docs(docker-to-sealos): document sandbox storage pressure (#69)

Author: yangchuansheng

skills/docker-to-sealos/references/conversion-mappings.md

@@ -991,7 +991,9 @@ metadata:
 ### Existing Template Resource Tuning
 - Tune CPU and memory through the Sealos resource ladder.
 - Preserve existing `ephemeral-storage` requests and limits exactly during template refreshes.
-- Change `ephemeral-storage` only when runtime evidence shows `EphemeralStorage`, eviction, or disk-pressure failures for that workload.
+- Change `ephemeral-storage` only when live evidence shows `EphemeralStorage`, eviction, or disk-pressure failures for that workload.
+- Adjust `requests.ephemeral-storage` and `limits.ephemeral-storage` together for the same container.
+- Choose the smallest common Mi value that covers observed writable-layer usage plus startup margin; Dify sandbox uses `512Mi` after `300Mi` eviction and observed runner expansion under `/opt` and `/var/sandbox`.
 
 ### Configuration Files
 - Docker config files → ConfigMap (using vn- naming convention)

skills/docker-to-sealos/references/runtime-log-hygiene.md

@@ -63,6 +63,32 @@ Fix pattern:
 3. Keep PVCs for real user data and writable runtime state.
 4. Redeploy fresh and re-run setup/login plus log scan.
 
+## Ephemeral Local Storage Pressure
+
+Tune `ephemeral-storage` only from live runtime evidence.
+
+Detection signals:
+
+- Events contain `Pod ephemeral local storage usage exceeds the total limit of containers ...`.
+- The pod is repeatedly `Evicted` while the workload's main process otherwise starts.
+- `kubectl describe pod` shows tight `requests.ephemeral-storage` and `limits.ephemeral-storage` values for the failing container.
+- Logs show large runtime extraction or dependency bootstrap shortly before eviction.
+
+Debug pattern:
+
+1. Inspect recent events with `kubectl get events --sort-by=.lastTimestamp` and filter for the workload name, `Evicted`, or `ephemeral`.
+2. Inspect the failing container resources with `kubectl describe pod` or `kubectl get pod -o jsonpath`.
+3. When the pod survives long enough, run `du -sh /opt /var /var/sandbox /tmp /root /var/cache 2>/dev/null` inside the container to identify runtime-expanded directories.
+4. Patch the live workload to the smallest Mi value that covers observed writable-layer usage with startup margin.
+5. Observe beyond the previous eviction window, then update both `requests.ephemeral-storage` and `limits.ephemeral-storage` together in the template.
+
+Dify sandbox case study:
+
+- `langgenius/dify-sandbox:0.2.15` expands Node and Python runner assets during startup.
+- Observed writable-layer directories included `/opt/node-v20.20.0-linux-x64` at about `167Mi` and `/var/sandbox` at about `174Mi`.
+- `300Mi` caused repeated eviction with `Pod ephemeral local storage usage exceeds the total limit of containers 300Mi`.
+- `512Mi` kept `dify-sandbox` Ready with zero restarts after the old eviction window.
+
 ## Restricted-Compatible Security Context
 
 When the image default UID is verified as non-root through image metadata, upstream docs, or `id` inside a live container, set restricted-compatible security context on managed app workloads and init Jobs: