Vouch request: [dmonakhov]

[dmonakhov]

What do you want to work on?

pytorch fails to work inside sandbox with standard nvcr.io/nvidia/pytorch container out of box.
So trivial torch check fail with scary message which is not clear for majority of non technical people:

openshell sandbox create --name torch-default --gpu \
     --from nvcr.io/nvidia/pytorch:26.10-py3 --no-keep -- python3 -c "import torch"
    Created sandbox: torch-default                                                                                                                                                                                                                                                                                              
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/local/lib/python3.12/dist-packages/torch/__init__.py", line 504, in <module>
    _load_global_deps()
  File "/usr/local/lib/python3.12/dist-packages/torch/__init__.py", line 462, in _load_global_deps
    _preload_cuda_deps(err)
  File "/usr/local/lib/python3.12/dist-packages/torch/__init__.py", line 388, in _preload_cuda_deps
    raise err
  File "/usr/local/lib/python3.12/dist-packages/torch/__init__.py", line 433, in _load_global_deps
    ctypes.CDLL(global_deps_lib_path, mode=ctypes.RTLD_GLOBAL)
  File "/usr/lib/python3.12/ctypes/__init__.py", line 379, in __init__
    self._handle = _dlopen(self._name, mode)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^
OSError: libmpi.so.40: cannot open shared object file: No such file or directory
✓ Sandbox torch-default deletion accepted; cleanup is pending

Why this change?

By default openshell sandbox does not allow to access /opt but it is mandatory for torch to load library from /opt/hpcx,
also it restrict access to /sys/, which makes it impossible for container to read system topology like /sys/devices/system/cpu, as result nccl will not able to bind tasks to correct CPUs.

This is not clear whether /opt and /sys should be accessible by default, but they we definitely need a policy example which allow to work standard ML containers out of box. My PR add exactly that example
Please review : https://github.com/dmonakhov/OpenShell/tree/ngc-pytorch-gpu-example

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md