@@ -0,0 +1,75 @@
+# syntax=docker/dockerfile:1.4
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# In-cluster (OpenShift/Buildah) variant of Dockerfile.sandbox.
+#
+# Upstream CI produces the static musl `openshell-sandbox` binary by building
+# inside the project's Nix devShell with the musl cross target, and stages it
+# under deploy/docker/.build/prebuilt-binaries. This multi-stage Dockerfile
+# reproduces that exact binary in a builder stage so clusters without the Nix
+# CI pipeline can build the sandbox image directly from source. The final stage
+# is identical to Dockerfile.sandbox.
+
+# ---- Builder: glibc base + Nix, reproduce upstream's cross build -------------
+#
+# The build must run on a glibc/FHS base (like the CI runners), NOT on the
+# minimal nixos/nix image: cross-compiling emits host build-scripts linked for
+# x86_64-unknown-linux-gnu whose ELF interpreter is /lib64/ld-linux-x86-64.so.2,
+# which the nixos/nix (Alpine, store-only) image does not provide.
+FROM debian:bookworm-slim AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl xz-utils ca-certificates git && rm -rf /var/lib/apt/lists/*
+
+# Single-user Nix (no daemon) as root. NIX_CONFIG disables per-build users
+# during the install itself (the installer reads config before our nix.conf
+# exists); the written nix.conf carries that to later `nix develop` runs, plus
+# flakes and the flake's cachix substituter for prebuilt toolchain/z3/aws-lc.
+RUN export NIX_CONFIG="build-users-group =" && \
+    mkdir -m 0755 /nix && \
+    curl -L https://nixos.org/nix/install -o /tmp/nix-install.sh && \
+    sh /tmp/nix-install.sh --no-daemon && \
+    mkdir -p /etc/nix && \
+    printf 'experimental-features = nix-command flakes\naccept-flake-config = true\nbuild-users-group =\nsandbox = false\n' > /etc/nix/nix.conf
+
+# Put single-user Nix on PATH directly (Buildah RUN is not a login shell, so the
+# profile script is unreliable) and point it at Debian's CA bundle for HTTPS
+# substituter fetches.
+ENV HOME=/root \
+    PATH=/root/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+    NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+
+WORKDIR /build
+COPY . .
+
+# Build the sandbox binary exactly like CI: same devShell, same cargo command
+# and target triple. Everything runs in a single layer: build, stage the static
+# binary at /, then delete the Nix store and Cargo target. The binary is static
+# musl (it needs nothing from /nix at runtime), so the committed builder layer
+# shrinks to the binary alone, keeping the intermediate commit fast and within
+# the node's ephemeral-storage budget.
+RUN nix develop -c bash -euo pipefail -c '\
+      GIT_DIR=/nonexistent cargo auditable build --release \
+        --target x86_64-unknown-linux-musl \
+        --package openshell-sandbox --bin openshell-sandbox' && \
+    cp target/x86_64-unknown-linux-musl/release/openshell-sandbox /openshell-sandbox && \
+    cd / && rm -rf /nix /build /root/.cache /tmp/*
+
+# ---- Runtime: identical to deploy/docker/Dockerfile.sandbox ------------------
+#
+# Runtime-specific bootstrap tools belong to their compute drivers rather than
+# this portable image, so the sandbox runtime image is a bare scratch layer.
+FROM scratch AS sandbox
+
+ARG TARGETARCH
+
+# Keep the binary root-owned for image-volume mounts and executable by the
+# sandbox runtime's non-root UID.
+COPY --from=builder --chmod=0555 /openshell-sandbox /openshell-sandbox
+
+# Drivers may override this identity to match the admitted workload. Keep the
+# standalone image non-root by default.
+USER 65532:65532
+
+ENTRYPOINT ["/openshell-sandbox"]
@@ -4,12 +4,13 @@
 
 # In-cluster (OpenShift/Buildah) variant of Dockerfile.supervisor.
 #
-# Upstream CI produces the static musl `openshell-sandbox` binary by building
-# inside the project's Nix devShell with the musl cross target, and stages it
-# under deploy/docker/.build/prebuilt-binaries. This multi-stage Dockerfile
-# reproduces that exact binary in a builder stage so clusters without the Nix
-# CI pipeline can build the supervisor image directly from source. The final
-# stage is identical to Dockerfile.supervisor.
+# Upstream CI builds the dynamically linked GNU `openshell-supervisor` binary
+# inside the project's Nix devShell with the gnu cross target (z3 and aws-lc
+# statically embedded, standard ELF interpreter), and stages it under
+# deploy/docker/.build/prebuilt-binaries. This multi-stage Dockerfile reproduces
+# that exact artifact in a builder stage so clusters without the Nix CI pipeline
+# can build the supervisor image directly from source. The final stage is
+# identical to Dockerfile.supervisor.
 
 # ---- Builder: glibc base + Nix, reproduce upstream's cross build -------------
 #
@@ -43,30 +44,30 @@ ENV HOME=/root \
 WORKDIR /build
 COPY . .
 
-# Build the sandbox binary exactly like CI: same devShell, same cargo command
-# and target triple. Everything runs in a single layer: build, stage the static
-# binary at /, then delete the Nix store and Cargo target. The binary is static
-# musl (it needs nothing from /nix at runtime), so the committed builder layer
-# shrinks to the binary alone, keeping the intermediate commit fast and within
-# the node's ephemeral-storage budget.
+# Build the supervisor exactly like CI: same devShell, same cargo command and
+# target triple. The gnu cross toolchain emits a standard ELF interpreter, so
+# the binary runs on a plain Debian base without post-processing. Everything
+# runs in a single layer: build, stage the binary at /, then delete the Nix
+# store and Cargo target so the committed builder layer stays small.
 RUN nix develop -c bash -euo pipefail -c '\
       GIT_DIR=/nonexistent cargo auditable build --release \
-        --target x86_64-unknown-linux-musl \
-        --package openshell-sandbox --bin openshell-sandbox' && \
-    cp target/x86_64-unknown-linux-musl/release/openshell-sandbox /openshell-sandbox && \
+        --target x86_64-unknown-linux-gnu \
+        --package openshell-supervisor --bin openshell-supervisor' && \
+    cp target/x86_64-unknown-linux-gnu/release/openshell-supervisor /openshell-supervisor && \
     cd / && rm -rf /nix /build /root/.cache /tmp/*
 
 # ---- Runtime: identical to deploy/docker/Dockerfile.supervisor ---------------
 #
-# Alpine supplies nftables and iptables for pod-namespace egress enforcement.
-FROM alpine:3.22 AS supervisor
+# The dynamically linked GNU supervisor binary needs a glibc runtime plus a CA
+# bundle for its outbound TLS connections.
+FROM debian:bookworm-slim AS supervisor
 
 ARG TARGETARCH
 
-RUN apk add --no-cache nftables iptables iptables-legacy
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-# Keep the binary root-owned for Podman image-volume mounts and executable by
-# the Kubernetes network sidecar's non-root proxy UID.
-COPY --from=builder --chmod=0555 /openshell-sandbox /openshell-sandbox
+COPY --from=builder --chmod=0555 /openshell-supervisor /openshell-supervisor
 
-ENTRYPOINT ["/openshell-sandbox"]
+ENTRYPOINT ["/openshell-supervisor"]