Consolidate sandbox images: e2b + local docker only, drop K8s SandboxSet

[RyanLee-Dev]

Summary

Support-scope decision: only e2b.app SaaS templates and the local docker-backed sandbox provider are supported going forward. The self-hosted K8s SandboxSet path is dropped.

Root cause investigation for "sandbox does not start" after ./install.sh led here: PARSAR_SANDBOX_IMAGE defaulted to ghcr.io/minimax-ai-dev/parsar-sandbox:latest, an image that had never been published — its build workflow was gated off since the initial public release because the Dockerfile's COPY --from=e2bdev/base:latest /usr/bin/envd broke (upstream removed envd from that image) and nobody had re-enabled it. Rather than just patch that one Dockerfile, this PR steps back and simplifies the whole sandbox image story.

What changed

• Dropped the K8s SandboxSet path entirely: infra/sandbox/parsar-daemon-claudecode/{Dockerfile,sandboxset.yaml}, infra/sandbox/parsar-daemon-claudecode-xl/sandboxset.yaml, the old .github/workflows/sandbox-image-release.yml, docs/deploy/sandbox-setup.md — all deleted. It duplicated most of the e2b.app template, needed its own OpenKruise CRD infra, and its publish pipeline had been silently dead since the initial release.
• Dropped OpenCode from the sandbox images (Claude Code + Codex + Pi only) to keep them minimal. Also deleted the standalone infra/e2b-templates/opencode/e2b.Dockerfile template. Server-side agent_kind=opencode support (DB, API, frontend, the local apps/parsar-daemon daemon runtime) is untouched — this only affects whether a sandbox image has OpenCode preinstalled.
• One Dockerfile for both remaining targets: infra/sandbox/Dockerfile.local + infra/sandbox/Dockerfile.e2b (themselves already consolidated from 5 original files, deduplicating CLI-install logic into shared scripts) collapsed further into a single infra/sandbox/Dockerfile, selecting the target via --build-arg BASE_IMAGE:

  docker build -f infra/sandbox/Dockerfile -t parsar-sandbox:local .
  docker build -f infra/sandbox/Dockerfile --build-arg BASE_IMAGE=e2bdev/base:latest -t parsar-daemon-claudecode .

  The two prior files had shrunk to a ~2-line real diff (base image + a TARGETARCH default) — not worth maintaining separately when Docker's ARG-before-FROM substitution covers it natively. Verified both targets still produce byte-identical images (full layer-cache hit against the prior two-file build).
• Both targets now compile parsar-daemon from source in the shared Go builder stage instead of the e2b variant downloading a prebuilt binary from GitHub Releases — removes a dependency on a release existing first, and removes ~25 lines of GitHub-API tag-resolution logic.
• CLI installs unified into one script: infra/sandbox/scripts/install-agents.sh (previously 4 separate install-*.sh files) installs Node 22, Claude Code, Codex, and Pi, shared by the one Dockerfile. Backfilled Codex + Pi into the e2b target (it was previously Claude-Code-only, inconsistent with the local target) and switched its Claude Code install off claude.ai/install.sh (bot-challenge-prone) onto the CDN method the local target already used.
• Two real bugs found and fixed while backfilling:
  1. @earendil-works/pi-coding-agent pins engines.node >=22.19.0 and fails at runtime on Node 20 (TypeError: webidl.util.markAsUncloneable is not a function, not just an npm warning) — bumped the shared install script to Node 22, pinned pi to 0.80.6 for reproducibility.
  2. e2bdev/base:latest ships its own stale /usr/local/bin/node (v20.9.0) that shadows a fresh nodesource install on PATH — install-agents.sh now force-relinks /usr/local/bin/{node,npm,npx} to the dpkg-installed /usr/bin/ binaries.
• New .github/workflows/sandbox-image-release.yml: a matrix build off the single Dockerfile publishing both ghcr.io/<org>/parsar-sandbox (multi-arch amd64+arm64) and ghcr.io/<org>/parsar-daemon-claudecode (amd64 only) to GHCR, mirroring parsar-server-release.yml's trigger conventions (PR = build only, push to main = :latest + :sha, sandbox-v* tag = release, manual dispatch).
• docker-compose.yml / install.sh: AGENT_DAEMON_SANDBOX_DOCKER_IMAGE / DEFAULT_SANDBOX_IMAGE now default to parsar-sandbox:local instead of the never-published GHCR image.

Not included

• server/internal/sandbox/e2b/podip.go (K8s in-cluster pod IP resolution) is now dead code but wasn't touched — removing it means editing server Go code beyond this PR's infra/Dockerfile scope.
• Found but did not fix (pre-existing, unrelated): deploy/compose/compose.selfhost.yml / deploy/compose/.env.example set PARSAR_E2B_TEMPLATE_ID / PARSAR_E2B_TIMEOUT_SECONDS, but server/cmd/server/main.go actually reads AGENT_DAEMON_SANDBOX_TEMPLATE / AGENT_DAEMON_SANDBOX_TEMPLATE_XL — the self-host e2b sandbox path can never enable itself with those files as shipped.

Test plan

• docker build -f infra/sandbox/Dockerfile -t parsar-sandbox:local . and the e2b variant (--build-arg BASE_IMAGE=e2bdev/base:latest) both succeed end to end
• docker run --rm <image> bash -c 'node/claude/codex/pi --version' confirms all four CLIs resolve to pinned versions on both images (Node 22.23.1, Claude 2.1.207, Codex 0.141.0, Pi 0.80.6)
• Rebuilt parsar-sandbox:local, recreated parsar-server, confirmed the startup log reports "agent_daemon docker sandbox provider wired","image":"parsar-sandbox:local"
• Started a real sandbox container on the parsar_default compose network with the exact invocation server/internal/sandbox/docker/client.go uses (docker run -d --entrypoint sleep ... infinity) and confirmed it can curl parsar-server:8080/healthz successfully
• actionlint clean on the new workflow; locally simulated both matrix legs' exact build invocations
• Repo-wide grep confirms no leftover references to any of the deleted/renamed paths (infra/e2b-templates, Dockerfile.local/Dockerfile.e2b, the 4 separate install scripts, docker-compose.local.yml, parsar-init, old seed-dev, docker-image-info, parsar-paths.sh)
• bash -n install.sh, docker compose config --quiet on docker-compose.yml both pass

🤖 Generated with Claude Code