chore(vm): refresh runtime defaults and hardening - #3446

🌿 Preview your docs: https://nvidia-preview-pr-3446.docs.buildwithfern.com/openshell

I see that #3451 is related. It may be good to stack on that.

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Heads-up: VM E2E (rust-vm-managed and rust-vm-external-driver) has been failing on every PR that runs it since this merged. Sandbox creation aborts in the guest with:

FATAL: prepared image disk missing /image-rootfs

The most likely trigger is the switch to nvcr.io/nvidia/base/ubuntu:24.04 in e2e/rust/e2e-vm.sh and DEFAULT_VM_SANDBOX_IMAGE. The symptom matches #2358 exactly: registry image prep leaves a disk without /image-rootfs for any image other than the bootstrap one. The kernel hardening options are the other change on that path; I haven't bisected.

Since the gateway default changed too, VM driver users on the default image may hit the same failure. Could we revert the image switch until #2358 is fixed, or revive #2360?

@drew follow-up on the VM E2E breakage: the CI logs trace it to the image switch, not the kernel options. --from base no longer matches the bootstrap image, so it goes through registry prep and hits #2358. Fix is up in #3524.

With that fix, conformance passes locally, but there's a second regression hiding behind it: both host_gateway_alias tests fail with curl: command not found. They run in the new default image, and nvcr.io/nvidia/base/ubuntu:24.04 ships without curl (or wget/python3). CI never reached them because conformance failed first.

Two easy options: have those tests use --from base, or keep the new gateway default but point SANDBOX_IMAGE in e2e/rust/e2e-vm.sh back at the community image. Happy to take either, just let me know which you prefer.

@drew quick update: vm_corporate_proxy had the same problem (its workload runs python3, which the new image doesn't ship either). Since CI was blocked on it, I went with the --from base option for both test files and pushed it to #3524 as a separate commit, so it's easy to drop if you'd rather go another way. Full e2e:vm passes locally with the Ubuntu default.