Merge branch 'master' into experimental

Correct typo in check for null device

See merge request nvidia/container-toolkit/container-toolkit!101

.common-ci.yml

@@ -1,4 +1,4 @@
-# Copyright (c) 2021-2022, NVIDIA CORPORATION.  All rights reserved.
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,17 +12,16 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 default:
-  image: docker
+  image: docker:stable
   services:
-    - name: docker:dind
+    - name: docker:stable-dind
       command: ["--experimental"]
 
 variables:
   GIT_SUBMODULE_STRATEGY: recursive
-  BUILD_MULTI_ARCH_IMAGES: "true"
+  BUILDIMAGE: "${CI_REGISTRY_IMAGE}/build:${CI_COMMIT_SHORT_SHA}"
 
 stages:
-  - trigger
   - image
   - lint
   - go-checks
@@ -33,71 +32,46 @@ stages:
   - test
   - scan
   - release
-  - sign
-
-.pipeline-trigger-rules:
-  rules:
-    # We trigger the pipeline if started manually
-    - if: $CI_PIPELINE_SOURCE == "web"
-    # We trigger the pipeline on the main branch
-    - if: $CI_COMMIT_BRANCH == "main"
-    # We trigger the pipeline on the release- branches
-    - if: $CI_COMMIT_BRANCH =~ /^release-.*$/
-    # We trigger the pipeline on tags
-    - if: $CI_COMMIT_TAG && $CI_COMMIT_TAG != ""
-
-workflow:
-  rules:
-    # We trigger the pipeline on a merge request
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    # We then add all the regular triggers
-    - !reference [.pipeline-trigger-rules, rules]
-
-# The main or manual job is used to filter out distributions or architectures that are not required on
-# every build.
-.main-or-manual:
-  rules:
-    - !reference [.pipeline-trigger-rules, rules]
-    - if: $CI_PIPELINE_SOURCE == "schedule"
-      when: manual
-
-# The trigger-pipeline job adds a manualy triggered job to the pipeline on merge requests.
-trigger-pipeline:
-  stage: trigger
-  script:
-    - echo "starting pipeline"
-  rules:
-    - !reference [.main-or-manual, rules]
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      when: manual
-      allow_failure: false
-    - when: always
+  - build-all
 
 # Define the distribution targets
+.dist-amazonlinux2:
+  variables:
+    DIST: amazonlinux2
+
 .dist-centos7:
-  rules:
-    - !reference [.main-or-manual, rules]
   variables:
     DIST: centos7
+    CVE_UPDATES: "nss"
 
 .dist-centos8:
   variables:
     DIST: centos8
 
+.dist-debian10:
+  variables:
+    DIST: debian10
+
+.dist-debian9:
+  variables:
+    DIST: debian9
+
+.dist-opensuse-leap15.1:
+  variables:
+    DIST: opensuse-leap15.1
+
 .dist-ubi8:
-  rules:
-    - !reference [.main-or-manual, rules]
   variables:
     DIST: ubi8
 
+.dist-ubuntu16.04:
+  variables:
+    DIST: ubuntu16.04
+
 .dist-ubuntu18.04:
   variables:
     DIST: ubuntu18.04
 
-.dist-ubuntu20.04:
-  variables:
-    DIST: ubuntu20.04
-
 .dist-packaging:
   variables:
     DIST: packaging
@@ -116,8 +90,6 @@ trigger-pipeline:
     ARCH: arm64
 
 .arch-ppc64le:
-  rules:
-    - !reference [.main-or-manual, rules]
   variables:
     ARCH: ppc64le
 
@@ -125,15 +97,6 @@ trigger-pipeline:
   variables:
     ARCH: x86_64
 
-# Define the platform targets
-.platform-amd64:
-  variables:
-    PLATFORM: linux/amd64
-
-.platform-arm64:
-  variables:
-    PLATFORM: linux/arm64
-
 # Define test helpers
 .integration:
   stage: test
@@ -145,7 +108,7 @@ trigger-pipeline:
     - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
     - docker pull "${IMAGE_NAME}:${VERSION}-${DIST}"
   script:
-    - make -f deployments/container/Makefile test-${DIST}
+    - make -f build/container/Makefile test-${DIST}
 
 # Define the test targets
 test-packaging:
@@ -155,30 +118,20 @@ test-packaging:
   needs:
     - image-packaging
 
-# Download the regctl binary for use in the release steps
-.regctl-setup:
-  before_script:
-    - export REGCTL_VERSION=v0.4.5
-    - apk add --no-cache curl
-    - mkdir -p bin
-    - curl -sSLo bin/regctl https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64
-    - chmod a+x bin/regctl
-    - export PATH=$(pwd)/bin:${PATH}
-
 # .release forms the base of the deployment jobs which push images to the CI registry.
 # This is extended with the version to be deployed (e.g. the SHA or TAG) and the
 # target os.
 .release:
-  stage: release
+  stage:
+    release
   variables:
     # Define the source image for the release
     IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
     VERSION: "${CI_COMMIT_SHORT_SHA}"
     # OUT_IMAGE_VERSION is overridden for external releases
     OUT_IMAGE_VERSION: "${CI_COMMIT_SHORT_SHA}"
+  stage: release
   before_script:
-    - !reference [.regctl-setup, before_script]
-
     # We ensure that the OUT_IMAGE_VERSION is set
     - 'echo Version: ${OUT_IMAGE_VERSION} ; [[ -n "${OUT_IMAGE_VERSION}" ]] || exit 1'
 
@@ -186,16 +139,16 @@ test-packaging:
     # need to tag the image.
     # Note: a leading 'v' is stripped from the version if present
     - apk add --no-cache make bash
-  script:
-    # Log in to the "output" registry, tag the image and push the image
     - 'echo "Logging in to CI registry ${CI_REGISTRY}"'
-    - regctl registry login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
-    - '[ ${CI_REGISTRY} = ${OUT_REGISTRY} ] || echo "Logging in to output registry ${OUT_REGISTRY}"'
-    - '[ ${CI_REGISTRY} = ${OUT_REGISTRY} ] || regctl registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}"'
-
-    # Since OUT_IMAGE_NAME and OUT_IMAGE_VERSION are set, this will push the CI image to the
-    # Target
-    - make -f deployments/container/Makefile push-${DIST}
+    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
+    - docker pull "${IMAGE_NAME}:${VERSION}-${DIST}"
+  script:
+    - docker tag "${IMAGE_NAME}:${VERSION}-${DIST}" "${OUT_IMAGE_NAME}:${OUT_IMAGE_VERSION}-${DIST}"
+    # Log in to the "output" registry, tag the image and push the image
+    - 'echo "Logging in to output registry ${OUT_REGISTRY}"'
+    - docker logout
+    - docker login -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}" "${OUT_REGISTRY}"
+    - make IMAGE_NAME=${OUT_IMAGE_NAME} VERSION=${OUT_IMAGE_VERSION} -f build/container/Makefile push-${DIST}
 
 # Define a staging release step that pushes an image to an internal "staging" repository
 # This is triggered for all pipelines (i.e. not only tags) to test the pipeline steps
@@ -210,12 +163,10 @@ test-packaging:
     OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/staging/container-toolkit"
 
 # Define an external release step that pushes an image to an external repository.
-# This includes a devlopment image off main.
+# This includes a devlopment image off master.
 .release:external:
   extends:
     - .release
-  variables:
-    FORCE_PUBLISH_IMAGES: "yes"
   rules:
     - if: $CI_COMMIT_TAG
       variables:
@@ -225,6 +176,20 @@ test-packaging:
         OUT_IMAGE_VERSION: "${DEVEL_RELEASE_IMAGE_VERSION}"
 
 # Define the release jobs
+release:staging-centos7:
+  extends:
+    - .release:staging
+    - .dist-centos7
+  needs:
+    - image-centos7
+
+release:staging-centos8:
+  extends:
+    - .release:staging
+    - .dist-centos8
+  needs:
+    - image-centos8
+
 release:staging-ubi8:
   extends:
     - .release:staging
@@ -232,15 +197,15 @@ release:staging-ubi8:
   needs:
     - image-ubi8
 
-release:staging-ubuntu20.04:
+release:staging-ubuntu18.04:
   extends:
     - .release:staging
-    - .dist-ubuntu20.04
+    - .dist-ubuntu18.04
   needs:
-    - test-toolkit-ubuntu20.04
-    - test-containerd-ubuntu20.04
-    - test-crio-ubuntu20.04
-    - test-docker-ubuntu20.04
+    - test-toolkit-ubuntu18.04
+    - test-containerd-ubuntu18.04
+    - test-crio-ubuntu18.04
+    - test-docker-ubuntu18.04
 
 release:staging-packaging:
   extends:

.github/dependabot.yml

@@ -1,120 +0,0 @@
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-# main branch
-  - package-ecosystem: "gomod"
-    target-branch: main
-    directories:
-    - "/"
-    - "deployments/devel"
-    - "tests"
-    schedule:
-      interval: "daily"
-    labels:
-    - dependencies
-    groups:
-      k8sio:
-        patterns:
-        - k8s.io/*
-        exclude-patterns:
-        - k8s.io/klog/*
-
-  - package-ecosystem: "docker"
-    target-branch: main
-    directories:
-    # CUDA image
-    - "/deployments/container"
-    # Golang version
-    - "/deployments/devel"
-    schedule:
-      interval: "daily"
-    labels:
-    - dependencies
-
-  - package-ecosystem: "github-actions"
-    target-branch: main
-    directory: "/"
-    schedule:
-      interval: "daily"
-    labels:
-    - dependencies
-
-  # Allow dependabot to update the libnvidia-container submodule.
-  - package-ecosystem: "gitsubmodule"
-    target-branch: main
-    directory: "/"
-    allow:
-    - dependency-name: "third_party/libnvidia-container"
-    schedule:
-      interval: "daily"
-    labels:
-    - dependencies
-    - libnvidia-container
-
-# The release branch(es):
-  - package-ecosystem: "gomod"
-    target-branch: release-1.17
-    directories:
-    - "/"
-    # We don't update development or test dependencies on release branches
-    # - "deployments/devel"
-    # - "tests"
-    schedule:
-      interval: "weekly"
-      day: "sunday"
-    labels:
-    - dependencies
-    - maintenance
-    ignore:
-    # For release branches we only consider patch updates.
-    - dependency-name: "*"
-      update-types:
-      - version-update:semver-major
-      - version-update:semver-minor
-    groups:
-      k8sio:
-        patterns:
-        - k8s.io/*
-        exclude-patterns:
-        - k8s.io/klog/*
-
-  - package-ecosystem: "docker"
-    target-branch: release-1.17
-    directories:
-    # CUDA image
-    - "/deployments/container"
-    # Golang version
-    - "/deployments/devel"
-    schedule:
-      interval: "weekly"
-      day: "sunday"
-    ignore:
-    # For release branches we only apply patch updates to the golang version.
-    - dependency-name: "*golang*"
-      update-types:
-      - version-update:semver-major
-      - version-update:semver-minor
-    labels:
-    - dependencies
-    - maintenance
-
-  - package-ecosystem: "github-actions"
-    target-branch: release-1.17
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "sunday"
-    labels:
-    - dependencies
-    - maintenance
-
-  # Github actions need to be gh-pages branches.
-  - package-ecosystem: "github-actions"
-    target-branch: gh-pages
-    directory: "/"
-    schedule:
-      interval: "daily"
-    labels:
-    - dependencies

