Vouch request: [your GitHub username]

[udsy19]

What do you want to work on?

I'd like to fix #4029. With a tagless --from, the Docker driver pulls the image's entire tag history (same as docker pull --all-tags) instead of just latest.

The cause is in pull_image in crates/openshell-driver-docker/src/lib.rs: it sets from_image with no tag, and the Engine API treats that as "pull every tag." The docker CLI and the Podman driver both normalize a bare reference to :latest before pulling, so the Docker driver is the odd one out.

The fix is small and stays in that one driver: normalize a reference with no tag or digest to :latest, and add a regression test covering tagless, tagged and digest references.

Why this change?

Creating a sandbox from a common untagged image quietly downloads gigabytes across dozens of tags. The reporter hit about 9.5 GB and several minutes of waiting, with nothing telling them why. Anyone who uses --from without a tag will hit this.

For context, I've had about 40 PRs merged in NemoClaw over the last couple of months, mostly gateway hardening, credential redaction and runtime adapter validation, so I'm already familiar with how NemoClaw sits on top of OpenShell.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md

[elezar]

/vouch

[github-actions[bot]]

@udsy19 has been vouched by @elezar.

You can now submit pull requests to OpenShell. Welcome aboard.

Please read CONTRIBUTING.md before submitting.