refactor(sandbox)!: retire community images and default to Alpine

[drew]

User Story

As an OpenShell user, I want a neutral, generic sandbox image as the default and explicit image selection for agent-specific environments, so that the core OpenShell experience does not depend on a separately maintained community image catalog.

Problem Statement

OpenShell currently defaults to ghcr.io/nvidia/openshell-community/sandboxes/base:latest. The CLI and TUI also expand bare --from values into the OpenShell Community registry, and deployment configuration, tests, documentation, examples, and agent skills depend on the NVIDIA/OpenShell-Community repository and its images.

The community base image also supplies behavior beyond a generic container image, including preinstalled tools and the default sandbox policy. These implicit dependencies must be removed before the community repository can be retired and before the 0.1.0 sandbox contract is stabilized.

Impact / Why This Matters

The current default couples OpenShell releases and basic sandbox creation to a separate repository, registry namespace, curated toolchain, and image-baked policy. It also makes a default sandbox appear agent-ready even though the installed tools and policy are external to the core product's compatibility surface.

Users can already pass an explicit OCI image with --from or configure a gateway default, but that workaround does not remove the product's built-in dependency or clarify which behavior OpenShell itself supports. Retiring the catalog is a breaking change for users who rely on community shorthand names, preinstalled agents, or the community base image's policy, so 0.1.0 needs an explicit migration path.

Proposed Design

Use an official, version-qualified Alpine image as the default sandbox image across supported compute drivers and deployment methods. A sandbox created without --from should start from that generic image rather than an OpenShell-curated agent environment.

Remove implicit community catalog resolution from the CLI and TUI, including the community registry override. Continue to support explicit OCI image references and operator-configured defaults for users who need custom tools or agent runtimes.

Move or replace any policy, user-identity, filesystem, startup, and test assumptions currently supplied by the community base image so that the supported default works with an unmodified Alpine image. Update user-facing guidance to make BYOC or another explicit image source the workflow for agent-specific environments.

After all OpenShell consumers have migrated, decommission NVIDIA/OpenShell-Community and stop presenting its repository and registry namespace as supported OpenShell distribution channels.

Acceptance Criteria

• A fresh OpenShell installation uses a documented, version-qualified official Alpine image when sandbox creation does not specify an image.
• The Alpine default is consistent across Docker, Podman, Kubernetes, and VM driver defaults, Helm and standalone deployment configuration, and packaged examples.
• Creating a sandbox with the default Alpine image succeeds on supported compute drivers and has end-to-end coverage.
• CLI and TUI image handling no longer expand bare names into ghcr.io/nvidia/openshell-community/sandboxes, and OPENSHELL_COMMUNITY_REGISTRY is removed.
• Policy, user-identity, filesystem, and startup behavior required by OpenShell no longer depends on files or tools baked into the community base image.
• Tests, development tasks, examples, and agent skills no longer require community images or the community registry namespace.
• Published documentation no longer advertises the community catalog or preinstalled agent environments and instead documents explicit OCI images and BYOC.
• The 0.1.0 upgrade guide explains the default-image change, removal of community shorthand, and migration for users who relied on the base image's tools or policy.
• NVIDIA/OpenShell-Community is decommissioned after its OpenShell consumers are removed, and supported OpenShell workflows no longer link to or pull from it.
• Explicit user-provided OCI images and operator-configured default images continue to work.

Alternatives Considered

Keep the community repository as an optional catalog while changing only the default. This retains a separate support and release surface and leaves shorthand resolution in the stable CLI contract.

Publish a new OpenShell-specific minimal base image. This would move the dependency but would not provide the neutral, generic default intended by this change.

Require every sandbox creation request to specify an image. This is explicit, but it removes a useful default and makes first-run workflows less approachable when a generic Alpine environment is sufficient.

Parent Issue

• Stabilize public API, SDK, and extension contracts for 0.1.0 #2565

[akram]

@drew I am interested in working on that. Any suggestion on how to "qualify" which official Alpine to use?
Any requirements for that?

[akram]

@drew I tried a stock alpine:3.21 sandbox and hit a hard blocker: in NetworkMode::Proxy the supervisor creates a per-workload netns by shelling out to ip netns add (create_netns_for_proxy in crates/openshell-supervisor-process/src/netns/mod.rs). Stock Alpine only ships BusyBox ip, which has no netns subcommand, so startup fails:

Network namespace creation failed and proxy mode requires isolation.
/sbin/ip netns add sandbox-XXXX failed: BusyBox v1.37.0 ...

So using an entirely stock image may not be straightforward without installing iproute2 — do you consider doing so as still using "an unmodified Alpine image"? (The sidecar enforcement path doesn't use ip netns and is unaffected.)

[akram]

@drew another blocker found if we want to use Alpine images: the supervisor was failing to start with failed to spawn sandbox entrypoint process: No such file or directory (os error 2) — an opaque ENOENT that didn't say what was missing.

After instrumenting the spawn path and adding logs, it turns out /bin/bash is what's being invoked: the default sandbox command is /bin/bash -l (openshell-sandbox/src/main.rs), and the interactive SSH path calls Command::new("/bin/bash") (ssh.rs), plus SHELL=/bin/bash is set in a couple of places. bash is absent from Alpine (only /bin/sh/BusyBox ash), so startup failed. Confirmed it's not a libc issue — busybox:glibc fails the same way, Debian-based images (which ship bash) work.

I'll open an issue to track this and start working on a fix.