[pull] main from NVIDIA:main

.agents/skills/helm-dev-environment/SKILL.md

@@ -34,7 +34,7 @@ Also applies the upstream agent-sandbox CRDs/controller (pinned via `AGENT_SANDB
 in `tasks/scripts/helm-k3s-local.sh`, fetched from `github.com/kubernetes-sigs/agent-sandbox`
 releases), enables its OTLP tracing on v0.5 and later, installs an OTLP trace
 collector and UI in the `observability` namespace,
-and preloads the default community sandbox image into k3d so the first sandbox create
+and preloads the default sandbox image into k3d so the first sandbox create
 does not wait on a large registry pull. Traefik is disabled at cluster creation time.
 
 **Multi-worktree support:** the cluster name is derived from the last component of the
@@ -52,7 +52,7 @@ Port mappings created at cluster time (cannot be changed without recreating):
 Override with env vars before running `helm:k3s:create`:
 - `HELM_K3S_LB_HOST_PORT` (default: `8080`)
 - `HELM_K3S_PRELOAD_SANDBOX_IMAGE` (default:
-  `ghcr.io/nvidia/openshell-community/sandboxes/base:latest`; set to an empty value to skip)
+  `nvcr.io/nvidia/base/ubuntu:24.04`; set to an empty value to skip)
 - `HELM_K3S_COLLECTOR_IMAGE` (default:
   `mcr.microsoft.com/dotnet/aspire-dashboard:latest`)
 - `HELM_K3S_COLLECTOR_HEALTH_TIMEOUT` (default: `120` seconds)

.agents/skills/update-docs/SKILL.md

@@ -63,7 +63,7 @@ For each relevant commit, determine which doc page(s) it affects. Use this mappi
 | `python/` (SDK changes) | `docs/reference/` or `docs/get-started/quickstart.mdx` |
 | `proto/` (API changes) | `docs/reference/` |
 | `deploy/` (Dockerfile, Helm) | `docs/sandboxes/manage-gateways.mdx`, `docs/about/architecture.mdx` |
-| Community sandbox definitions | `docs/sandboxes/community-sandboxes.mdx` |
+| Sandbox image behavior | `docs/sandboxes/manage-sandboxes.mdx` |
 
 If a commit does not map to any existing page but introduces a user-visible concept, flag it as needing a new page.
 

.github/actions/build-rust-binary/action.yml

@@ -32,21 +32,10 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Hash development shell
-      id: dev-shell
-      shell: bash
-      run: |
-        shell_drv=$(nix eval --raw --impure .#devShells --apply 'shells: shells.${builtins.currentSystem}.default.drvPath')
-        echo "hash=$(nix hash file --type sha256 --base16 "$shell_drv")" >> "$GITHUB_OUTPUT"
-
-    - name: Cache Rust artifacts
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+    - uses: ./.github/actions/setup-rust
       with:
-        shared-key: binaries-${{ inputs.binary }}-${{ inputs.triple }}-${{ steps.dev-shell.outputs.hash }}
-        cache-on-failure: "true"
-        cache-workspace-crates: "true"
-        cache-bin: "false"
-        cmd-format: nix develop -c {0}
+        cache-key: binaries-v2-${{ inputs.binary }}-${{ inputs.triple }}
+        save-cache: "true"
 
     - name: Set version
       shell: nix develop -c bash -euo pipefail {0}

.github/actions/setup-e2e-kind/action.yml

@@ -80,3 +80,16 @@ runs:
           docker image save --platform linux/amd64 --output "$archive" "$image"
           kind load image-archive "$archive" --name "$CLUSTER_NAME"
         done
+
+    - name: Preload default sandbox image into kind
+      shell: bash
+      env:
+        CLUSTER_NAME: ${{ inputs.cluster-name }}
+        SANDBOX_IMAGE: nvcr.io/nvidia/base/ubuntu:24.04
+      run: |
+        set -euo pipefail
+        archive="${RUNNER_TEMP:-/tmp}/openshell-default-sandbox-linux-amd64.tar"
+        docker pull --platform linux/amd64 "$SANDBOX_IMAGE"
+        docker image inspect "$SANDBOX_IMAGE" --format 'default sandbox image: {{join .RepoDigests ", "}}'
+        docker image save --platform linux/amd64 --output "$archive" "$SANDBOX_IMAGE"
+        kind load image-archive "$archive" --name "$CLUSTER_NAME"

.github/actions/setup-e2e-podman/action.yml

@@ -122,5 +122,5 @@ runs:
         podman run --rm \
           --cap-add=SETPCAP \
           --volume "$probe:/openshell-capbset-probe:ro" \
-          docker.io/library/alpine:3.22 \
+          nvcr.io/nvidia/base/ubuntu:24.04 \
           /openshell-capbset-probe

.github/actions/setup-rust/action.yml

@@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup Rust
+description: Configure the Nix development shell and Rust caches
+
+inputs:
+  cache-key:
+    description: Rust target cache namespace
+    required: true
+  save-cache:
+    description: Whether this job writes the Rust target cache
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Hash Nix development shell
+      id: dev-shell
+      shell: bash
+      run: |
+        shell_drv=$(nix eval --raw --impure .#devShells --apply 'shells: shells.${builtins.currentSystem}.default.drvPath')
+        echo "hash=$(nix hash file --type sha256 --base16 "$shell_drv")" >> "$GITHUB_OUTPUT"
+
+    - name: Realize Nix development shell
+      shell: bash
+      run: nix develop -c true
+
+    - name: Cache Rust target and registry
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        shared-key: ${{ inputs.cache-key }}-${{ steps.dev-shell.outputs.hash }}
+        save-if: ${{ inputs.save-cache }}
+        cache-on-failure: ${{ inputs.save-cache }}
+        cache-bin: "false"
+        cmd-format: nix develop -c {0}