bug: sandbox from community base image stays ConfigurationInvalid; image policy uses removed tls: terminate #4467

User Story

As a user creating a sandbox with --from base, I want the sandbox to reach Ready or tell me exactly which part of its policy is invalid, so that I can fix it without reading supervisor source.

Problem Statement

On v0.1.3, openshell sandbox create --from base never reaches Ready when no --policy is passed. The sandbox sits in ConfigurationInvalid and the supervisor logs Image policy is invalid; replace the sandbox policy to repair configuration on every pass.

The published ghcr.io/nvidia/openshell-community/sandboxes/base:latest image (built 2026-05-29) ships /etc/openshell/policy.yaml with tls: terminate on the claude_code endpoint. #3414 made that value a hard error, and that change is in v0.1.0 and every later release. Parsing the same file with the CLI (--policy <file>) gives:

network policy 'claude_code': endpoint 0: unknown tls value 'terminate';
omit the field to keep automatic TLS termination

Before #3414 this was only a deprecation warning (#3310), so older releases work with this image.

The error a user sees does not carry that message. openshell sandbox get reports only Effective configuration could not be activated; replace the policy or repair attached providers. The only trace of the cause is the Image policy is invalid line in the sandbox log, with no field or reason.

Impact / Why This Matters

Any --from base sandbox without an explicit policy fails on a current release, including the harness in #3314. The workaround is to pass a --policy file, which you only find out by reading the supervisor code or trying the image's policy through the CLI. The generic message gives no hint that the image's baked-in policy is the problem, so it is easy to read as a gateway or provider fault.

Acceptance Criteria

• A sandbox created from the published base image either reaches Ready on a current release, or the image is no longer referenced as a working example.
• When an image-supplied policy fails to parse, the parse error (including the failing field and reason) is visible in openshell sandbox get or openshell logs, not only the generic message.
• Release notes or docs say that image-baked policies using removed values (such as tls: terminate) are rejected.

Reproduction Steps

1. Install the v0.1.3 RPMs and start the gateway with the Podman driver.
2. Run openshell sandbox create --name cfg-inv-test --from base --no-auto-providers --no-keep -- true.
3. Run openshell sandbox get cfg-inv-test. The condition is ConfigurationInvalid and the sandbox stays in Provisioning.
4. Run openshell logs cfg-inv-test. It shows Image policy is invalid, followed by repeated Server returned no policy; attempting local discovery.
5. Extract /etc/openshell/policy.yaml from the image and pass it with --policy. The CLI prints the unknown tls value 'terminate' error above.
6. Create the sandbox again with a minimal --policy file (filesystem and Landlock only). It reaches Ready.

Environment

• OpenShell: v0.1.3 (RPM), gateway and CLI
• OS: Fedora 44, x86_64
• Runtime: rootless Podman 5.8.4
• Image: ghcr.io/nvidia/openshell-community/sandboxes/base:latest, digest sha256:aeef1c63f00e2913ea002ccb3aaf925f338b5c5d70e63576f0d95c16a138044e

I only tested the Podman driver. The failure happens in the supervisor's policy discovery before any driver-specific step, so other drivers that use this image are likely affected too.

Logs

CONFIG:CONFIGURATION_ERROR [HIGH] Image policy is invalid; replace the sandbox policy to repair configuration
Server returned no policy; attempting local discovery