.github/workflows/ci.yaml

@@ -1,53 +0,0 @@
-# Copyright 2025 NVIDIA CORPORATION
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: CI Pipeline
-
-on:
-  push:
-    branches:
-      - "pull-request/[0-9]+"
-      - main
-      - release-*
-
-jobs:
-  code-scanning:
-    uses: ./.github/workflows/code_scanning.yaml
-
-  variables:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - name: Generate Commit Short SHA
-        id: version
-        run: echo "version=$(echo $GITHUB_SHA | cut -c1-8)" >> "$GITHUB_OUTPUT"
-
-  golang:
-    uses: ./.github/workflows/golang.yaml
-
-  image:
-    uses: ./.github/workflows/image.yaml
-    needs: [variables, golang, code-scanning]
-    secrets: inherit
-    with:
-      version: ${{ needs.variables.outputs.version }}
-      build_multi_arch_images: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release-') }}
-
-  e2e-test:
-    needs: [image, variables]
-    secrets: inherit
-    uses: ./.github/workflows/e2e.yaml
-    with:
-      version: ${{ needs.variables.outputs.version }}

.github/workflows/code_scanning.yaml

@@ -1,49 +0,0 @@
-# Copyright 2024 NVIDIA CORPORATION
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: "CodeQL"
-
-on:
-  workflow_call: {}
-  pull_request:
-    types:
-      - opened
-      - synchronize
-    branches:
-      - main
-      - release-*
-
-jobs:
-  analyze:
-    name: Analyze Go code with CodeQL
-    runs-on: ubuntu-latest
-    timeout-minutes: 360
-    permissions:
-      security-events: write
-      packages: read
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: go
-        build-mode: manual
-    - shell: bash
-      run: |
-        make build
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:go"

.github/workflows/e2e.yaml

@@ -1,98 +0,0 @@
-# Copyright 2025 NVIDIA CORPORATION
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: End-to-end Tests
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        required: true
-        type: string
-    secrets:
-      AWS_ACCESS_KEY_ID:
-        required: true
-      AWS_SECRET_ACCESS_KEY:
-        required: true
-      AWS_SSH_KEY:
-        required: true
-      E2E_SSH_USER:
-        required: true
-      SLACK_BOT_TOKEN:
-        required: true
-      SLACK_CHANNEL_ID:
-        required: true
-
-jobs:
-  e2e-tests:
-    runs-on: linux-amd64-cpu4
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-
-      - name: Calculate build vars
-        id: vars
-        run: |
-          echo "COMMIT_SHORT_SHA=${GITHUB_SHA:0:8}" >> $GITHUB_ENV
-          echo "LOWERCASE_REPO_OWNER=$(echo "${GITHUB_REPOSITORY_OWNER}" | awk '{print tolower($0)}')" >> $GITHUB_ENV
-          GOLANG_VERSION=$(./hack/golang-version.sh)
-          echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION := }" >> $GITHUB_ENV
-
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GOLANG_VERSION }}
-
-      - name: Set up Holodeck
-        uses: NVIDIA/holodeck@v0.2.12
-        with:
-          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws_ssh_key: ${{ secrets.AWS_SSH_KEY }}
-          holodeck_config: "tests/e2e/infra/aws.yaml"
-
-      - name: Get public dns name
-        id: holodeck_public_dns_name
-        uses: mikefarah/yq@master
-        with:
-          cmd: yq '.status.properties[] | select(.name == "public-dns-name") | .value' /github/workspace/.cache/holodeck.yaml
-
-      - name: Run e2e tests
-        env:
-          IMAGE_NAME: ghcr.io/nvidia/container-toolkit
-          VERSION: ${{ inputs.version }}
-          SSH_KEY: ${{ secrets.AWS_SSH_KEY }}
-          E2E_SSH_USER: ${{ secrets.E2E_SSH_USER }}
-          E2E_SSH_HOST: ${{ steps.holodeck_public_dns_name.outputs.result }}
-          E2E_INSTALL_CTK: "true"
-        run: |
-          e2e_ssh_key=$(mktemp)
-          echo "$SSH_KEY" > "$e2e_ssh_key"
-          chmod 600 "$e2e_ssh_key"
-          export E2E_SSH_KEY="$e2e_ssh_key"
-
-          make -f tests/e2e/Makefile test
-
-      - name: Send Slack alert notification
-        if: ${{ failure() }}
-        uses: slackapi/slack-github-action@v2.1.0
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_BOT_TOKEN }}
-          payload: |
-            channel: ${{ secrets.SLACK_CHANNEL_ID }}
-            text: |
-              :x: On repository ${{ github.repository }}, the Workflow *${{ github.workflow }}* has failed.
-      
-              Details: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/golang.yaml

@@ -1,83 +0,0 @@
-# Copyright 2024 NVIDIA CORPORATION
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Golang
-
-on:
-  workflow_call: {}
-  pull_request:
-    types:
-      - opened
-      - synchronize
-    branches:
-      - main
-      - release-*
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-      name: Checkout code
-    - name: Get Golang version
-      id: vars
-      run: |
-        GOLANG_VERSION=$(./hack/golang-version.sh)
-        echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION := }" >> $GITHUB_ENV
-    - name: Install Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: ${{ env.GOLANG_VERSION }}
-    - name: Lint
-      uses: golangci/golangci-lint-action@v6
-      with:
-        version: latest
-        args: -v --timeout 5m
-        skip-cache: true
-    - name: Check golang modules
-      run: | 
-        make check-vendor
-        make -C deployments/devel check-modules
-  test:
-    name: Unit test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Get Golang version
-        id: vars
-        run: |
-          GOLANG_VERSION=$(./hack/golang-version.sh)
-          echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION := }" >> $GITHUB_ENV
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GOLANG_VERSION }}
-      - run: make test
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Get Golang version
-        id: vars
-        run: |
-          GOLANG_VERSION=$(./hack/golang-version.sh)
-          echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION ?= }" >> $GITHUB_ENV
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GOLANG_VERSION }}
-      - run: make build

.github/workflows/image.yaml

@@ -1,126 +0,0 @@
-# Copyright 2024 NVIDIA CORPORATION
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Run this workflow on pull requests
-name: image
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        required: true
-        type: string
-      build_multi_arch_images:
-        required: true
-        type: string
-
-jobs:
-  packages:
-    runs-on: linux-amd64-cpu4
-    strategy:
-      matrix:
-        target:
-          - ubuntu18.04-arm64
-          - ubuntu18.04-amd64
-          - ubuntu18.04-ppc64le
-          - centos7-aarch64
-          - centos7-x86_64
-          - centos8-ppc64le
-        ispr:
-          - ${{ github.ref_name != 'main' && !startsWith( github.ref_name, 'release-' ) }}
-        exclude:
-          - ispr: true
-            target: ubuntu18.04-arm64
-          - ispr: true
-            target: ubuntu18.04-ppc64le
-          - ispr: true
-            target: centos7-aarch64
-          - ispr: true
-            target: centos8-ppc64le
-      fail-fast: false
-      
-    steps:
-      - uses: actions/checkout@v4
-        name: Check out code
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          image: tonistiigi/binfmt:master
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: build ${{ matrix.target }} packages
-        run: |
-          sudo apt-get install -y coreutils build-essential sed git bash make
-          echo "Building packages"
-          ./scripts/build-packages.sh ${{ matrix.target }}
-
-      - name: 'Upload Artifacts'
-        uses: actions/upload-artifact@v4
-        with:
-          compression-level: 0
-          name: toolkit-container-${{ matrix.target }}-${{ github.run_id }}
-          path: ${{ github.workspace }}/dist/*
-
-  image:
-    runs-on: linux-amd64-cpu4
-    strategy:
-      matrix:
-        dist:
-          - ubuntu20.04
-          - ubi8
-          - packaging
-        ispr:
-          - ${{ github.ref_name != 'main' && !startsWith( github.ref_name, 'release-' ) }}
-        exclude:
-          - ispr: true
-            dist: ubi8
-    needs: packages
-    steps:
-      - uses: actions/checkout@v4
-        name: Check out code
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          image: tonistiigi/binfmt:master
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Get built packages
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ github.workspace }}/dist/
-          pattern: toolkit-container-*-${{ github.run_id }}
-          merge-multiple: true
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build image
-        env:
-          IMAGE_NAME: ghcr.io/nvidia/container-toolkit
-          VERSION: ${{ inputs.version }}
-          PUSH_ON_BUILD: "true"
-          BUILD_MULTI_ARCH_IMAGES: ${{ inputs.build_multi_arch_images }}
-        run: |
-          echo "${VERSION}"
-          make -f deployments/container/Makefile build-${{ matrix.dist }}

.github/workflows/release.yaml

@@ -1,38 +0,0 @@
-# Copyright 2024 NVIDIA CORPORATION
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Run this workflow on new tags
-name: Release
-
-on:
-  push:
-    tags:
-      - v*
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        name: Check out code
-
-      - name: Prepare Artifacts
-        run: |
-          ./hack/prepare-artifacts.sh ${{ github.ref_name }}
-
-      - name: Create Draft Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          ./hack/create-release.sh ${{ github.ref_name }}

.gitignore

@@ -1,13 +1,8 @@
 dist
-artifacts
 *.swp
 *.swo
-/coverage.out*
-/tests/output/
+/coverage.out
+/test/output/
 /nvidia-container-runtime
-/nvidia-container-runtime.*
-/nvidia-container-runtime-hook
 /nvidia-container-toolkit
-/nvidia-ctk
 /shared-*
-/release-*

.gitlab-ci.yml

@@ -1,4 +1,4 @@
-# Copyright (c) 2019-2022, NVIDIA CORPORATION.  All rights reserved.
+# Copyright (c) 2019-2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,6 +15,68 @@
 include:
   - .common-ci.yml
 
+build-dev-image:
+  stage: image
+  script:
+    - apk --no-cache add make bash
+    - make .build-image
+    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
+    - make .push-build-image
+
+.requires-build-image:
+  image: "${BUILDIMAGE}"
+
+.go-check:
+  extends:
+    - .requires-build-image
+  stage: go-checks
+
+fmt:
+  extends:
+    - .go-check
+  script:
+    - make assert-fmt
+
+vet:
+  extends:
+    - .go-check
+  script:
+    - make vet
+
+lint:
+  extends:
+    - .go-check
+  script:
+    - make lint
+  allow_failure: true
+
+ineffassign:
+  extends:
+    - .go-check
+  script:
+    - make ineffassign
+  allow_failure: true
+
+misspell:
+  extends:
+    - .go-check
+  script:
+    - make misspell
+
+go-build:
+  extends:
+    - .requires-build-image
+  stage: go-build
+  script:
+    - make build
+
+unit-tests:
+  extends:
+    - .requires-build-image
+  stage: unit-tests
+  script:
+    - make coverage
+
 # Define the package build helpers
 .multi-arch-build:
   before_script:
@@ -32,43 +94,32 @@ include:
     - .multi-arch-build
     - .package-artifacts
   stage: package-build
-  timeout: 3h
   script:
-    - ./scripts/build-packages.sh ${DIST}-${ARCH}
+    - ./scripts/release.sh ${DIST}-${ARCH}
 
   artifacts:
     name: ${ARTIFACTS_NAME}
     paths:
       - ${ARTIFACTS_ROOT}
-  needs:
-    - job: package-meta-packages
-      artifacts: true
 
 # Define the package build targets
-package-meta-packages:
+package-amazonlinux2-aarch64:
   extends:
-    - .package-artifacts
-  stage: package-build
-  variables:
-    SKIP_LIBNVIDIA_CONTAINER: "yes"
-    SKIP_NVIDIA_CONTAINER_TOOLKIT: "yes"
-  parallel:
-    matrix:
-      - PACKAGING: [deb, rpm]
-  before_script:
-    - apk add --no-cache coreutils build-base sed git bash make
-  script:
-    - ./scripts/build-packages.sh ${PACKAGING}
-  artifacts:
-    name: ${ARTIFACTS_NAME}
-    paths:
-      - ${ARTIFACTS_ROOT}
+    - .package-build
+    - .dist-amazonlinux2
+    - .arch-aarch64
 
