docs(website): sync dev docs from 0bca9fb828

fern/.docs-snapshots.yml

@@ -1,8 +1,8 @@
 snapshots:
   dev:
-    source-ref: 4a0208fa695d8881f4210e8a89d94af6d895c267
-    source-sha: 4a0208fa695d8881f4210e8a89d94af6d895c267
-    version: 0.1.3.dev102
+    source-ref: 0bca9fb8280045224c910610cba005b7fa5a6a83
+    source-sha: 0bca9fb8280045224c910610cba005b7fa5a6a83
+    version: 0.1.3.dev104
   latest:
     source-ref: 6648bd0c290efbc41ba131ee9831ee45cd431f94
     source-sha: 6648bd0c290efbc41ba131ee9831ee45cd431f94

fern/pages-dev/how-it-works/sandboxes/runtimes.mdx

@@ -44,6 +44,11 @@ driver TOML overrides the compiled release defaults. Helm renders Kubernetes
 image fields into TOML, so they apply when these environment variables are
 unset. Sandbox requests cannot override either trusted image.
 
+When building your own gateway or supervisor image, the `GATEWAY_BASE_IMAGE`
+and `SUPERVISOR_BASE_IMAGE` build arguments override their pinned bases. See
+[Container Image Base Overrides](https://github.com/NVIDIA/OpenShell/blob/main/CONTRIBUTING.md#container-image-base-overrides)
+for build commands and base compatibility requirements.
+
 For TLS-enabled Docker, Podman, and MicroVM gateways, set `guest_tls_ca` in
 `[openshell.gateway]` or use the package-managed local CA. Remove the retired
 `guest_tls_cert` and `guest_tls_key` fields. Supervisors receive only the