bug: Cannot pull openshell-gateway image: Access Denied from nvcr.io

[uogharrylin-codex]

Agent Diagnostic

Unable to start OpenShell agent because gateway image cannot be downloaded.

Diagnostics performed:

1. Verified Docker daemon is running: docker ps works correctly
2. Authenticated to nvcr.io: docker login nvcr.io returned "Login Succeeded"
3. Attempted to pull gateway image: docker pull nvcr.io/nvidia/openshell-gateway:latest
4. Result: "Error response from daemon: error from registry: Access Denied"

The gateway container never started, preventing any agent diagnostics.
This appears to be a registry access permission issue for external Alpha testers.

Description

I am trying to test NemoClaw Alpha on my local workstation. I have completed all environment setup (WSL2, Docker, OpenShell CLI), but I cannot download the required openshell-gateway image from nvcr.io due to "Access Denied" error even after successful login.
The openshell-gateway image should be pulled successfully and the gateway container should start.
Docker returns "Error response from daemon: error from registry: Access Denied"

Reproduction Steps

1. Install OpenShell CLI 0.0.10 via GitHub release
2. Login to nvcr.io: docker login nvcr.io (successful)
3. Run openshell gateway start or manually pull: docker pull nvcr.io/nvidia/openshell-gateway:latest
4. Observe "Access Denied" error from registry

Environment

• OS: Windows 11 + WSL2 (Ubuntu 24.04)
• GPU: NVIDIA RTX 5080 (16GB VRAM)
• Docker: Docker Desktop for Windows (WSL2 backend)
• OpenShell CLI: 0.0.10
• NemoClaw: Cloned from GitHub, npm install completed
• nvcr.io: Login successful but image pull denied

Logs

## Logs

$ docker pull nvcr.io/nvidia/openshell-gateway:latest
Error response from daemon: error from registry: Access Denied

Note: I could not complete the Agent-First Checklist items 1 and 2 because 
the openshell-gateway image cannot be downloaded, preventing the agent from starting. 
The diagnostic above explains the root cause (nvcr.io Access Denied).

Agent-First Checklist

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why

[johntmyers]

That doesn't seem like the right image, this is what we publish: https://github.com/NVIDIA/OpenShell/pkgs/container/openshell%2Fgateway

[uogharrylin-codex]

That doesn't seem like the right image, this is what we publish: https://github.com/NVIDIA/OpenShell/pkgs/container/openshell%2Fgateway

@johntmyers Thanks for the clarification!

I actually managed to download the gateway image (it suddenly worked),
but now I'm stuck at the next step:

Error: K8s namespace not ready
timed out waiting for namespace 'openshell' to exist

This seems to be the same as issue #433.
Should I follow the workaround there, or is there a fix coming?

Environment: WSL2 + Docker Desktop + RTX 5080