-package-centos7-aarch64:
+package-amazonlinux2-x86_64:
+  extends:
+    - .package-build
+    - .dist-amazonlinux2
+    - .arch-x86_64
+
+package-centos7-ppc64le:
   extends:
     - .package-build
     - .dist-centos7
-    - .arch-aarch64
+    - .arch-ppc64le
 
 package-centos7-x86_64:
   extends:
@@ -76,12 +127,54 @@ package-centos7-x86_64:
     - .dist-centos7
     - .arch-x86_64
 
+package-centos8-aarch64:
+  extends:
+    - .package-build
+    - .dist-centos8
+    - .arch-aarch64
+
 package-centos8-ppc64le:
   extends:
     - .package-build
     - .dist-centos8
     - .arch-ppc64le
 
+package-centos8-x86_64:
+  extends:
+    - .package-build
+    - .dist-centos8
+    - .arch-x86_64
+
+package-debian10-amd64:
+  extends:
+    - .package-build
+    - .dist-debian10
+    - .arch-amd64
+
+package-debian9-amd64:
+  extends:
+    - .package-build
+    - .dist-debian9
+    - .arch-amd64
+
+package-opensuse-leap15.1-x86_64:
+  extends:
+    - .package-build
+    - .dist-opensuse-leap15.1
+    - .arch-x86_64
+
+package-ubuntu16.04-amd64:
+  extends:
+    - .package-build
+    - .dist-ubuntu16.04
+    - .arch-amd64
+
+package-ubuntu16.04-ppc64le:
+  extends:
+    - .package-build
+    - .dist-ubuntu16.04
+    - .arch-ppc64le
+
 package-ubuntu18.04-amd64:
   extends:
     - .package-build
@@ -100,33 +193,38 @@ package-ubuntu18.04-ppc64le:
     - .dist-ubuntu18.04
     - .arch-ppc64le
 
-.buildx-setup:
-  before_script:
-    -  export BUILDX_VERSION=v0.6.3
-    -  apk add --no-cache curl
-    -  mkdir -p ~/.docker/cli-plugins
-    -  curl -sSLo ~/.docker/cli-plugins/docker-buildx "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-amd64"
-    -  chmod a+x ~/.docker/cli-plugins/docker-buildx
-
-    -  docker buildx create --use --platform=linux/amd64,linux/arm64
-
-    -  '[[ -n "${SKIP_QEMU_SETUP}" ]] || docker run --rm --privileged multiarch/qemu-user-static --reset -p yes'
-
 # Define the image build targets
 .image-build:
   stage: image-build
   variables:
     IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
     VERSION: "${CI_COMMIT_SHORT_SHA}"
-    PUSH_ON_BUILD: "true"
   before_script:
-    - !reference [.buildx-setup, before_script]
-
-    - apk add --no-cache bash make git
+    - apk add --no-cache bash make
     - 'echo "Logging in to CI registry ${CI_REGISTRY}"'
     - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
   script:
-    - make -f deployments/container/Makefile build-${DIST}
+    - make -f build/container/Makefile build-${DIST}
+    - make -f build/container/Makefile push-${DIST}
+
+image-centos7:
+  extends:
+    - .image-build
+    - .package-artifacts
+    - .dist-centos7
+  needs:
+    - package-centos7-ppc64le
+    - package-centos7-x86_64
+
+image-centos8:
+  extends:
+    - .image-build
+    - .package-artifacts
+    - .dist-centos8
+  needs:
+    - package-centos8-aarch64
+    - package-centos8-x86_64
+    - package-centos8-ppc64le
 
 image-ubi8:
   extends:
@@ -134,20 +232,19 @@ image-ubi8:
     - .package-artifacts
     - .dist-ubi8
   needs:
-    # Note: The ubi8 image uses the centos7 packages
-    - package-centos7-aarch64
+    # Note: The ubi8 image currently uses the centos7 packages
+    - package-centos7-ppc64le
     - package-centos7-x86_64
 
-image-ubuntu20.04:
+image-ubuntu18.04:
   extends:
     - .image-build
     - .package-artifacts
-    - .dist-ubuntu20.04
+    - .dist-ubuntu18.04
   needs:
     - package-ubuntu18.04-amd64
     - package-ubuntu18.04-arm64
-    - job: package-ubuntu18.04-ppc64le
-      optional: true
+    - package-ubuntu18.04-ppc64le
 
 # The DIST=packaging target creates an image containing all built packages
 image-packaging:
@@ -156,24 +253,21 @@ image-packaging:
     - .package-artifacts
     - .dist-packaging
   needs:
-    - job: package-ubuntu18.04-amd64
-    - job: package-ubuntu18.04-arm64
-    - job: package-amazonlinux2-aarch64
-      optional: true
-    - job: package-amazonlinux2-x86_64
-      optional: true
-    - job: package-centos7-aarch64
-      optional: true
-    - job: package-centos7-x86_64
-      optional: true
-    - job: package-centos8-ppc64le
-      optional: true
-    - job: package-debian10-amd64
-      optional: true
-    - job: package-opensuse-leap15.1-x86_64
-      optional: true
-    - job: package-ubuntu18.04-ppc64le
-      optional: true
+    - package-amazonlinux2-aarch64
+    - package-amazonlinux2-x86_64
+    - package-centos7-ppc64le
+    - package-centos7-x86_64
+    - package-centos8-aarch64
+    - package-centos8-ppc64le
+    - package-centos8-x86_64
+    - package-debian10-amd64
+    - package-debian9-amd64
+    - package-opensuse-leap15.1-x86_64
+    - package-ubuntu16.04-amd64
+    - package-ubuntu16.04-ppc64le
+    - package-ubuntu18.04-amd64
+    - package-ubuntu18.04-arm64
+    - package-ubuntu18.04-ppc64le
 
 # Define publish test helpers
 .test:toolkit:
@@ -205,30 +299,74 @@ image-packaging:
     TEST_CASES: "crio"
 
 # Define the test targets
-test-toolkit-ubuntu20.04:
+test-toolkit-ubuntu18.04:
   extends:
     - .test:toolkit
-    - .dist-ubuntu20.04
+    - .dist-ubuntu18.04
   needs:
-    - image-ubuntu20.04
+    - image-ubuntu18.04
 
-test-containerd-ubuntu20.04:
+test-containerd-ubuntu18.04:
   extends:
     - .test:containerd
-    - .dist-ubuntu20.04
+    - .dist-ubuntu18.04
   needs:
-    - image-ubuntu20.04
+    - image-ubuntu18.04
 
-test-crio-ubuntu20.04:
+test-crio-ubuntu18.04:
   extends:
     - .test:crio
-    - .dist-ubuntu20.04
+    - .dist-ubuntu18.04
   needs:
-    - image-ubuntu20.04
+    - image-ubuntu18.04
 
-test-docker-ubuntu20.04:
+test-docker-ubuntu18.04:
   extends:
     - .test:docker
-    - .dist-ubuntu20.04
+    - .dist-ubuntu18.04
   needs:
-    - image-ubuntu20.04
+    - image-ubuntu18.04
+
+# build-all jobs build packages for every OS / ARCH combination we support.
+#
+# They are run under two conditions:
+# 1) Automatically whenever a new tag is pushed to the repo (e.g. v1.1.0)
+# 2) Manually by a reviewer just before merging a MR.
+.build-all-for-arch:
+  variables:
+    # Setting DIST=docker invokes the docker- release targets
+    DIST: docker
+  extends:
+    - .package-build
+  stage: build-all
+  timeout: 2h 30m
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: always
+
+# The full set of build-all jobs organized to
+# have builds for each ARCH run in parallel.
+build-all-amd64:
+  extends:
+    - .build-all-for-arch
+    - .arch-amd64
+
+build-all-x86_64:
+  extends:
+    - .build-all-for-arch
+    - .arch-x86_64
+
+build-all-ppc64le:
+  extends:
+    - .build-all-for-arch
+    - .arch-ppc64le
+
+build-all-arm64:
+  extends:
+    - .build-all-for-arch
+    - .arch-arm64
+
+build-all-aarch64:
+  extends:
+    - .build-all-for-arch
+    - .arch-aarch64

.gitmodules

@@ -1,4 +1,9 @@
 [submodule "third_party/libnvidia-container"]
 	path = third_party/libnvidia-container
-	url = https://github.com/NVIDIA/libnvidia-container.git
-	branch = main
+	url = https://gitlab.com/nvidia/container-toolkit/libnvidia-container.git
+[submodule "third_party/nvidia-container-runtime"]
+	path = third_party/nvidia-container-runtime
+	url = https://gitlab.com/nvidia/container-toolkit/container-runtime.git
+[submodule "third_party/nvidia-docker"]
+	path = third_party/nvidia-docker
+	url = https://gitlab.com/nvidia/container-toolkit/nvidia-docker.git

.golangci.yml

@@ -1,43 +0,0 @@
-run:
-  timeout: 10m
-
-linters:
-  enable:
-    - contextcheck
-    - gocritic
-    - gofmt
-    - goimports
-    - gosec
-    - gosimple
-    - govet
-    - ineffassign
-    - misspell
-    - staticcheck
-    - unconvert
-
-linters-settings:
-  goimports:
-    local-prefixes: github.com/NVIDIA/nvidia-container-toolkit
-
-issues:
-  exclude:
-  # The legacy hook relies on spec.Hooks.Prestart, which is deprecated as of the v1.2.0 OCI runtime spec.
-  - "SA1019:(.+).Prestart is deprecated(.+)"
-  # TODO: We should address each of the following integer overflows.
-  - "G115: integer overflow conversion(.+)"
-  exclude-rules:
-  # Exclude the gocritic dupSubExpr issue for cgo files.
-  - path: internal/dxcore/dxcore.go
-    linters:
-    - gocritic
-    text: dupSubExpr
-  # Exclude the checks for usage of returns to config.Delete(Path) in the crio and containerd config packages.
-  - path: pkg/config/engine/
-    linters:
-    - errcheck
-    text: config.Delete
-  # RENDERD refers to the Render Device and not the past tense of render.
-  - path: .*.go
-    linters:
-    - misspell
-    text: "`RENDERD` is a misspelling of `RENDERED`"

.nvidia-ci.yml

@@ -1,4 +1,4 @@
-# Copyright (c) 2021-2022, NVIDIA CORPORATION.  All rights reserved.
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -27,17 +27,14 @@ default:
 variables:
   DOCKER_DRIVER: overlay2
   DOCKER_TLS_CERTDIR: "/certs"
-  # Release "devel"-tagged images off the main branch
-  RELEASE_DEVEL_BRANCH: "main"
+  # Release "devel"-tagged images off the master branch
+  RELEASE_DEVEL_BRANCH: "master"
   DEVEL_RELEASE_IMAGE_VERSION: "devel"
   # On the multi-arch builder we don't need the qemu setup.
   SKIP_QEMU_SETUP: "1"
   # Define the public staging registry
-  STAGING_REGISTRY: ghcr.io/nvidia
+  STAGING_REGISTRY: registry.gitlab.com/nvidia/container-toolkit/container-toolkit/staging
   STAGING_VERSION: ${CI_COMMIT_SHORT_SHA}
-  ARTIFACTORY_REPO_BASE: "https://urm.nvidia.com/artifactory/sw-gpu-cloudnative"
-  KITMAKER_RELEASE_FOLDER: "kitmaker"
-  PACKAGE_ARCHIVE_RELEASE_FOLDER: "releases"
 
