 5
  containers:
    - name: hermes
      image: docker.io/firecracker-lab/hermes:0.21.0-amd64
      imagePullPolicy: Never
      command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
      envFrom:
        - secretRef:
            name: firecracker-agent-model
      env:
        - name: CUBE_ADAPTER_URL
          value: http://cube-agent-adapter-cubesandbox-agent-adapter.agent-runtime.svc:18080
        - name: CUBE_ADAPTER_TOKEN
          valueFrom:
            secretKeyRef:
              name: cube-adapter-auth
              key: token
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          cpu: "2"
          memory: 2Gi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        seccompProfile:
          type: RuntimeDefault
      volumeMounts:
        - name: plugin
          mountPath: /opt/cube-plugin
          readOnly: true
        - name: state
          mountPath: /opt/data
        - name: workspace
          mountPath: /workspace
  volumes:
    - name: plugin
      configMap:
        name: firecracker-hermes-plugin
    - name: state
      emptyDir: {}
    - name: workspace
      emptyDir: {}
---
apiVersion: v1
kind: Pod
metadata:
  name: kata-fc-codex
  namespace: agent-runtime
  labels:
    app.kubernetes.io/name: kata-fc-codex
    app.kubernetes.io/part-of: firecracker-agent-lab
    cubesandbox-agent-adapter-client: "true"
spec:
  runtimeClassName: kata-fc-lab
  terminationGracePeriodSeconds: 5
  containers:
    - name: codex
      image: docker.io/firecracker-lab/codex:0.150.1-amd64
      imagePullPolicy: Never
      command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
      env:
        - name: CUBE_ADAPTER_URL
          value: http://cube-agent-adapter-cubesandbox-agent-adapter.agent-runtime.svc:18080
        - name: CUBE_ADAPTER_TOKEN
          valueFrom:
            secretKeyRef:
              name: cube-adapter-auth
              key: token
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          cpu: "2"
          memory: 2Gi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        seccompProfile:
          type: RuntimeDefault
      volumeMounts:
        - name: codex-home
          mountPath: /root/.codex
        - name: workspace
          mountPath: /work
  volumes:
    - name: codex-home
      emptyDir: {}
    - name: workspace
      emptyDir: {}