bug: uv fails to install packages on docker based sandboxes with Cross-device link (os error 18)

Agent Diagnostic

• Loaded debug-openshell-cluster and openshell-cli skills
• Created diagnostic sandboxes with openshell sandbox create --name uv_diag_testX --no-keep
• Reproduced the failure: uv tool run cowsay fails with Cross-device link (os error 18) on every run
• Verified both paths (/sandbox/.cache/uv/.tmpXXXXXX and /sandbox/.cache/uv/archive-v0/) report the same device number (dev=56, overlayfs)
• Confirmed manual mv (which uses rename(2)) between the same directories succeeds without error
• Wrote and executed a Python script that calls renameat2(RENAME_NOREPLACE) directly on the same paths → confirmed it returns errno=18 (EXDEV)
• Root cause: uv uses renameat2(2) with the RENAME_NOREPLACE flag for atomic cache population. Linux kernel 5.15 overlayfs (used by Docker-backed sandboxes) returns EXDEV for renameat2(RENAME_NOREPLACE) when source and destination are in different subdirectories, even on the same device. Standard rename(2) works fine on the same paths.
• Gateway: local Docker driver, kernel 5.15.0-179-generic, uv 0.10.8
• No workaround found via UV_CACHE_DIR or TMPDIR — the issue is in uv's cache write path, not the cache location

Description

When creating a sandbox using the docker driver uv is not able to install packages. Based on the investigation this is related to EXDEV (errno 18, cross-device link error) error on overlayfs. This may be related to Landlock restriction as noted on this past PR https://github.com/NVIDIA/OpenShell/pull/151

Reproduction Steps

1. Run openshell sandbox create --name 'uv_test_1'
2. uv tool run cowsay
3. Get error:

sandbox@33cd2528853a:~$ uv tool run cowsay
  x Failed to download `cowsay==6.1`
  |-> Failed to read from the distribution cache
  `-> failed to rename file from /sandbox/.cache/uv/.tmpKk67yS to /sandbox/.cache/uv/archive-v0/L6-C5kj-jfrluxzZ1YhlR: Cross-device link (os error 18)

Environment

• OS: Ubuntu 22.04
• Docker: version 29.1.3, build 29.1.3-0ubuntu3~22.04.2
• OpenShell: v.0.0.41

Logs

  x Failed to download `cowsay==6.1`
  |-> Failed to read from the distribution cache
  `-> failed to rename file from /sandbox/.cache/uv/.tmpKk67yS to /sandbox/.cache/uv/archive-v0/L6-C5kj-jfrluxzZ1YhlR: Cross-device link (os error 18)

Agent-First Checklist

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why

Start by reproducing uv tool run cowsay in the Docker-backed sandbox, then trace the uv cache write path between /sandbox/.cache/uv/.tmpXXXXXX and archive-v0/. Use the reported renameat2(RENAME_NOREPLACE) EXDEV failure as the boundary; done means the command succeeds in this environment with regression coverage for the failure case.