Base sandbox build broken: NodeSource yanked pinned Node.js 22.22.1 package

[johntmyers]

Summary

The Build Sandbox Images workflow is failing because NodeSource removed nodejs=22.22.1-1nodesource1 from their apt repository. The base sandbox Dockerfile pins this exact version at line 61, causing the Docker build to fail with:

E: Version '22.22.1-1nodesource1' for 'nodejs' was not found

Failed run: https://github.com/NVIDIA/OpenShell-Community/actions/runs/23721670468

Root Cause

NodeSource has a recurring issue where they publish patch releases to their apt repo and then remove them shortly after, keeping only the .0 release. This is documented in multiple upstream issues:

• nodesource/distributions#1931 — opened Mar 28, 2026, reports 22.22.1, 22.22.2, 20.20.1, 20.20.2, 24.14.1 all missing
• nodesource/distributions#1897 — same pattern observed with 22.21.1 back in Nov 2025

The version 22.22.1-1nodesource1 was available when the pin was introduced in commit d5073c3 (Mar 12) and built successfully as recently as Mar 24 (run 23503799247). NodeSource yanked it between Mar 24–28.

The highest version currently available in the NodeSource repo is 22.22.0-1nodesource1.

Suggested Fix

Pinning to NodeSource apt packages is unreliable since they remove versions without notice. Consider one of:

1. Install from official Node.js tarballs — download pre-built binaries directly from https://nodejs.org/dist/ which are never removed. This is the most robust option.
2. Pin to the latest available NodeSource version (22.22.0-1nodesource1) as a short-term fix, accepting it will likely break again on the next patch release cycle.
3. Remove the version pin and just install nodejs without a version suffix, trading reproducibility for resilience.

Option 1 is recommended since it avoids this class of problem entirely.

[johntmyers]

@drew since you set this up originally wanted to check if there's a reason to not use official node tarballs? seems like this is a known recurring issue

[drew]

No reason not to use the tarbells.