refactor(runtime): retire Community image dependencies

.agents/skills/helm-dev-environment/SKILL.md

@@ -34,7 +34,7 @@ Also applies the upstream agent-sandbox CRDs/controller (pinned via `AGENT_SANDB
 in `tasks/scripts/helm-k3s-local.sh`, fetched from `github.com/kubernetes-sigs/agent-sandbox`
 releases), enables its OTLP tracing on v0.5 and later, installs an OTLP trace
 collector and UI in the `observability` namespace,
-and preloads the default community sandbox image into k3d so the first sandbox create
+and preloads the default sandbox image into k3d so the first sandbox create
 does not wait on a large registry pull. Traefik is disabled at cluster creation time.
 
 **Multi-worktree support:** the cluster name is derived from the last component of the
@@ -52,7 +52,7 @@ Port mappings created at cluster time (cannot be changed without recreating):
 Override with env vars before running `helm:k3s:create`:
 - `HELM_K3S_LB_HOST_PORT` (default: `8080`)
 - `HELM_K3S_PRELOAD_SANDBOX_IMAGE` (default:
-  `ghcr.io/nvidia/openshell-community/sandboxes/base:latest`; set to an empty value to skip)
+  `nvcr.io/nvidia/base/ubuntu:24.04`; set to an empty value to skip)
 - `HELM_K3S_COLLECTOR_IMAGE` (default:
   `mcr.microsoft.com/dotnet/aspire-dashboard:latest`)
 - `HELM_K3S_COLLECTOR_HEALTH_TIMEOUT` (default: `120` seconds)

.agents/skills/update-docs/SKILL.md

@@ -63,7 +63,7 @@ For each relevant commit, determine which doc page(s) it affects. Use this mappi
 | `python/` (SDK changes) | `docs/reference/` or `docs/get-started/quickstart.mdx` |
 | `proto/` (API changes) | `docs/reference/` |
 | `deploy/` (Dockerfile, Helm) | `docs/sandboxes/manage-gateways.mdx`, `docs/about/architecture.mdx` |
-| Community sandbox definitions | `docs/sandboxes/community-sandboxes.mdx` |
+| Sandbox image behavior | `docs/sandboxes/manage-sandboxes.mdx` |
 
 If a commit does not map to any existing page but introduces a user-visible concept, flag it as needing a new page.
 

.github/actions/setup-e2e-kind/action.yml

@@ -80,3 +80,16 @@ runs:
           docker image save --platform linux/amd64 --output "$archive" "$image"
           kind load image-archive "$archive" --name "$CLUSTER_NAME"
         done
+
+    - name: Preload default sandbox image into kind
+      shell: bash
+      env:
+        CLUSTER_NAME: ${{ inputs.cluster-name }}
+        SANDBOX_IMAGE: nvcr.io/nvidia/base/ubuntu:24.04
+      run: |
+        set -euo pipefail
+        archive="${RUNNER_TEMP:-/tmp}/openshell-default-sandbox-linux-amd64.tar"
+        docker pull --platform linux/amd64 "$SANDBOX_IMAGE"
+        docker image inspect "$SANDBOX_IMAGE" --format 'default sandbox image: {{join .RepoDigests ", "}}'
+        docker image save --platform linux/amd64 --output "$archive" "$SANDBOX_IMAGE"
+        kind load image-archive "$archive" --name "$CLUSTER_NAME"

.github/actions/setup-e2e-podman/action.yml

@@ -122,5 +122,5 @@ runs:
         podman run --rm \
           --cap-add=SETPCAP \
           --volume "$probe:/openshell-capbset-probe:ro" \
-          docker.io/library/alpine:3.22 \
+          nvcr.io/nvidia/base/ubuntu:24.04 \
           /openshell-capbset-probe