bug: Cannot pull openshell-gateway image: Access Denied from nvcr.io

[uogharrylin-codex]

Agent Diagnostic

Unable to start OpenShell agent because gateway image cannot be downloaded.

Diagnostics performed:

1. Verified Docker daemon is running: docker ps works correctly
2. Authenticated to nvcr.io: docker login nvcr.io returned "Login Succeeded"
3. Attempted to pull gateway image: docker pull nvcr.io/nvidia/openshell-gateway:latest
4. Result: "Error response from daemon: error from registry: Access Denied"

The gateway container never started, preventing any agent diagnostics.
This appears to be a registry access permission issue for external Alpha testers.

Description

I am trying to test NemoClaw Alpha on my local workstation. I have completed all environment setup (WSL2, Docker, OpenShell CLI), but I cannot download the required openshell-gateway image from nvcr.io due to "Access Denied" error even after successful login.
The openshell-gateway image should be pulled successfully and the gateway container should start.
Docker returns "Error response from daemon: error from registry: Access Denied"

Reproduction Steps

1. Install OpenShell CLI 0.0.10 via GitHub release
2. Login to nvcr.io: docker login nvcr.io (successful)
3. Run openshell gateway start or manually pull: docker pull nvcr.io/nvidia/openshell-gateway:latest
4. Observe "Access Denied" error from registry

Environment

• OS: Windows 11 + WSL2 (Ubuntu 24.04)
• GPU: NVIDIA RTX 5080 (16GB VRAM)
• Docker: Docker Desktop for Windows (WSL2 backend)
• OpenShell CLI: 0.0.10
• NemoClaw: Cloned from GitHub, npm install completed
• nvcr.io: Login successful but image pull denied

Logs

## Logs

$ docker pull nvcr.io/nvidia/openshell-gateway:latest
Error response from daemon: error from registry: Access Denied

Note: I could not complete the Agent-First Checklist items 1 and 2 because 
the openshell-gateway image cannot be downloaded, preventing the agent from starting. 
The diagnostic above explains the root cause (nvcr.io Access Denied).

Agent-First Checklist

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why

[johntmyers]

That doesn't seem like the right image, this is what we publish: https://github.com/NVIDIA/OpenShell/pkgs/container/openshell%2Fgateway

[uogharrylin-codex]

That doesn't seem like the right image, this is what we publish: https://github.com/NVIDIA/OpenShell/pkgs/container/openshell%2Fgateway

@johntmyers Thanks for the clarification!

I actually managed to download the gateway image (it suddenly worked),
but now I'm stuck at the next step:

Error: K8s namespace not ready
timed out waiting for namespace 'openshell' to exist

This seems to be the same as issue #433.
Should I follow the workaround there, or is there a fix coming?

Environment: WSL2 + Docker Desktop + RTX 5080

[johntmyers]

I'd be interested to know if the workaround works for you. We have heard that the error your described happens on WSL. We are working on more formal WSL support so when that becomes available we can re-visit and see if this is an issue for you. Some of that work is spawning out of this: #398.

If you are still seeing this issue, if you could try running openshell doctor logs and using the debug-openshell-cluster SKILL with your own local agent that would be helpful.