 .image-pull:
   stage: image-build
@@ -49,11 +46,9 @@ variables:
     OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
     OUT_REGISTRY: "${CI_REGISTRY}"
     OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
-    PUSH_MULTIPLE_TAGS: "false"
   # We delay the job start to allow the public pipeline to generate the required images.
-  rules:
-    - when: delayed
-      start_in: 30 minutes
+  when: delayed
+  start_in: 30 minutes
   timeout: 30 minutes
   retry:
     max: 2
@@ -61,29 +56,39 @@ variables:
       - job_execution_timeout
       - stuck_or_timeout_failure
   before_script:
-    - !reference [.regctl-setup, before_script]
-    - apk add --no-cache make bash
     - >
-      regctl manifest get ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} --list > /dev/null && echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST}" || ( echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} does not exist" && sleep infinity )
+      docker pull ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} > /dev/null && echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST}" || ( echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} does not exist" && sleep infinity )
   script:
-    - regctl registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}"
-    - make -f deployments/container/Makefile IMAGE=${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} OUT_IMAGE=${OUT_IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}-${DIST} push-${DIST}
+    - docker pull ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST}
+    - docker tag ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} ${OUT_IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}-${DIST}
+    - docker login -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}" "${OUT_REGISTRY}"
+    - docker push ${OUT_IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}-${DIST}
+
+image-centos7:
+  extends:
+    - .image-pull
+    - .dist-centos7
+
+image-centos8:
+  extends:
+    - .image-pull
+    - .dist-centos8
 
 image-ubi8:
   extends:
+    - .image-pull
     - .dist-ubi8
-    - .image-pull
 
-image-ubuntu20.04:
+image-ubuntu18.04:
   extends:
-    - .dist-ubuntu20.04
     - .image-pull
+    - .dist-ubuntu18.04
 
 # The DIST=packaging target creates an image containing all built packages
 image-packaging:
   extends:
-    - .dist-packaging
     - .image-pull
+    - .dist-packaging
 
 # We skip the integration tests for the internal CI:
 .integration:
@@ -100,14 +105,14 @@ image-packaging:
   image: "${PULSE_IMAGE}"
   variables:
     IMAGE: "${CI_REGISTRY_IMAGE}/container-toolkit:${CI_COMMIT_SHORT_SHA}-${DIST}"
-    IMAGE_ARCHIVE: "container-toolkit-${DIST}-${ARCH}-${CI_JOB_ID}.tar"
-  rules:
-    - if: $SKIP_SCANS != "yes"
-    - when: manual
+    IMAGE_ARCHIVE: "container-toolkit.tar"
+  except:
+    variables:
+      - $SKIP_SCANS && $SKIP_SCANS == "yes"
   before_script:
     - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
     # TODO: We should specify the architecture here and scan all architectures
-    - docker pull --platform="${PLATFORM}" "${IMAGE}"
+    - docker pull "${IMAGE}"
     - docker save "${IMAGE}" -o "${IMAGE_ARCHIVE}"
     - AuthHeader=$(echo -n $SSA_CLIENT_ID:$SSA_CLIENT_SECRET | base64 -w0)
     - >
@@ -115,7 +120,6 @@ image-packaging:
     - if [ -z "$SSA_TOKEN" ]; then exit 1; else echo "SSA_TOKEN set!"; fi
   script:
     - pulse-cli -n $NSPECT_ID --ssa $SSA_TOKEN scan -i $IMAGE_ARCHIVE -p $CONTAINER_POLICY -o
-    - rm -f "${IMAGE_ARCHIVE}"
   artifacts:
     when: always
     expire_in: 1 week
@@ -127,47 +131,34 @@ image-packaging:
       - policy_evaluation.json
 
 # Define the scan targets
-scan-ubuntu20.04-amd64:
+scan-centos7:
   extends:
-    - .dist-ubuntu20.04
-    - .platform-amd64
     - .scan
+    - .dist-centos7
   needs:
-    - image-ubuntu20.04
+    - image-centos7
 
-scan-ubuntu20.04-arm64:
+scan-centos8:
   extends:
-    - .dist-ubuntu20.04
-    - .platform-arm64
     - .scan
+    - .dist-centos8
   needs:
-    - image-ubuntu20.04
-    - scan-ubuntu20.04-amd64
+    - image-centos8
 
-scan-ubi8-amd64:
+scan-ubuntu18.04:
   extends:
+    - .scan
+    - .dist-ubuntu18.04
+  needs:
+    - image-ubuntu18.04
+
+scan-ubi8:
+  extends:
+    - .scan
     - .dist-ubi8
-    - .platform-amd64
-    - .scan
   needs:
     - image-ubi8
 
-scan-ubi8-arm64:
-  extends:
-    - .dist-ubi8
-    - .platform-arm64
-    - .scan
-  needs:
-    - image-ubi8
-    - scan-ubi8-amd64
-
-scan-packaging:
-  extends:
-    - .dist-packaging
-    - .scan
-  needs:
-    - image-packaging
-
 # Define external release helpers
 .release:ngc:
   extends:
@@ -178,128 +169,61 @@ scan-packaging:
     OUT_REGISTRY: "${NGC_REGISTRY}"
     OUT_IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"
 
-.release:packages:
-  stage: release
-  needs:
-    - image-packaging
-  variables:
-    VERSION: "${CI_COMMIT_SHORT_SHA}"
-    PACKAGE_REGISTRY: "${CI_REGISTRY}"
-    PACKAGE_REGISTRY_USER: "${CI_REGISTRY_USER}"
-    PACKAGE_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
-    PACKAGE_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
-    PACKAGE_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}-packaging"
-    KITMAKER_ARTIFACTORY_REPO: "${ARTIFACTORY_REPO_BASE}-generic-local/${KITMAKER_RELEASE_FOLDER}"
-    ARTIFACTS_DIR: "${CI_PROJECT_DIR}/artifacts"
-  script:
-    - !reference [.regctl-setup, before_script]
-    - apk add --no-cache bash git
-    - regctl registry login "${PACKAGE_REGISTRY}" -u "${PACKAGE_REGISTRY_USER}" -p "${PACKAGE_REGISTRY_TOKEN}"
-    - ./scripts/extract-packages.sh "${PACKAGE_IMAGE_NAME}:${PACKAGE_IMAGE_TAG}"
-    - ./scripts/release-kitmaker-artifactory.sh "${KITMAKER_ARTIFACTORY_REPO}"
-    - rm -rf ${ARTIFACTS_DIR}
-
-# Define the package release targets
-release:packages:kitmaker:
-  extends:
-    - .release:packages
-
-release:archive:
+.release:dockerhub:
   extends:
     - .release:external
-  needs:
-    - image-packaging
   variables:
-    VERSION: "${CI_COMMIT_SHORT_SHA}"
-    PACKAGE_REGISTRY: "${CI_REGISTRY}"
-    PACKAGE_REGISTRY_USER: "${CI_REGISTRY_USER}"
-    PACKAGE_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
-    PACKAGE_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
-    PACKAGE_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}-packaging"
-    PACKAGE_ARCHIVE_ARTIFACTORY_REPO: "${ARTIFACTORY_REPO_BASE}-generic-local/${PACKAGE_ARCHIVE_RELEASE_FOLDER}"
-  script:
-    - apk add --no-cache bash git
-    - ./scripts/archive-packages.sh "${PACKAGE_ARCHIVE_ARTIFACTORY_REPO}"
+    OUT_REGISTRY_USER: "${REGISTRY_USER}"
+    OUT_REGISTRY_TOKEN: "${REGISTRY_TOKEN}"
+    OUT_REGISTRY: "${DOCKERHUB_REGISTRY}"
+    OUT_IMAGE_NAME: "${REGISTRY_IMAGE}"
 
-release:staging-ubuntu20.04:
+release:staging-ubuntu18.04:
   extends:
     - .release:staging
-    - .dist-ubuntu20.04
+    - .dist-ubuntu18.04
   needs:
-    - image-ubuntu20.04
+    - image-ubuntu18.04
 
 # Define the external release targets
 # Release to NGC
-release:ngc-ubuntu20.04:
+release:ngc-centos7:
   extends:
-    - .dist-ubuntu20.04
     - .release:ngc
+    - .dist-centos7
+
+release:ngc-centos8:
+  extends:
+    - .release:ngc
+    - .dist-centos8
+
+release:ngc-ubuntu18:
+  extends:
+    - .release:ngc
+    - .dist-ubuntu18.04
 
 release:ngc-ubi8:
   extends:
-    - .dist-ubi8
     - .release:ngc
-
-release:ngc-packaging:
-  extends:
-    - .dist-packaging
-    - .release:ngc
-
-# Define the external image signing steps for NGC
-# Download the ngc cli binary for use in the sign steps
-.ngccli-setup:
-  before_script:
-    - apt-get update && apt-get install -y curl unzip jq
-    - |
-      if [ -z "${NGCCLI_VERSION}" ]; then
-        NGC_VERSION_URL="https://api.ngc.nvidia.com/v2/resources/nvidia/ngc-apps/ngc_cli/versions"
-        # Extract the latest version from the JSON data using jq
-        export NGCCLI_VERSION=$(curl -s $NGC_VERSION_URL | jq -r '.recipe.latestVersionIdStr')
-      fi
-      echo "NGCCLI_VERSION ${NGCCLI_VERSION}"
-    - curl -sSLo ngccli_linux.zip https://api.ngc.nvidia.com/v2/resources/nvidia/ngc-apps/ngc_cli/versions/${NGCCLI_VERSION}/files/ngccli_linux.zip
-    - unzip ngccli_linux.zip
-    - chmod u+x ngc-cli/ngc
-
-# .sign forms the base of the deployment jobs which signs images in the CI registry.
-# This is extended with the image name and version to be deployed.
-.sign:ngc:
-  image: ubuntu:latest
-  stage: sign
-  rules:
-    - if: $CI_COMMIT_TAG
-  variables:
-    NGC_CLI_API_KEY: "${NGC_REGISTRY_TOKEN}"
-    IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"
-    IMAGE_TAG: "${CI_COMMIT_TAG}-${DIST}"
-  retry:
-    max: 2
-  before_script:
-    - !reference [.ngccli-setup, before_script]
-    # We ensure that the IMAGE_NAME and IMAGE_TAG is set
-    - 'echo Image Name: ${IMAGE_NAME} && [[ -n "${IMAGE_NAME}" ]] || exit 1'
-    - 'echo Image Tag: ${IMAGE_TAG} && [[ -n "${IMAGE_TAG}" ]] || exit 1'
-  script:
-    - 'echo "Signing the image ${IMAGE_NAME}:${IMAGE_TAG}"'
-    - ngc-cli/ngc registry image publish --source ${IMAGE_NAME}:${IMAGE_TAG} ${IMAGE_NAME}:${IMAGE_TAG} --public --discoverable --allow-guest --sign --org nvidia
-
-sign:ngc-ubuntu20.04:
-  extends:
-    - .dist-ubuntu20.04
-    - .sign:ngc
-  needs:
-    - release:ngc-ubuntu20.04
-
-sign:ngc-ubi8:
-  extends:
     - .dist-ubi8
-    - .sign:ngc
-  needs:
-    - release:ngc-ubi8
 
-sign:ngc-packaging:
+# Release to Dockerhub
+release:dockerhub-centos7:
   extends:
-    - .dist-packaging
-    - .sign:ngc
-  needs:
-    - release:ngc-packaging
+    - .release:dockerhub
+    - .dist-centos7
+
+release:dockerhub-centos8:
+  extends:
+    - .release:dockerhub
+    - .dist-centos8
+
+release:dockerhub-ubuntu18:
+  extends:
+    - .release:dockerhub
+    - .dist-ubuntu18.04
+
+release:dockerhub-ubi8:
+  extends:
+    - .release:dockerhub
+    - .dist-ubi8

