Sandbox GPU probe times out pulling the managed image; pre-pull from #10124 only runs on Docker Desktop WSL

[jjrodriguez3]

Investigation Summary

Problem: on Jetson (Linux, JetPack 7.2.1), nemoclaw onboard fails at [6/8] Creating sandbox on a first install. The sandbox GPU-mode probe runs docker create --runtime nvidia <image> with a 30 s timeout. The managed image is not cached yet, the implicit pull is killed at 30 s, and NemoClaw reports a misleading "Docker did not accept the Jetson NVIDIA runtime GPU mode" error.

This exact bug was already found and fixed on Windows: #10105 reported it on Docker Desktop WSL in August, and #10124 fixed it by pre-pulling the image before the probe. But that fix is gated on dockerDesktopWsl, so it never runs on Linux hosts. Jetson uses the same --runtime nvidia compatibility route and still hits the original bug.

Description

Same root cause as #10105, on Jetson: the GPU-mode probe (docker create --runtime nvidia <image>@<digest> true, 30 s timeout, pull policy "missing") pulls the managed image on first install and gets killed:

Error: Docker did not accept the Jetson NVIDIA runtime GPU mode for managed bootstrap.
Attempts: --runtime nvidia (NVIDIA_VISIBLE_DEVICES=all): Unable to find image '...openclaw-sandbox@sha256:a041cacf77f8...' locally ... Pull complete ... spawnSync docker ETIMEDOUT

The NVIDIA runtime is registered and preflight passes. #10124 added a pre-pull before the probe, but prepareDockerManagedBootstrapGpuProbeImage in managed-bootstrap/docker-runtime.ts only runs when dockerDesktopWsl is true. Jetson takes the same compatibility route and is not covered.

Reproduction Steps

1. Fresh JetPack 7.2 flash, install NemoClaw.
2. nemoclaw onboard, OpenClaw + Local Ollama, defaults.
3. [6/8] fails after ~60 s with the error above. --resume fails the same way.

Environment

Jetson AGX Orin 64 GB, JetPack 7.2.1 (L4T R39.2.1), arm64
Docker 29.8.0 (runtimes: runc, nvidia), 

Node v22.23.2,
openshell 0.0.106
NemoClaw <output of nemoclaw --version>,
OpenClaw agent,
Local Ollama

Debug Output

[1/8] Preflight checks

──────────────────────────────────────────────────
[resume] Skipping preflight (cached)
✓ Docker daemon: server 29.8.0
✓ Docker NVIDIA runtime detected for Jetson/Tegra sandbox GPU
✓ Docker can start bridge containers
✓ Docker container DNS resolution works
NVIDIA Jetson/Tegra GPU detected; enabling sandbox GPU through Docker NVIDIA runtime. Use --no-gpu to opt out.

[2/8] Starting OpenShell gateway
──────────────────────────────────────────────────
[resume] Skipping gateway (running)

[3/8] Configuring inference provider
──────────────────────────────────────────────────
[resume] Skipping provider_selection (ollama-local / qwen3.5:9b)
[resume] Reusing sandbox name: mysandbox1.

[4/8] Setting up inference provider
──────────────────────────────────────────────────
[resume] Skipping inference (ollama-local / qwen3.5:9b)
[resume] Reusing web search selection: disabled.

[5/8] Messaging channels
──────────────────────────────────────────────────
[resume] Reusing messaging selection: no channels.
[resume] Reusing OpenShell default resources.

[6/8] Creating sandbox
──────────────────────────────────────────────────
Registry entry exists for 'mysandbox1' but installer restore flag not set — skipping pre-upgrade backup select.
⏳ Still working on Sandbox creation… (30s elapsed)
Jetson sandbox GPU enabled; using NVIDIA Container Runtime instead of CDI/--gpus.
Creating sandbox 'mysandbox1' (this takes a few minutes on first run)...
✓ Updated provider ollama-local

⏳ Still working on Sandbox creation… (62s elapsed)
Error: Docker did not accept the Jetson NVIDIA runtime GPU mode for managed bootstrap. Attempts: --runtime nvidia (NVIDIA_VISIBLE_DEVICES=all): Unable to find image 'ghcr.io/nvidia/nemoclaw/openclaw-sandbox@sha256:a041cacf77f8...' locally ghcr.io/nvidia/nemoclaw/openclaw-sandbox@sha256:a041cacf77f8...: Pulling from nvidia/nemoclaw/openclaw-sandbox 20051f4c4206: Pulling fs layer 570fa881 ... [layer progress lines omitted] ... 9c8912f050a7: Pull complete 55fb7358eaf9: Download complete feff3e10ed80: Download complete spawnSync docker ETIMEDOUT

Onboarding did not finish. Resume from the step that failed with:
nemoclaw onboard --resume

Logs

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate

[kaofelix]

Tracking this issue through #8910, which owns NemoClaw adoption and qualification of the accepted OpenShell-native CDI path for Jetson GPU onboarding.

#11877 addressed the cold-image timeout in the legacy NemoClaw compatibility probe. We closed that PR because the supported direction no longer extends that probe and container-recreation path. This issue remains open: #8910 does not contain the same pre-pull change, and the original behavior is not yet verified as fixed.

The current upstream gates are NVIDIA/OpenShell#2265, NVIDIA/OpenShell#2775, NVIDIA/OpenShell#2776, NVIDIA/OpenShell#2846, NVIDIA/OpenShell#3348, and NVIDIA/OpenShell#3349. Resolution still requires a released OpenShell CDI contract and the accepted AGX Thor and IGX Orin validation matrix.