refactor(docker)!: retire community images, build Alpine supervisor and Debian gateway in OpenShell

OPENSHELL_BUILD_SETUP.md

@@ -0,0 +1,89 @@
+# OpenShell Image Build Setup on OpenShift
+
+## Overview
+
+This document describes the setup for building OpenShell images (`openshell-supervisor` and `openshell-gateway`) on the RedHat Workshops OpenShift cluster using multi-stage Dockerfiles.
+
+## Branch
+
+Branch: `refactor/sandbox-alpine-default`
+
+Key changes:
+1. **Default sandbox image**: Changed from community image to Alpine-based supervisor image
+   - `ghcr.io/nvidia/openshell/supervisor:latest` (instead of `ghcr.io/nvidia/openshell-community/sandboxes/base:latest`)
+
+2. **Multi-stage Dockerfiles**:
+   - `deploy/docker/Dockerfile.supervisor.multistage` - Compiles openshell-sandbox + Alpine runtime
+   - `deploy/docker/Dockerfile.gateway.multistage` - Compiles openshell-gateway + distroless runtime
+
+## OpenShift Setup
+
+### Namespace
+```bash
+oc create namespace openshell-images
+```
+
+### BuildConfigs
+
+Two BuildConfigs automatically build and push images to the internal registry:
+
+1. **openshell-supervisor**
+   - Source: https://github.com/akram/OpenShell.git (branch: refactor/sandbox-alpine-default)
+   - Dockerfile: deploy/docker/Dockerfile.supervisor.multistage
+   - Output: openshell-images/openshell-supervisor:latest
+   - Resources: 2 CPU / 4Gi memory (request), 4 CPU / 8Gi (limit)
+
+2. **openshell-gateway**
+   - Source: https://github.com/akram/OpenShell.git (branch: refactor/sandbox-alpine-default)
+   - Dockerfile: deploy/docker/Dockerfile.gateway.multistage
+   - Output: openshell-images/openshell-gateway:latest
+   - Resources: 4 CPU / 8Gi memory (request), 8 CPU / 16Gi (limit)
+
+### Start Builds
+
+```bash
+# Supervisor image
+oc -n openshell-images start-build openshell-supervisor --follow
+
+# Gateway image
+oc -n openshell-images start-build openshell-gateway --follow
+```
+
+### View Image Registry
+
+```bash
+# List images
+oc -n openshell-images get imagestreams
+
+# Get internal registry route
+oc get route -n openshift-image-registry
+
+# Use images in pods
+image-registry.openshift-image-registry.svc:5000/openshell-images/openshell-supervisor:latest
+image-registry.openshift-image-registry.svc:5000/openshell-images/openshell-gateway:latest
+```
+
+## Build Times
+
+Builds take ~5-10 minutes due to full Rust compilation:
+- Supervisor: ~5-7 min (openshell-sandbox is simpler)
+- Gateway: ~8-10 min (full gateway with all dependencies)
+
+## Monitoring
+
+```bash
+# Watch builds in real-time
+oc -n openshell-images get builds -w
+
+# Check specific build logs
+oc -n openshell-images logs -f builds/openshell-supervisor-5
+
+# Check ImageStream status
+oc -n openshell-images describe is openshell-supervisor
+```
+
+## Next Steps
+
+1. Deploy OpenShell gateway using the built image
+2. Configure workloads to use supervisor image
+3. Set up CI/CD triggers for automatic rebuilds on branch pushes

crates/openshell-core/src/image.rs

@@ -58,6 +58,13 @@ mod tests {
         ENV_LOCK.get_or_init(|| Mutex::new(()))
     }
 
+    #[test]
+    fn default_image_uses_community_registry() {
+        let result = default_sandbox_image();
+        assert!(result.contains("/base:latest"));
+        assert!(result.starts_with(&format!("{}/", DEFAULT_COMMUNITY_REGISTRY)));
+    }
+
     #[test]
     fn bare_name_expands_to_community_registry() {
         let _guard = env_lock().lock().unwrap();

deploy/docker/Dockerfile.gateway.multistage

@@ -0,0 +1,49 @@
+# syntax=docker/dockerfile:1.4
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# ARG must come before FROM for multi-stage
+ARG GATEWAY_BASE_IMAGE=debian:bookworm-slim
+
+# Build stage: Compile openshell-gateway
+FROM rust:1.81 AS builder
+
+WORKDIR /build
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    linux-headers-generic \
+    pkg-config \
+    libssl-dev \
+    libz3-dev \
+    git \
+    protobuf-compiler \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy source
+COPY . .
+
+# Build openshell-gateway in release mode
+RUN cargo build --release -p openshell-gateway
+
+# Final stage: Runtime for gateway
+FROM ${GATEWAY_BASE_IMAGE} AS gateway
+
+WORKDIR /app
+
+# Install runtime dependencies (libz3, openssl libs, ca-certificates)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libz3-4 \
+    libssl3 \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy the compiled binary from builder
+COPY --from=builder /build/target/release/openshell-gateway /usr/local/bin/openshell-gateway
+
+USER 1000:1000
+EXPOSE 8080
+
+ENTRYPOINT ["/usr/local/bin/openshell-gateway"]
+CMD ["--bind-address", "0.0.0.0", "--port", "8080"]

deploy/docker/Dockerfile.supervisor.multistage

@@ -0,0 +1,22 @@
+# syntax=docker/dockerfile:1.4
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Compile openshell-sandbox in Debian base
+FROM rust:1.81
+
+WORKDIR /build
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends linux-headers-generic pkg-config libssl-dev git ca-certificates && rm -rf /var/lib/apt/lists/*
+
+# Copy source
+COPY . .
+
+# Build openshell-sandbox in release mode and move to root
+RUN cargo build --release -p openshell-sandbox && \
+    mv /build/target/release/openshell-sandbox /openshell-sandbox && \
+    chmod 0555 /openshell-sandbox
+
+# Entrypoint
+ENTRYPOINT ["/openshell-sandbox"]