Policy update in Sandbox Policy Quickstart fails with an error #3138

User Story

As a new user, I want to complete the Sandbox Policy Quickstart, so I can make sure OpenShell is working on my machine and learn how to use it.

Problem Statement

In step 4 of the quickstart, trying to run the command for updating the policy in the still-running sandbox returns the following error, and the policy is not updated:

OpenShell$ openshell policy set demo   --policy examples/sandbox-policy-quickstart/policy.yaml   --wait
Error:   × code: 'Client specified an invalid argument', message: "process policy cannot be changed on a live sandbox (applied at startup)"

Impact / Why This Matters

If we extract the current policy from the live sandbox with openshell policy get demo --base and copy the following section into the policy.yaml file before calling openshell policy set, the update succeeds:

process:
  run_as_user: sandbox
  run_as_group: sandbox

However, a new user might be unable to identify this solution, preventing them from completing the quickstart, or at least forcing them to spend time trying to debug the problem. The confusion and frustration might lead the user to give up on using OpenShell altogether. Furthermore, if this same issue occurs in the context of a real application rather than just a tutorial, the user might be unable to update the policy in their running sandbox, blocking their workflow until they can find a solution.

Acceptance Criteria

• The instructions in step 4 of the Sandbox Policy Quickstart can be followed by a user successfully with no errors, without requiring modification to policy.yaml or any other files (or, if modifications are needed, instructions for doing so are included in the quickstart).

Reproduction Steps

1. Run openshell sandbox create --name demo --no-auto-providers --detach to create a running sandbox without attaching it to the terminal.
2. From the top-level directory of the OpenShell repo, run openshell policy set demo --policy examples/sandbox-policy-quickstart/policy.yaml --wait.
3. Observe the following output: Error: × code: 'Client specified an invalid argument', message: "process policy cannot be changed on a live sandbox (applied at startup)"
4. Add the following section to the policy.yaml file (copied from the output of openshell policy get demo --base):

   process:
     run_as_user: sandbox
     run_as_group: sandbox
   

5. Re-run openshell policy set demo --policy examples/sandbox-policy-quickstart/policy.yaml --wait.
6. Observe an output similar to the following:

   ✓ Policy version 2 submitted (hash: 43b6858641b9)
   ✓ Policy version 2 loaded (active version: 2)
   

Environment

• OpenShell: v0.0.116
• OS: Ubuntu 22.04
• Runtime: Docker Engine 29.7.2

Logs