docs(gateway-config): fix stale community sandbox image path

crates/openshell-server/src/cli.rs

@@ -1845,7 +1845,7 @@ mem_mib = "not-a-number"
         let file = config_file_from_toml(
             r#"
 [openshell.gateway]
-default_image = "ghcr.io/nvidia/openshell/sandbox:1.0"
+default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 
 [openshell.drivers.kubernetes]
 namespace = "agents"
@@ -1859,7 +1859,10 @@ namespace = "agents"
         let parsed = merged
             .try_into::<openshell_driver_kubernetes::KubernetesComputeConfig>()
             .expect("merged table deserializes");
-        assert_eq!(parsed.default_image, "ghcr.io/nvidia/openshell/sandbox:1.0");
+        assert_eq!(
+            parsed.default_image,
+            "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
+        );
         assert_eq!(parsed.namespace, "agents");
     }
 

crates/openshell-server/src/config_file.rs

@@ -551,7 +551,7 @@ sandbox_namespace = "agents"
 grpc_rate_limit_requests = 120
 grpc_rate_limit_window_seconds = 60
 policy_validation_failure_mode = "retain_last_valid"
-default_image = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 supervisor_image = "ghcr.io/nvidia/openshell/supervisor:latest"
 client_tls_secret_name = "openshell-sandbox-tls"
 service_account_name = "openshell-sandbox"
@@ -578,7 +578,7 @@ namespace = "agents"
         assert_eq!(gw.log_level.as_deref(), Some("info"));
         assert_eq!(
             gw.default_image.as_deref(),
-            Some("ghcr.io/nvidia/openshell/sandbox:latest")
+            Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest")
         );
         assert_eq!(gw.grpc_rate_limit_requests, Some(120));
         assert_eq!(gw.grpc_rate_limit_window_seconds, Some(60));
@@ -971,7 +971,9 @@ version = 2
     #[test]
     fn driver_table_inherits_gateway_defaults() {
         let gateway = GatewayFileSection {
-            default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()),
+            default_image: Some(
+                "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(),
+            ),
             supervisor_image: Some("ghcr.io/nvidia/openshell/supervisor:0.9".to_string()),
             ..Default::default()
         };
@@ -990,7 +992,7 @@ version = 2
         );
         assert_eq!(
             table.get("default_image").and_then(|v| v.as_str()),
-            Some("ghcr.io/nvidia/openshell/sandbox:0.9")
+            Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest")
         );
         assert_eq!(
             table.get("supervisor_image").and_then(|v| v.as_str()),
@@ -1002,7 +1004,9 @@ version = 2
     fn docker_driver_table_inherits_gateway_defaults() {
         let gateway = GatewayFileSection {
             sandbox_namespace: Some("agents".to_string()),
-            default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()),
+            default_image: Some(
+                "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(),
+            ),
             host_gateway_ip: Some("10.0.0.1".to_string()),
             ..Default::default()
         };
@@ -1014,7 +1018,7 @@ version = 2
         );
         assert_eq!(
             table.get("default_image").and_then(|v| v.as_str()),
-            Some("ghcr.io/nvidia/openshell/sandbox:0.9")
+            Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest")
         );
         assert_eq!(
             table.get("host_gateway_ip").and_then(|v| v.as_str()),
@@ -1025,15 +1029,17 @@ version = 2
     #[test]
     fn podman_driver_table_inherits_gateway_host_gateway_ip() {
         let gateway = GatewayFileSection {
-            default_image: Some("ghcr.io/nvidia/openshell/sandbox:0.9".to_string()),
+            default_image: Some(
+                "ghcr.io/nvidia/openshell-community/sandboxes/base:latest".to_string(),
+            ),
             host_gateway_ip: Some("192.168.127.254".to_string()),
             ..Default::default()
         };
         let merged = driver_table(ComputeDriverKind::Podman.as_str(), &gateway, None);
         let table = merged.as_table().expect("table");
         assert_eq!(
             table.get("default_image").and_then(|v| v.as_str()),
-            Some("ghcr.io/nvidia/openshell/sandbox:0.9")
+            Some("ghcr.io/nvidia/openshell-community/sandboxes/base:latest")
         );
         assert_eq!(
             table.get("host_gateway_ip").and_then(|v| v.as_str()),