CHANGELOG.md

@@ -1,597 +0,0 @@
-# NVIDIA Container Toolkit Changelog
-
-## v1.17.8
-
-- Updated the ordering of Mounts in CDI to have a deterministic output. This makes testing more consistent.
-- Added NVIDIA_CTK_DEBUG envvar to hooks.
-
-### Changes in libnvidia-container
-
-- Fixed bug in setting default for `--cuda-compat-mode` flag. This caused failures in use cases invoking the `nvidia-container-cli` directly.
-- Added additional logging to the `nvidia-container-cli`.
-- Fixed variable initialisation when updating the ldcache. This caused failures on Arch linux or other platforms where the `nvidia-container-cli` was built from source.
-
-## v1.17.7
-
-- Fix mode detection on Thor-based systems. This correctly resolves `auto` mode to `csv`.
-- Fix resolution of libs in LDCache on ARM. This fixes CDI spec generation on ARM-based systems using NVML.
-- Run update-ldcache hook in isolated namespaces.
-
-### Changes in the Toolkit Container
-
-- Bump CUDA base image version to 12.9.0
-
-### Changes in libnvidia-container
-
-- Add `--cuda-compat-mode` flag to the `nvidia-container-cli configure` command.
-
-## v1.17.6
-
-### Changes in the Toolkit Container
-
-- Allow container runtime executable path to be specified when configuring containerd.
-- Bump CUDA base image version to 12.8.1
-
-### Changes in libnvidia-container
-
-- Skip files when user has insufficient permissions. This prevents errors when discovering IPC sockets when the `nvidia-container-cli` is run as a non-root user.
-- Fix building with Go 1.24
-- Fix some typos in text.
-
-## v1.17.5
-
-- Allow the `enabled-cuda-compat` hook to be skipped when generating CDI specifications. This improves compatibility with older NVIDIA Container Toolkit installations. The hook is explicitly ignored for management CDI specifications.
-- Add IMEX binaries to CDI discovery. This includes the IMEX Daemon and IMEX Control binaries in containers.
-- Fix bug that may overwrite docker feature flags when configuring CDI from the `nvidia-ctk runtime configure` command.
-- Remove the unused `Set()` function from engine config API.
-- Add an `EnableCDI()` method to engine config API.
-- Add an `ignore-imex-channel-requests` feature flag. This ensures that the NVIDIA Container Runtime can be configured to ignore IMEX channel requests when these should be managed by another component.
-- Update the `update-ldcache` hook to run the host `ldconfig` from a MEMFD.
-- Add support for CUDA Forward Compatibility (removed by default in v1.17.4) using a dedicated `enable-cuda-compat` hook.  This can be disabled using a `disable-cuda-compat-lib-hook` feature flag.
-- Disable nvsandboxutils in the `nvcdi` API. This prevents a segmentation violation with NVIDIA GPU Drivers from the 565 branch.
-- Fix a bug where `cdi` mode would not work with the `--gpus` flag even if the NVIDIA Container Runtime was used.
-
-### Changes in the Toolkit Container
-
-- Enable CDI in container engine (Containerd, Cri-o, Docker) if CDI_ENABLED is set.
-- Bump CUDA base image version to 12.8.0
-
-## v1.17.4
-- Disable mounting of compat libs from container by default
-- Add allow-cuda-compat-libs-from-container feature flag
-- Skip graphics modifier in CSV mode
-- Properly pass configSearchPaths to a Driver constructor
-- Add support for containerd version 3 config
-- Add string TOML source
-
-### Changes in libnvidia-container
-- Add no-cntlibs CLI option to nvidia-container-cli
-
-### Changes in the Toolkit Container
-- Bump CUDA base image version to 12.6.3
-
-## v1.17.3
-- Only allow host-relative LDConfig paths by default.
-### Changes in libnvidia-container
-- Create virtual copy of host ldconfig binary before calling fexecve()
-
-## v1.17.2
-- Fixed a bug where legacy images would set imex channels as `all`.
-
-## v1.17.1
-- Fixed a bug where specific symlinks existing in a container image could cause a container to fail to start.
-- Fixed a bug on Tegra-based systems where a container would fail to start.
-- Fixed a bug where the default container runtime config path was not properly set.
-
-### Changes in the Toolkit Container
-- Fallback to using a config file if the current runtime config can not be determined from the command line.
-
-## v1.17.0
-- Promote v1.17.0-rc.2 to v1.17.0
-- Fix bug when using just-in-time CDI spec generation
-- Check for valid paths in create-symlinks hook
-
-## v1.17.0-rc.2
-- Fix bug in locating libcuda.so from ldcache
-- Fix bug in sorting of symlink chain
-- Remove unsupported print-ldcache command
-- Remove csv-filename support from create-symlinks
-
-### Changes in the Toolkit Container
-- Fallback to `crio-status` if `crio status` does not work when configuring the crio runtime
-
-## v1.17.0-rc.1
-- Allow IMEX channels to be requested as volume mounts
-- Fix typo in error message
-- Add disable-imex-channel-creation feature flag
-- Add -z,lazy to LDFLAGS
-- Add imex channels to management CDI spec
-- Add support to fetch current container runtime config from the command line.
-- Add creation of select driver symlinks to CDI spec generation.
-- Remove support for config overrides when configuring runtimes.
-- Skip explicit creation of libnvidia-allocator.so.1 symlink
-- Add vdpau as as a driver library search path.
-- Add support for using libnvsandboxutils to generate CDI specifications.
-
-### Changes in the Toolkit Container
-
-- Allow opt-in features to be selected when deploying the toolkit-container.
-- Bump CUDA base image version to 12.6.2
-- Remove support for config overrides when configuring runtimes.
-
-### Changes in libnvidia-container
-
-- Add no-create-imex-channels command line option.
-
-## v1.16.2
-- Exclude libnvidia-allocator from graphics mounts. This fixes a bug that leaks mounts when a container is started with bi-directional mount propagation.
-- Use empty string for default runtime-config-override. This removes a redundant warning for runtimes (e.g. Docker) where this is not applicable.
-
-### Changes in the Toolkit Container
-- Bump CUDA base image version to 12.6.0
-
-### Changes in libnvidia-container
-- Add no-gsp-firmware command line option
-- Add no-fabricmanager command line option
-- Add no-persistenced command line option
-- Skip directories and symlinks when mounting libraries.
-
-## v1.16.1
-- Fix bug with processing errors during CDI spec generation for MIG devices
-
-## v1.16.0
-- Promote v1.16.0-rc.2 to v1.16.0
-
-### Changes in the Toolkit Container
-- Bump CUDA base image version to 12.5.1
-
-## v1.16.0-rc.2
-- Use relative path to locate driver libraries
-- Add RelativeToRoot function to Driver
-- Inject additional libraries for full X11 functionality
-- Extract options from default runtime if runc does not exist
-- Avoid using map pointers as maps are always passed by reference
-- Reduce logging for the NVIDIA Container runtime
-- Fix bug in argument parsing for logger creation
-
-## v1.16.0-rc.1
-
-- Support vulkan ICD files directly in a driver root. This allows for the discovery of vulkan files in GKE driver installations.
-- Increase priority of ld.so.conf.d config file injected into container. This ensures that injected libraries are preferred over libraries present in the container.
-- Set default CDI spec permissions to 644. This fixes permission issues when using the `nvidia-ctk cdi transform` functions.
-- Add `dev-root` option to `nvidia-ctk system create-device-nodes` command.
-- Fix location of `libnvidia-ml.so.1` when a non-standard driver root is used. This enabled CDI spec generation when using the driver container on a host.
-- Recalculate minimum required CDI spec version on save.
-- Move `nvidia-ctk hook` commands to a separate `nvidia-cdi-hook` binary. The same subcommands are supported.
-- Use `:` as an `nvidia-ctk config --set` list separator. This fixes a bug when trying to set config options that are lists.
-
-- [toolkit-container] Bump CUDA base image version to 12.5.0
-- [toolkit-container] Allow the path to `toolkit.pid` to be specified directly.
-- [toolkit-container] Remove provenance information from image manifests.
-- [toolkit-container] Add `dev-root` option when configuring the toolkit. This adds support for GKE driver installations.
-
-## v1.15.0
-
-* Remove `nvidia-container-runtime` and `nvidia-docker2` packages.
-* Use `XDG_DATA_DIRS` environment variable when locating config files such as graphics config files.
-* Add support for v0.7.0 Container Device Interface (CDI) specification.
-* Add `--config-search-path` option to `nvidia-ctk cdi generate` command. These paths are used when locating driver files such as graphics config files.
-* Use D3DKMTEnumAdapters3 to enumerate adpaters on WSL2 if available.
-* Add support for v1.2.0 OCI Runtime specification.
-* Explicitly set `NVIDIA_VISIBLE_DEVICES=void` in generated CDI specifications. This prevents the NVIDIA Container Runtime from making additional modifications.
-
-* [libnvidia-container] Use D3DKMTEnumAdapters3 to enumerate adpaters on WSL2 if available.
-
-* [toolkit-container] Bump CUDA base image version to 12.4.1
-
-## v1.15.0-rc.4
-* Add a `--spec-dir` option to the `nvidia-ctk cdi generate` command. This allows specs outside of `/etc/cdi` and `/var/run/cdi` to be processed.
-* Add support for extracting device major number from `/proc/devices` if `nvidia` is used as a device name over `nvidia-frontend`.
-* Allow multiple device naming strategies for `nvidia-ctk cdi generate` command. This allows a single
-  CDI spec to be generated that includes GPUs by index and UUID.
-* Set the default `--device-name-strategy` for the `nvidia-ctk cdi generate` command to `[index, uuid]`.
-* Remove `libnvidia-container0` jetpack dependency included for legacy Tegra-based systems.
-* Add `NVIDIA_VISIBLE_DEVICES=void` to generated CDI specifications.
-
-* [toolkit-container] Remove centos7 image. The ubi8 image can be used on all RPM-based platforms.
-* [toolkit-container] Bump CUDA base image version to 12.3.2
-
-## v1.15.0-rc.3
-* Fix bug in `nvidia-ctk hook update-ldcache` where default `--ldconfig-path` value was not applied.
-
-## v1.15.0-rc.2
-* Extend the `runtime.nvidia.com/gpu` CDI kind to support full-GPUs and MIG devices specified by index or UUID.
