Prevent local storage for Pimox workers

README.md

@@ -94,7 +94,8 @@ Set `LAB_PIMOX_PIPELINE=false` to skip Pimox automation. Set
 `LAB_PIMOX_WORKER_COUNT=0` to create or refresh only the template. The pipeline
 keeps the template on its configured `local` storage, creates new worker VM
 clones on `nvme_thin_pool` by default, checks that the Pimox bridge already
-exists, and refuses to edit Orange Pi host networking.
+exists, refuses `local` as worker clone storage, and refuses to edit Orange Pi
+host networking.
 
 The website and demos images default to `linux/arm64` because both deployments
 are pinned to the Raspberry Pi worker. Override with `WEBSITE_IMAGE_PLATFORMS`

bootstrap/provisioning/README.md

@@ -111,7 +111,8 @@ defaults to one worker, VMID `9010`, names like `pimox-worker-01`, deterministic
 locally administered MAC addresses, `nvme_thin_pool` clone storage, and
 qemu-guest-agent IP discovery. New workers are full clones created with
 `qm clone --storage`, so the template can remain on `local` while worker disks
-land on the NVMe thin pool. Useful overrides:
+land on the NVMe thin pool. The pipeline refuses `LAB_PIMOX_WORKER_STORAGE=local`
+so only the template VM lives on local storage. Useful overrides:
 
 ```bash
 LAB_PIMOX_PIPELINE=false ./lab.sh up

lab.sh

@@ -334,6 +334,10 @@ run_pimox_pipeline() {
         echo "LAB_PIMOX_WORKER_STORAGE must be a valid Pimox storage identifier." >&2
         exit 1
     fi
+    if [[ "${worker_storage}" == "local" ]]; then
+        echo "LAB_PIMOX_WORKER_STORAGE cannot be local; only the Pimox template VM should live on local storage." >&2
+        exit 1
+    fi
 
     set +e
     readiness_output="$(pimox_ssh "${pimox_host}" "${pimox_user}" "${pimox_key}" "set -eu