commit 66ed21b48a9e6dbe24f140f0db0f3349c6725da3
Author: CI Demo <ci@ethan2048.top>
Date:   Sun Nov 15 17:57:33 2026 +0800

    ci: helloworld sandbox demo

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..8184bdf
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,37 @@
+name: helloworld
+on: [push]
+
+jobs:
+  hello:
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Show environment
+        run: |
+          echo "whoami=$(id)"
+          echo "pwd=$PWD"
+          cat /etc/os-release | head -2
+          echo "node=$(node --version)"
+          echo "git=$(git --version)"
+
+      - name: apt install is isolated
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq cowsay
+          echo "inside sandbox: $(command -v cowsay || echo missing)"
+          cowsay "hello from overlay sandbox" || true
+
+      - name: Host must not see cowsay
+        run: |
+          # This still runs inside the same job overlay — host check is implied
+          # by the runner's read-only rootfs template; upper dies after the job.
+          ls /var/lib/dpkg/info/cowsay.list
+          echo "package lives in overlay upper (discarded after job)"
+
+      - name: Workspace is shared with host
+        run: |
+          echo "workspace-content" > marker.txt
+          cat marker.txt
+          ls -la
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..67aff02
--- /dev/null
+++ b/README.md
@@ -0,0 +1,7 @@
+# helloworld
+
+Gitea Actions sandbox demo on NAS (`nas-arm` runner).
+
+- Host mode + kernel overlay + bwrap
+- `apt install` only writes the per-job overlay upper
+- Host rootfs template is read-only