-* Fix bug when specifying `--dev-root` for Tegra-based systems.
-* Log explicitly requested runtime mode.
-* Remove package dependency on libseccomp.
-* Added detection of libnvdxgdmal.so.1 on WSL2
-* Use devRoot to resolve MIG device nodes.
-* Fix bug in determining default nvidia-container-runtime.user config value on SUSE-based systems.
-* Add `crun` to the list of configured low-level runtimes.
-* Added support for `--ldconfig-path` to `nvidia-ctk cdi generate` command.
-* Fix `nvidia-ctk runtime configure --cdi.enabled` for Docker.
-* Add discovery of the GDRCopy device (`gdrdrv`) if the `NVIDIA_GDRCOPY` environment variable of the container is set to `enabled`
-
-* [toolkit-container] Bump CUDA base image version to 12.3.1.
-
-## v1.15.0-rc.1
-* Skip update of ldcache in containers without ldconfig. The .so.SONAME symlinks are still created.
-* Normalize ldconfig path on use. This automatically adjust the ldconfig setting applied to ldconfig.real on systems where this exists.
-* Include `nvidia/nvoptix.bin` in list of graphics mounts.
-* Include `vulkan/icd.d/nvidia_layers.json` in list of graphics mounts.
-* Add support for `--library-search-paths` to `nvidia-ctk cdi generate` command.
-* Add support for injecting /dev/nvidia-nvswitch* devices if the NVIDIA_NVSWITCH=enabled envvar is specified.
-* Added support for `nvidia-ctk runtime configure --enable-cdi` for the `docker` runtime. Note that this requires Docker >= 25.
-* Fixed bug in `nvidia-ctk config` command when using `--set`. The types of applied config options are now applied correctly.
-* Add `--relative-to` option to `nvidia-ctk transform root` command. This controls whether the root transformation is applied to host or container paths.
-* Added automatic CDI spec generation when the `runtime.nvidia.com/gpu=all` device is requested by a container.
-
-* [libnvidia-container] Fix device permission check when using cgroupv2 (fixes #227)
-
-## v1.14.3
-* [toolkit-container] Bump CUDA base image version to 12.2.2.
-
-## v1.14.2
-* Fix bug on Tegra-based systems where symlinks were not created in containers.
-* Add --csv.ignore-pattern command line option to nvidia-ctk cdi generate command.
-
-## v1.14.1
-* Fixed bug where contents of `/etc/nvidia-container-runtime/config.toml` is ignored by the NVIDIA Container Runtime Hook.
-
-* [libnvidia-container] Use libelf.so on RPM-based systems due to removed mageia repositories hosting pmake and bmake.
-
-## v1.14.0
-* Promote v1.14.0-rc.3 to v1.14.0
-
-## v1.14.0-rc.3
-* Added support for generating OCI hook JSON file to `nvidia-ctk runtime configure` command.
-* Remove installation of OCI hook JSON from RPM package.
-* Refactored config for `nvidia-container-runtime-hook`.
-* Added a `nvidia-ctk config` command which supports setting config options using a `--set` flag.
-* Added `--library-search-path` option to `nvidia-ctk cdi generate` command in `csv` mode. This allows folders where
-  libraries are located to be specified explicitly.
-* Updated go-nvlib to support devices which are not present in the PCI device database. This allows the creation of dev/char symlinks on systems with such devices installed.
-* Added `UsesNVGPUModule` info function for more robust platform detection. This is required on Tegra-based systems where libnvidia-ml.so is also supported.
-
-* [toolkit-container] Set `NVIDIA_VISIBLE_DEVICES=void` to prevent injection of NVIDIA devices and drivers into the NVIDIA Container Toolkit container.
-
-## v1.14.0-rc.2
-* Fix bug causing incorrect nvidia-smi symlink to be created on WSL2 systems with multiple driver roots.
-* Remove dependency on coreutils when installing package on RPM-based systems.
-* Create output folders if required when running `nvidia-ctk runtime configure`
-* Generate default config as post-install step.
-* Added support for detecting GSP firmware at custom paths when generating CDI specifications.
-* Added logic to skip the extraction of image requirements if `NVIDIA_DISABLE_REQUIRES` is set to `true`.
-
-* [libnvidia-container] Include Shared Compiler Library (libnvidia-gpucomp.so) in the list of compute libaries.
-
-* [toolkit-container] Ensure that common envvars have higher priority when configuring the container engines.
-* [toolkit-container] Bump CUDA base image version to 12.2.0.
-* [toolkit-container] Remove installation of nvidia-experimental runtime. This is superceded by the NVIDIA Container Runtime in CDI mode.
-
-## v1.14.0-rc.1
-
-* Add support for updating containerd configs to the `nvidia-ctk runtime configure` command.
-* Create file in `etc/ld.so.conf.d` with permissions `644` to support non-root containers.
-* Generate CDI specification files with `644` permissions to allow rootless applications (e.g. podman)
-* Add `nvidia-ctk cdi list` command to show the known CDI devices.
-* Add support for generating merged devices (e.g. `all` device) to the nvcdi API.
-* Use *.* pattern to locate libcuda.so when generating a CDI specification to support platforms where a patch version is not specified.
-* Update go-nvlib to skip devices that are not MIG capable when generating CDI specifications.
-* Add `nvidia-container-runtime-hook.path` config option to specify NVIDIA Container Runtime Hook path explicitly.
-* Fix bug in creation of `/dev/char` symlinks by failing operation if kernel modules are not loaded.
-* Add option to load kernel modules when creating device nodes
-* Add option to create device nodes when creating `/dev/char` symlinks
-
-* [libnvidia-container] Support OpenSSL 3 with the Encrypt/Decrypt library
-
-* [toolkit-container] Allow same envars for all runtime configs
-
-## v1.13.1
-
-* Update `update-ldcache` hook to only update ldcache if it exists.
-* Update `update-ldcache` hook to create `/etc/ld.so.conf.d` folder if it doesn't exist.
-* Fix failure when libcuda cannot be located during XOrg library discovery.
-* Fix CDI spec generation on systems that use `/etc/alternatives` (e.g. Debian)
-
-## v1.13.0
-
-* Promote 1.13.0-rc.3 to 1.13.0
-
-## v1.13.0-rc.3
-
-* Only initialize NVML for modes that require it when runing `nvidia-ctk cdi generate`.
-* Prefer /run over /var/run when locating nvidia-persistenced and nvidia-fabricmanager sockets.
-* Fix the generation of CDI specifications for management containers when the driver libraries are not in the LDCache.
-* Add transformers to deduplicate and simplify CDI specifications.
-* Generate a simplified CDI specification by default. This means that entities in the common edits in a spec are not included in device definitions.
-* Also return an error from the nvcdi.New constructor instead of panicing.
-* Detect XOrg libraries for injection and CDI spec generation.
-* Add `nvidia-ctk system create-device-nodes` command to create control devices.
-* Add `nvidia-ctk cdi transform` command to apply transforms to CDI specifications.
-* Add `--vendor` and `--class` options to `nvidia-ctk cdi generate`
-
-* [libnvidia-container] Fix segmentation fault when RPC initialization fails.
-* [libnvidia-container] Build centos variants of the NVIDIA Container Library with static libtirpc v1.3.2.
-* [libnvidia-container] Remove make targets for fedora35 as the centos8 packages are compatible.
-
-* [toolkit-container] Add `nvidia-container-runtime.modes.cdi.annotation-prefixes` config option that allows the CDI annotation prefixes that are read to be overridden.
-* [toolkit-container] Create device nodes when generating CDI specification for management containers.
-* [toolkit-container] Add `nvidia-container-runtime.runtimes` config option to set the low-level runtime for the NVIDIA Container Runtime
-
-## v1.13.0-rc.2
-
-* Don't fail chmod hook if paths are not injected
-* Only create `by-path` symlinks if CDI devices are actually requested.
-* Fix possible blank `nvidia-ctk` path in generated CDI specifications
-* Fix error in postun scriplet on RPM-based systems
-* Only check `NVIDIA_VISIBLE_DEVICES` for environment variables if no annotations are specified.
-* Add `cdi.default-kind` config option for constructing fully-qualified CDI device names in CDI mode
-* Add support for `accept-nvidia-visible-devices-envvar-unprivileged` config setting in CDI mode
-* Add `nvidia-container-runtime-hook.skip-mode-detection` config option to bypass mode detection. This allows `legacy` and `cdi` mode, for example, to be used at the same time.
-* Add support for generating CDI specifications for GDS and MOFED devices
-* Ensure CDI specification is validated on save when generating a spec
-* Rename `--discovery-mode` argument to `--mode` for `nvidia-ctk cdi generate`
-* [libnvidia-container] Fix segfault on WSL2 systems
-* [toolkit-container] Add `--cdi-enabled` flag to toolkit config
-* [toolkit-container] Install `nvidia-ctk` from toolkit container
-* [toolkit-container] Use installed `nvidia-ctk` path in NVIDIA Container Toolkit config
-* [toolkit-container] Bump CUDA base images to 12.1.0
-* [toolkit-container] Set `nvidia-ctk` path in the
-* [toolkit-container] Add `cdi.k8s.io/*` to set of allowed annotations in containerd config
-* [toolkit-container] Generate CDI specification for use in management containers
-* [toolkit-container] Install experimental runtime as `nvidia-container-runtime.experimental` instead of `nvidia-container-runtime-experimental`
-* [toolkit-container] Install and configure mode-specific runtimes for `cdi` and `legacy` modes
-
-## v1.13.0-rc.1
-
-* Include MIG-enabled devices as GPUs when generating CDI specification
-* Fix missing NVML symbols when running `nvidia-ctk` on some platforms [#49]
-* Add CDI spec generation for WSL2-based systems to `nvidia-ctk cdi generate` command
-* Add `auto` mode to `nvidia-ctk cdi generate` command to automatically detect a WSL2-based system over a standard NVML-based system.
-* Add mode-specific (`.cdi` and `.legacy`) NVIDIA Container Runtime binaries for use in the GPU Operator
-* Discover all `gsb*.bin` GSP firmware files when generating CDI specification.
-* Align `.deb` and `.rpm` release candidate package versions
-* Remove `fedora35` packaging targets
