docs(gateway-config): fix stale community sandbox image path

[lunarwhite]

Summary

default_image/bootstrap_image examples in gateway-config.mdx, RFC, and the openshell-server test fixtures point at ghcr.io/nvidia/openshell/sandbox, which #267 removed from this repo in favor of NVIDIA/OpenShell-Community. Pulling that path now returns 403 denied (confirmed registry-side, not environment-specific: sibling gateway/supervisor/helm-chart images return 200 for the same anonymous request).

$ docker pull ghcr.io/nvidia/openshell/sandbox:latest
Error response from daemon: Head "https://ghcr.io/v2/nvidia/openshell/sandbox/manifests/latest": denied

$ docker pull ghcr.io/nvidia/openshell-community/sandboxes/base:latest
latest: Pulling from nvidia/openshell-community/sandboxes/base
Digest: sha256:aeef1c63f00e2913ea002ccb3aaf925f338b5c5d70e63576f0d95c16a138044e
Status: Image is up to date for ghcr.io/nvidia/openshell-community/sandboxes/base:latest
ghcr.io/nvidia/openshell-community/sandboxes/base:latest

This isn't a narrow doc corner: default_image is shared config across all four existing compute drivers (Docker, Podman, Kubernetes, VM) plus any new driver under development, and it's the first non-trivial example value in the "Shared driver defaults" block at the top of the canonical reference doc every driver README points to. I surfaced while building a new experimental compute driver locally. I have verified end-to-end the corrected path passed a full sandbox lifecycle (sandbox create -> exec -> delete) test against a live daemon, on both a cache-miss pull/convert and a cache-hit resolution of the same digest.

Related Issue

N/A. No behavior change.

Changes

Changes

• docs/reference/gateway-config.mdx: update all 6 default_image/bootstrap_image examples to ghcr.io/nvidia/openshell-community/sandboxes/base:latest, rfc/0003-gateway-configuration/README.md: update the 5 default_image examples to the same path
• crates/openshell-server/src/config_file.rs: update the doc-comment example and test fixture strings to the corrected path to avoid future confusion
• Dropped version-style tags (:0.9, :0.9.0) from default_image examples in favor of :latest (community sandbox images only ever publish latest/git-SHA tags, not semver)
• Rebasing onto main surfaced four more instances of the same dead path added by commits merged while this PR was open, fixed test fixtures in crates/openshell-driver-docker/src/tests.rs, crates/openshell-ocsf/tests/roundtrip.rs, and crates/openshell-server/src/compute/mod.rs, plus a real, user-facing SANDBOX_IMAGE default in examples/spiffe-token-exchange-demo/podman/README.md

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[elezar]

As a general nit: Could we use ghcr.io/nvidia/openshell-community/sandboxes/base:latest` everywhere?

The only place we use versions are in tests and I don't think they're relevant there. (I may be missing something though).

[lunarwhite]

@elezar Thanks for your review. Incorporated, and appended one note to the PR description:

Dropped version-style tags (:0.9, :1.0, :0.9.0) from default_image examples in favor of :latest (community sandbox images only ever publish latest/git-SHA tags, not semver)

[lunarwhite]

Hi @elezar, would you please take a relook at this change? Thank you

[lunarwhite]

Hi @johntmyers, I'd be grateful if you could also review and approve this Docs-Fix PR. It should be straightforward. I just did a fresh rebase and found that the same dead path had been introduced by other commits that were merged while this PR was open. This included a real user-facing default:

OpenShell/examples/spiffe-token-exchange-demo/podman/README.md

Line 112 in 9ca19e6

SANDBOX_IMAGE=ghcr.io/nvidia/openshell/sandbox:latest

[elezar]

Reviewed: this consistently replaces the retired sandbox registry path with the canonical community base image. No blocking concerns found.

[elezar]

/ok-to-test 41ab22f

[johntmyers]

We are going to deprecate managed community images. see: #3116

[lunarwhite]

Thanks for sharing the latest plan @johntmyers. Until the Alpine default actually lands, the documented path is still ghcr.io/nvidia/openshell/sandbox, which is a known docs bug. I hit that while standing up a new compute driver locally, and I noticed some new docs being added still referenced the legacy one, which would cause user hiccups.

I hope we can land this first to keep it updated and ensure consistency immediately, then #3116 has one namespace to migrate, instead of both the retired openshell/sandbox references and the community ones.

[johntmyers]

@lunarwhite I'm fine landing this as an interim step. Will you be using dev, pre-releases, or working off of main to continue your work? We've ceased the minor patch release cadence until 0.1.0.

[lunarwhite]

I don't have a preference actually, I'm doing some experimental work locally and just wanted to close a path gap I hit. :)

[lunarwhite]

Hi @johntmyers, just checking could we proceed with merging now, or do you have further comments? Appreciate your time.

[lunarwhite]

Thank you both John and Evan!