Add sandbox values so deployers can choose the build confinement mode

[tylerpotts]

Reference Issues or PRs

Supports nebari-dev/nebi#495, which adds Landlock confinement for untrusted environment builds (part of nebari-dev/nebi#445).

What does this implement/fix?

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds a feature)
• Breaking change (fix or feature that would cause existing features not to work as expected)
• Documentation Update
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no API changes)
• Build related changes
• Other (please describe):

Summary

Nebi confines untrusted environment builds with Landlock and picks its own default: strict in team mode, off in local/desktop mode. The chart had no way to override that, and no generic extraEnv escape hatch either, so a cluster whose kernel cannot establish the sandbox had no route to a working build short of rolling the image back or hand-patching the Deployment (which ArgoCD selfHeal then reverts).

This adds a sandbox block wiring the three environment variables nebi already reads:

sandbox:
  mode: ""            # strict | permissive | off
  allowedPorts: []    # e.g. [80, 443]
  buildTimeout: ""    # Go duration, e.g. "30m"

Default behavior is unchanged

Each key is emitted only when set, so a deployer who leaves the block alone gets no new environment variables and nebi keeps applying its own defaults. I verified the rendered output is byte-identical to main for a default install:

helm template t . --set nebariapp.hostname=n.example.com   # diff vs main: identical

With overrides:

- name: NEBI_SANDBOX_MODE
  value: "permissive"
- name: NEBI_SANDBOX_ALLOWED_PORTS
  value: "80,443"
- name: NEBI_SANDBOX_BUILD_TIMEOUT
  value: "45m"

Why mode matters in practice

Landlock's filesystem confinement needs Linux 5.13+, and the refer right that package managers rely on to move a staged download into their cache needs 5.19+. On an older kernel, strict fails the build by design. permissive is the documented way to keep such a cluster running while it is upgraded, and until now the chart could not express it.

Note on allowedPorts

An empty list here means "leave nebi's default in place", not "deny all TCP". Nebi does treat an explicitly empty allowlist as deny-all, but that cannot be expressed through an environment variable: viper reads an empty environment variable as unset. Operators who want fully offline builds need nebi's config file. This is called out in the values comment so nobody reaches for allowedPorts: [] expecting a lockdown and quietly gets the opposite.

Testing

• Did you test the pull request locally?
• Did you add new tests?

helm lint clean. Rendered with defaults (byte-identical to main) and with each override set, and validated the output with kubeconform (only the NebariApp CR is skipped, since its schema is not public). No unit tests: the chart has no test harness today, and this is template plumbing whose behavior is covered by the render checks above.

Chart version bumped 0.1.2 -> 0.1.3.

Access-centered content checklist

Text styling

• The content is written with plain language (where relevant).
• If there are headers, they use the proper header tags (with only one level-one header: H1 or # in markdown).
• All links describe where they link to (for example, check the Nebari website).
• This content adheres to the Nebari style guides.

Non-text content

• All content is represented as text (for example, images need alt text, and videos need captions or descriptive transcripts).
• If there are emojis, there are not more than three in a row.
• Don't use flashing GIFs or videos.
• If the content were to be read as plain text, it still makes sense, and no information is missing.