-* [libnvidia-container] Include all `gsp*.bin` firmware files if present
-* [libnvidia-container] Align `.deb` and `.rpm` release candidate package versions
-* [libnvidia-container] Remove `fedora35` packaging targets
-* [toolkit-container] Install `nvidia-container-toolkit-operator-extensions` package for mode-specific executables.
-* [toolkit-container] Allow `nvidia-container-runtime.mode` to be set when configuring the NVIDIA Container Toolkit
-
-## v1.12.0
-
-* Promote `v1.12.0-rc.5` to `v1.12.0`
-* Rename `nvidia cdi generate` `--root` flag to `--driver-root` to better indicate intent
-* [libnvidia-container] Add nvcubins.bin to DriverStore components under WSL2
-* [toolkit-container] Bump CUDA base images to 12.0.1
-
-## v1.12.0-rc.5
-
-* Fix bug here the `nvidia-ctk` path was not properly resolved. This causes failures to run containers when the runtime is configured in `csv` mode or if the `NVIDIA_DRIVER_CAPABILITIES` includes `graphics` or `display` (e.g. `all`).
-
-## v1.12.0-rc.4
-
-* Generate a minimum CDI spec version for improved compatibility.
-* Add `--device-name-strategy` options to the `nvidia-ctk cdi generate` command that can be used to control how device names are constructed.
-* Set default for CDI device name generation to `index` to generate device names such as `nvidia.com/gpu=0` or `nvidia.com/gpu=1:0` by default.
-
-## v1.12.0-rc.3
-
-* Don't fail if by-path symlinks for DRM devices do not exist
-* Replace the --json flag with a --format [json|yaml] flag for the nvidia-ctk cdi generate command
-* Ensure that the CDI output folder is created if required
-* When generating a CDI specification use a blank host path for devices to ensure compatibility with the v0.4.0 CDI specification
-* Add injection of Wayland JSON files
-* Add GSP firmware paths to generated CDI specification
-* Add --root flag to nvidia-ctk cdi generate command
-
-## v1.12.0-rc.2
-
-* Inject Direct Rendering Manager (DRM) devices into a container using the NVIDIA Container Runtime
-* Improve logging of errors from the NVIDIA Container Runtime
-* Improve CDI specification generation to support rootless podman
-* Use `nvidia-ctk cdi generate` to generate CDI specifications instead of `nvidia-ctk info generate-cdi`
-* [libnvidia-container] Skip creation of existing files when these are already mounted
-
-## v1.12.0-rc.1
-
-* Add support for multiple Docker Swarm resources
-* Improve injection of Vulkan configurations and libraries
-* Add `nvidia-ctk info generate-cdi` command to generated CDI specification for available devices
-* [libnvidia-container] Include NVVM compiler library in compute libs
-
-## v1.11.0
-
-* Promote v1.11.0-rc.3 to v1.11.0
-
-## v1.11.0-rc.3
-
-* Build fedora35 packages
-* Introduce an `nvidia-container-toolkit-base` package for better dependency management
-* Fix removal of `nvidia-container-runtime-hook` on RPM-based systems
-* Inject platform files into container on Tegra-based systems
-* [toolkit container] Update CUDA base images to 11.7.1
-* [libnvidia-container] Preload libgcc_s.so.1 on arm64 systems
-
-## v1.11.0-rc.2
-
-* Allow `accept-nvidia-visible-devices-*` config options to be set by toolkit container
-* [libnvidia-container] Fix bug where LDCache was not updated when the `--no-pivot-root` option was specified
-
-## v1.11.0-rc.1
-
-* Add discovery of GPUDirect Storage (`nvidia-fs*`) devices if the `NVIDIA_GDS` environment variable of the container is set to `enabled`
-* Add discovery of MOFED Infiniband devices if the `NVIDIA_MOFED` environment variable of the container is set to `enabled`
-* Fix bug in CSV mode where libraries listed as `sym` entries in mount specification are not added to the LDCache.
-* Rename `nvidia-container-toolkit` executable to `nvidia-container-runtime-hook` and create `nvidia-container-toolkit` as a symlink to `nvidia-container-runtime-hook` instead.
-* Add `nvidia-ctk runtime configure` command to configure the Docker config file (e.g. `/etc/docker/daemon.json`) for use with the NVIDIA Container Runtime.
-
-## v1.10.0
-
-* Promote v1.10.0-rc.3 to v1.10.0
-
-## v1.10.0-rc.3
-
-* Use default config instead of raising an error if config file cannot be found
-* Ignore NVIDIA_REQUIRE_JETPACK* environment variables for requirement checks
-* Fix bug in detection of Tegra systems where `/sys/devices/soc0/family` is ignored
-* Fix bug where links to devices were detected as devices
-* [libnvida-container] Fix bug introduced when adding libcudadebugger.so to list of libraries
-
-## v1.10.0-rc.2
-
-* Add support for NVIDIA_REQUIRE_* checks for cuda version and arch to csv mode
-* Switch to debug logging to reduce log verbosity
-* Support logging to logs requested in command line
-* Fix bug when launching containers with relative root path (e.g. using containerd)
-* Allow low-level runtime path to be set explicitly as nvidia-container-runtime.runtimes option
-* Fix failure to locate low-level runtime if PATH envvar is unset
-* Replace experimental option for NVIDIA Container Runtime with nvidia-container-runtime.mode = csv option
-* Use csv as default mode on Tegra systems without NVML
-* Add --version flag to all CLIs
-* [libnvidia-container] Bump libtirpc to 1.3.2
-* [libnvidia-container] Fix bug when running host ldconfig using glibc compiled with a non-standard prefix
-* [libnvidia-container] Add libcudadebugger.so to list of compute libraries
-
-## v1.10.0-rc.1
-
-* Include nvidia-ctk CLI in installed binaries
-* Add experimental option to NVIDIA Container Runtime
-
-## v1.9.0
-
-* [libnvidia-container] Add additional check for Tegra in /sys/.../family file in CLI
-* [libnvidia-container] Update jetpack-specific CLI option to only load Base CSV files by default
-* [libnvidia-container] Fix bug (from 1.8.0) when mounting GSP firmware into containers without /lib to /usr/lib symlinks
-* [libnvidia-container] Update nvml.h to CUDA 11.6.1 nvML_DEV 11.6.55
-* [libnvidia-container] Update switch statement to include new brands from latest nvml.h
-* [libnvidia-container] Process all --require flags on Jetson platforms
-* [libnvidia-container] Fix long-standing issue with running ldconfig on Debian systems
-
-## v1.8.1
-
-* [libnvidia-container] Fix bug in determining cgroup root when running in nested containers
-* [libnvidia-container] Fix permission issue when determining cgroup version
-
-## v1.8.0
-
-* Promote 1.8.0-rc.2-1 to 1.8.0
-
-## v1.8.0-rc.2
-
-* Remove support for building amazonlinux1 packages
-
-## v1.8.0-rc.1
-
-* [libnvidia-container] Add support for cgroupv2
-* Release toolkit-container images from nvidia-container-toolkit repository
-
-## v1.7.0
-
-* Promote 1.7.0-rc.1-1 to 1.7.0
- * Bump Golang version to 1.16.4
-
-## v1.7.0-rc.1
-
-* Specify containerd runtime type as string in config tools to remove dependency on containerd package
-* Add supported-driver-capabilities config option to allow for a subset of all driver capabilities to be specified
-
-## v1.6.0
-
-* Promote 1.6.0-rc.3-1 to 1.6.0
- * Fix unnecessary logging to stderr instead of configured nvidia-container-runtime log file
-
-## v1.6.0-rc.3
-
-* Add supported-driver-capabilities config option to the nvidia-container-toolkit
-* Move OCI and command line checks for runtime to internal oci package
-
-## v1.6.0-rc.2
-
-* Use relative path to OCI specification file (config.json) if bundle path is not specified as an argument to the nvidia-container-runtime
-
-## v1.6.0-rc.1
-
-* Add AARCH64 package for Amazon Linux 2
-* Include nvidia-container-runtime into nvidia-container-toolkit package
-
-## v1.5.1
-
-* Fix bug where Docker Swarm device selection is ignored if NVIDIA_VISIBLE_DEVICES is also set
-* Improve unit testing by using require package and adding coverage reports
-* Remove unneeded go dependencies by running go mod tidy
-* Move contents of pkg directory to cmd for CLI tools
-* Ensure make binary target explicitly sets GOOS
-
-## v1.5.0
-
-* Add dependence on libnvidia-container-tools >= 1.4.0
-* Add golang check targets to Makefile
-* Add Jenkinsfile definition for build targets
-* Move docker.mk to docker folder
-
-## v1.4.2
-
-* Add dependence on libnvidia-container-tools >= 1.3.3
-
-## v1.4.1
-
-* Ignore NVIDIA_VISIBLE_DEVICES for containers with insufficent privileges
-* Add dependence on libnvidia-container-tools >= 1.3.2
-
-## v1.4.0
-
-* Add 'compute' capability to list of defaults
-* Add dependence on libnvidia-container-tools >= 1.3.1
-
-## v1.3.0
-
-* Promote 1.3.0-rc.2-1 to 1.3.0
-* Add dependence on libnvidia-container-tools >= 1.3.0
-
-## v1.3.0-rc.2
-
-* 2c180947 Add more tests for new semantics with device list from volume mounts
-* 7c003857 Refactor accepting device lists from volume mounts as a boolean
-
-## v1.3.0-rc.1
-
-* b50d86c1 Update build system to accept a TAG variable for things like rc.x
-* fe65573b Add common CI tests for things like golint, gofmt, unit tests, etc.
-* da6fbb34 Revert "Add ability to merge envars of the form NVIDIA_VISIBLE_DEVICES_*"
-* a7fb3330 Flip build-all targets to run automatically on merge requests
-* 8b248b66 Rename github.com/NVIDIA/container-toolkit to nvidia-container-toolkit
-* da36874e Add new config options to pull device list from mounted files instead of ENVVAR
-
-## v1.2.1
-
-* 4e6e0ed4 Add 'ngx' to list of*all* driver capabilities
-* 2f4af743 List config.toml as a config file in the RPM SPEC
-
-## v1.2.0
-
-*  8e0aab46 Fix repo listed in changelog for debian distributions
-*  320bb6e4 Update dependence on libnvidia-container to 1.2.0
-*  6cfc8097 Update package license to match source license
-*  e7dc3cbb Fix debian copyright file
-*  d3aee3e0 Add the 'ngx' driver capability
-
-## v1.1.2
-
-* c32237f3 Add support for parsing Linux Capabilities for older OCI specs
-
-## v1.1.1
-
-* d202aded Update dependence to libnvidia-container 1.1.1
-
-## v1.1.0
-
-* 4e4de762 Update build system to support multi-arch builds
-* fcc1d116 Add support for MIG (Multi-Instance GPUs)
-* d4ff0416 Add ability to merge envars of the form NVIDIA_VISIBLE_DEVICES_*
-* 60f165ad Add no-pivot option to toolkit
-
-## v1.0.5
-
-* Initial release. Replaces older package nvidia-container-runtime-hook. (Closes: #XXXXXX)