docs/reference/gateway-config.mdx

@@ -102,7 +102,7 @@ disable_tls = false
 
 # Shared driver defaults. These inherit into [openshell.drivers.<name>] tables
 # when the driver-specific table does not override them.
-default_image           = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image           = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 # Defaults to the gateway version; override to pin a specific build.
 # supervisor_image      = "ghcr.io/nvidia/openshell/supervisor:<version>"
 client_tls_secret_name  = "openshell-client-tls"
@@ -453,7 +453,7 @@ workspace_mode                 = "shared"
 # gateway_id                   = "openshell"
 namespace                      = "agents"
 service_account_name           = "openshell-sandbox"
-default_image                  = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image                  = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 image_pull_policy              = "IfNotPresent"
 image_pull_secrets             = ["regcred"]
 # Defaults to the gateway version; override to pin a specific build.
@@ -566,7 +566,7 @@ compute_drivers = ["docker"]
 
 [openshell.drivers.docker]
 socket_path        = "/var/run/docker.sock"
-default_image      = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image      = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 # Docker vocabulary: Always | IfNotPresent | Never. Empty behaves like IfNotPresent.
 image_pull_policy  = "IfNotPresent"
 sandbox_namespace  = "docker-dev"
@@ -609,7 +609,7 @@ compute_drivers = ["podman"]
 # Omit to auto-detect: the driver probes for a responsive Podman socket and
 # fails to start if none respond.
 socket_path             = "/run/user/1000/podman/podman.sock"
-default_image           = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image           = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 image_pull_policy       = "missing"   # always | missing | never | newer
 grpc_endpoint           = "https://host.containers.internal:17670"
 # The gateway overwrites gateway_port from bind_address at runtime.
@@ -724,10 +724,10 @@ compute_drivers = ["vm"]
 state_dir        = "/var/lib/openshell/vm"
 # Where the gateway looks for the openshell-driver-vm subprocess binary.
 driver_dir       = "/usr/local/libexec/openshell"
-default_image    = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image    = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 grpc_endpoint    = "https://host.containers.internal:17670"
 # Empty falls back to default_image.
-bootstrap_image  = "ghcr.io/nvidia/openshell/sandbox:latest"
+bootstrap_image  = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 krun_log_level   = 1
 vcpus            = 2
 mem_mib          = 2048

rfc/0003-gateway-configuration/README.md

@@ -118,7 +118,7 @@ scopes_claim  = ""                     # empty disables scope enforcement
 
 [openshell.drivers.kubernetes]
 namespace                    = "openshell"
-default_image                = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image                = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 image_pull_policy            = "IfNotPresent"
 supervisor_image             = "ghcr.io/nvidia/openshell/supervisor:latest"
 supervisor_image_pull_policy = "IfNotPresent"
@@ -128,7 +128,7 @@ host_gateway_ip              = "10.0.0.1"
 ssh_socket_path              = "/run/openshell/ssh.sock"
 
 [openshell.drivers.docker]
-default_image     = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image     = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 image_pull_policy = "IfNotPresent"
 sandbox_namespace = "docker-dev"
 grpc_endpoint     = "https://host.openshell.internal:8080"
@@ -141,7 +141,7 @@ guest_tls_key     = "/etc/openshell/certs/client-key.pem"
 
 [openshell.drivers.podman]
 socket_path       = "/run/podman/podman.sock"
-default_image     = "ghcr.io/nvidia/openshell/sandbox:latest"
+default_image     = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 image_pull_policy = "missing"   # Podman vocabulary: always | missing | never | newer
 supervisor_image  = "ghcr.io/nvidia/openshell/supervisor:latest"
 network_name      = "openshell"
@@ -229,7 +229,7 @@ compute_drivers = ["kubernetes"]
 
 [openshell.drivers.kubernetes]
 namespace        = "agents"
-default_image    = "ghcr.io/nvidia/openshell/sandbox:0.9.0"
+default_image    = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 supervisor_image = "ghcr.io/nvidia/openshell/supervisor:0.9.0"
 grpc_endpoint    = "https://openshell-gateway.agents.svc:8080"
 ```
@@ -254,7 +254,7 @@ gateway:
     drivers:
       kubernetes:
         namespace: agents
-        default_image: ghcr.io/nvidia/openshell/sandbox:0.9.0
+        default_image: ghcr.io/nvidia/openshell-community/sandboxes/base:latest
         supervisor_image: ghcr.io/nvidia/openshell/supervisor:0.9.0
 ```