DEVELOPMENT.md

@@ -13,15 +13,13 @@ The `nvidia-container-toolkit` resides in this repo directly.
 
 In oder to build the packages, the following command is executed
 ```sh
-./scripts/build-packages.sh TARGET
+./scripts/build-all-components.sh TARGET
 ```
 where `TARGET` is a make target that is valid for each of the sub-components.
 
 These include:
 * `ubuntu18.04-amd64`
-* `centos7-x86_64`
-
-If no `TARGET` is specified, all valid release targets are built.
+* `centos8-x86_64`
 
 The packages are generated in the `dist` folder.
 
@@ -34,28 +32,14 @@ environment variables.
 
 ## Testing packages locally
 
-The [tests/release](./tests/release/) folder contains documentation on how the installation of local or staged packages can be tested.
+The [test/release](./test/release/) folder contains documentation on how the installation of local or staged packages can be tested.
 
 
 ## Releasing
 
-In order to release packages required for a release, a utility script
-[`scripts/release-packages.sh`](./scripts/release-packages.sh) is provided.
-This script can be executed as follows:
-
-```bash
-GPG_LOCAL_USER="GPG_USER" \
-MASTER_KEY_PATH=/path/to/gpg-master.key \
-SUB_KEY_PATH=/path/to/gpg-subkey.key \
-    ./scripts/release-packages.sh REPO PACKAGE_REPO_ROOT [REFERENCE]
+A utility script [`scripts/release.sh`](./scripts/release.sh) is provided to build
+packages required for release. If run without arguments, all supported distribution-architecture combinations are built. A specific distribution-architecture pair can also be provided
+```sh
+./scripts/release.sh ubuntu18.04-amd64
 ```
-
-Where `REPO` is one of `stable` or `experimental`, `PACKAGE_REPO_ROOT` is the local path to the `libnvidia-container` repository checked out to the `gh-pages` branch, and `REFERENCE` is the git SHA that is to be released. If reference is not specified `HEAD` is assumed.
-
-This scripts performs the following basic functions:
-* Pulls the package image defined by the `REFERENCE` git SHA from the staging registry,
-* Copies the required packages to the package repository at `PACKAGE_REPO_ROOT/REPO`,
-* Signs the packages using the specified GPG keys
-
-While the last two are performed, commits are added to the package repository. These can be pushed to the relevant repository.
-
+where the `amd64` builds for `ubuntu18.04` are provided as an example.

Jenkinsfile

@@ -0,0 +1,142 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+podTemplate (cloud:'sw-gpu-cloudnative',
+    containers: [
+    containerTemplate(name: 'docker', image: 'docker:dind', ttyEnabled: true, privileged: true),
+    containerTemplate(name: 'golang', image: 'golang:1.16.3', ttyEnabled: true)
+  ]) {
+    node(POD_LABEL) {
+        def scmInfo
+
+        stage('checkout') {
+            scmInfo = checkout(scm)
+        }
+
+        stage('dependencies') {
+            container('golang') {
+                sh 'GO111MODULE=off go get -u github.com/client9/misspell/cmd/misspell'
+                sh 'GO111MODULE=off go get -u github.com/gordonklaus/ineffassign'
+                sh 'GO111MODULE=off go get -u golang.org/x/lint/golint'
+            }
+            container('docker') {
+                sh 'apk add --no-cache make bash git'
+            }
+        }
+        stage('check') {
+            parallel (
+                getGolangStages(["assert-fmt", "lint", "vet", "ineffassign", "misspell"])
+            )
+        }
+        stage('test') {
+            parallel (
+                getGolangStages(["test"])
+            )
+        }
+
+        def versionInfo
+        stage('version') {
+            container('docker') {
+                versionInfo = getVersionInfo(scmInfo)
+                println "versionInfo=${versionInfo}"
+            }
+        }
+
+        def dist = 'ubuntu20.04'
+        def arch = 'amd64'
+        def stageLabel = "${dist}-${arch}"
+
+        stage('build-one') {
+            container('docker') {
+                stage (stageLabel) {
+                    sh "make ${dist}-${arch}"
+                }
+            }
+        }
+
+        stage('release') {
+            container('docker') {
+                stage (stageLabel) {
+
+                    def component = 'main'
+                    def repository = 'sw-gpu-cloudnative-debian-local/pool/main/'
+
+                    def uploadSpec = """{
+                                        "files":
+                                        [  {
+                                                "pattern": "./dist/${dist}/${arch}/*.deb",
+                                                "target": "${repository}",
+                                                "props": "deb.distribution=${dist};deb.component=${component};deb.architecture=${arch}"
+                                            }
+                                        ]
+                                    }"""
+
+                    sh "echo starting release with versionInfo=${versionInfo}"
+                    if (versionInfo.isTag) {
+                        // upload to artifactory repository
+                        def server = Artifactory.server 'sw-gpu-artifactory'
+                        server.upload spec: uploadSpec
+                    } else {
+                        sh "echo skipping release for non-tagged build"
+                    }
+                }
+            }
+        }
+    }
+}
+
+def getGolangStages(def targets) {
+    stages = [:]
+
+    for (t in targets) {
+        stages[t] = getLintClosure(t)
+    }
+
+    return stages
+}
+
+def getLintClosure(def target) {
+    return {
+        container('golang') {
+            stage(target) {
+                sh "make ${target}"
+            }
+        }
+    }
+}
+
+// getVersionInfo returns a hash of version info
+def getVersionInfo(def scmInfo) {
+    def versionInfo = [
+        isTag: isTag(scmInfo.GIT_BRANCH)
+    ]
+
+    scmInfo.each { k, v -> versionInfo[k] = v }
+    return versionInfo
+}
+
+def isTag(def branch) {
+    if (!branch.startsWith('v')) {
+        return false
+    }
+
+    def version = shOutput('git describe --all --exact-match --always')
+    return version == "tags/${branch}"
+}
+
+def shOuptut(def script) {
+    return sh(script: script, returnStdout: true).trim()
+}

Makefile

@@ -38,41 +38,32 @@ EXAMPLE_TARGETS := $(patsubst %,example-%, $(EXAMPLES))
 CMDS := $(patsubst ./cmd/%/,%,$(sort $(dir $(wildcard ./cmd/*/))))
 CMD_TARGETS := $(patsubst %,cmd-%, $(CMDS))
 
-CHECK_TARGETS := lint
-MAKE_TARGETS := binaries build check fmt test examples cmds coverage generate licenses vendor check-vendor $(CHECK_TARGETS)
+$(info CMD_TARGETS=$(CMD_TARGETS))
+
+CHECK_TARGETS := assert-fmt vet lint ineffassign misspell
+MAKE_TARGETS := binaries build check fmt lint-internal test examples cmds coverage generate $(CHECK_TARGETS)
 
 TARGETS := $(MAKE_TARGETS) $(EXAMPLE_TARGETS) $(CMD_TARGETS)
 
 DOCKER_TARGETS := $(patsubst %,docker-%, $(TARGETS))
 .PHONY: $(TARGETS) $(DOCKER_TARGETS)
 
-ifeq ($(VERSION),)
-CLI_VERSION = $(LIB_VERSION)$(if $(LIB_TAG),-$(LIB_TAG))
-else
-CLI_VERSION = $(VERSION)
-endif
-CLI_VERSION_PACKAGE = github.com/NVIDIA/nvidia-container-toolkit/internal/info
+GOOS ?= linux
 
 binaries: cmds
 ifneq ($(PREFIX),)
 cmd-%: COMMAND_BUILD_OPTIONS = -o $(PREFIX)/$(*)
 endif
 cmds: $(CMD_TARGETS)
-
-ifneq ($(shell uname),Darwin)
-EXTLDFLAGS = -Wl,--export-dynamic -Wl,--unresolved-symbols=ignore-in-object-files -Wl,-z,lazy
-else
-EXTLDFLAGS = -Wl,-undefined,dynamic_lookup
-endif
 $(CMD_TARGETS): cmd-%:
-	go build -ldflags "-s -w '-extldflags=$(EXTLDFLAGS)' -X $(CLI_VERSION_PACKAGE).gitCommit=$(GIT_COMMIT) -X $(CLI_VERSION_PACKAGE).version=$(CLI_VERSION)" $(COMMAND_BUILD_OPTIONS) $(MODULE)/cmd/$(*)
+	GOOS=$(GOOS) go build -ldflags "-s -w" $(COMMAND_BUILD_OPTIONS) $(MODULE)/cmd/$(*)
 
 build:
-	go build ./...
+	GOOS=$(GOOS) go build ./...
 
 examples: $(EXAMPLE_TARGETS)
 $(EXAMPLE_TARGETS): example-%:
-	go build ./examples/$(*)
+	GOOS=$(GOOS) go build ./examples/$(*)
 
 all: check test build binary
 check: $(CHECK_TARGETS)
@@ -82,28 +73,38 @@ fmt:
 	go list -f '{{.Dir}}' $(MODULE)/... \
 		| xargs gofmt -s -l -w
 
-# Apply goimports -local github.com/NVIDIA/container-toolkit to the codebase
-goimports:
-	go list -f {{.Dir}} $(MODULE)/... \
-		| xargs goimports -local $(MODULE) -w
+assert-fmt:
+	go list -f '{{.Dir}}' $(MODULE)/... \
+		| xargs gofmt -s -l > fmt.out
+	@if [ -s fmt.out ]; then \
+		echo "\nERROR: The following files are not formatted:\n"; \
+		cat fmt.out; \
+		rm fmt.out; \
+		exit 1; \
+	else \
+		rm fmt.out; \
+	fi
+
+ineffassign:
+	ineffassign $(MODULE)/...
 
 lint:
-	golangci-lint run ./...
+# We use `go list -f '{{.Dir}}' $(MODULE)/...` to skip the `vendor` folder.
+	go list -f '{{.Dir}}' $(MODULE)/... | grep -v /internal/ | xargs golint -set_exit_status
 
-vendor:
-	go mod tidy
-	go mod vendor
-	go mod verify
+lint-internal:
+# We use `go list -f '{{.Dir}}' $(MODULE)/...` to skip the `vendor` folder.
+	go list -f '{{.Dir}}' $(MODULE)/internal/... | xargs golint -set_exit_status
 
-check-vendor: vendor
-	git diff --quiet HEAD -- go.mod go.sum vendor
+misspell:
+	misspell $(MODULE)/...
 
-licenses:
-	go-licenses csv $(MODULE)/...
+vet:
+	go vet $(MODULE)/...
 
 COVERAGE_FILE := coverage.out
 test: build cmds
-	go test -coverprofile=$(COVERAGE_FILE) $(MODULE)/...
+	go test -v -coverprofile=$(COVERAGE_FILE) $(MODULE)/...
 
 coverage: test
 	cat $(COVERAGE_FILE) | grep -v "_mock.go" > $(COVERAGE_FILE).no-mocks
@@ -114,38 +115,30 @@ generate:
 
 # Generate an image for containerized builds
 # Note: This image is local only
-.PHONY: .build-image
-.build-image:
-	make -f deployments/devel/Makefile .build-image
+.PHONY: .build-image .pull-build-image .push-build-image
+.build-image: docker/Dockerfile.devel
+	if [ x"$(SKIP_IMAGE_BUILD)" = x"" ]; then \
+		$(DOCKER) build \
+			--progress=plain \
+			--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
+			--tag $(BUILDIMAGE) \
+			-f $(^) \
+			docker; \
+	fi
 
-ifeq ($(BUILD_DEVEL_IMAGE),yes)
-$(DOCKER_TARGETS): .build-image
-.shell: .build-image
-endif
+.pull-build-image:
+	$(DOCKER) pull $(BUILDIMAGE)
 
-$(DOCKER_TARGETS): docker-%:
-	@echo "Running 'make $(*)' in container image $(BUILDIMAGE)"
+.push-build-image:
+	$(DOCKER) push $(BUILDIMAGE)
+
+$(DOCKER_TARGETS): docker-%: .build-image
+	@echo "Running 'make $(*)' in docker container $(BUILDIMAGE)"
 	$(DOCKER) run \
 		--rm \
-		-e GOCACHE=/tmp/.cache/go \
-		-e GOMODCACHE=/tmp/.cache/gomod \
-		-e GOLANGCI_LINT_CACHE=/tmp/.cache/golangci-lint \
-		-v $(PWD):/work \
-		-w /work \
+		-e GOCACHE=/tmp/.cache \
+		-v $(PWD):$(PWD) \
+		-w $(PWD) \
 		--user $$(id -u):$$(id -g) \
 		$(BUILDIMAGE) \
 			make $(*)
-
-# Start an interactive shell using the development image.
-PHONY: .shell
-.shell:
-	$(DOCKER) run \
-		--rm \
-		-ti \
-		-e GOCACHE=/tmp/.cache/go \
-		-e GOMODCACHE=/tmp/.cache/gomod \
-		-e GOLANGCI_LINT_CACHE=/tmp/.cache/golangci-lint \
-		-v $(PWD):/work \
-		-w /work \
-		--user $$(id -u):$$(id -g) \
-		$(BUILDIMAGE)

README.md

@@ -1,6 +1,6 @@
 # NVIDIA Container Toolkit
 
-[![GitHub license](https://img.shields.io/github/license/NVIDIA/nvidia-container-toolkit?style=flat-square)](https://raw.githubusercontent.com/NVIDIA/nvidia-container-toolkit/main/LICENSE)
+[![GitHub license](https://img.shields.io/github/license/NVIDIA/nvidia-container-toolkit?style=flat-square)](https://raw.githubusercontent.com/NVIDIA/nvidia-container-toolkit/master/LICENSE)
 [![Documentation](https://img.shields.io/badge/documentation-wiki-blue.svg?style=flat-square)](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/overview.html)
 [![Package repository](https://img.shields.io/badge/packages-repository-b956e8.svg?style=flat-square)](https://nvidia.github.io/libnvidia-container)
 

RELEASE.md

@@ -1,36 +0,0 @@
-# Release Process
-
-The NVIDIA Container Toolkit consists of the following artifacts:
-- The NVIDIA Container Toolkit container
-- Packages for debian-based systems
-- Packages for rpm-based systems
-
-# Release Process Checklist:
-- [ ] Create a release PR:
-    - [ ] Run the `./hack/prepare-release.sh` script to update the version in all the needed files. This also creates a [release issue](https://github.com/NVIDIA/cloud-native-team/issues?q=is%3Aissue+is%3Aopen+label%3Arelease)
-    - [ ] Run the `./hack/generate-changelog.sh` script to generate the a draft changelog and update `CHANGELOG.md` with the changes.
-    - [ ] Create a PR from the created `bump-release-{{ .VERSION }}` branch.
-- [ ] Merge the release PR
-- [ ] Tag the release and push the tag to the `internal` mirror:
-    - [ ] Image release pipeline: https://gitlab-master.nvidia.com/dl/container-dev/container-toolkit/-/pipelines/16466098
-- [ ] Wait for the image release to complete.
-- [ ] Push the tag to the the upstream GitHub repo.
-- [ ] Wait for the [`Release`](https://github.com/NVIDIA/k8s-device-plugin/actions/workflows/release.yaml) GitHub Action to complete
-- [ ] Publish the [draft release](https://github.com/NVIDIA/k8s-device-plugin/releases) created by the GitHub Action
-- [ ] Publish the packages to the gh-pages branch of the libnvidia-container repo
-- [ ] Create a KitPick
-
-## Troubleshooting
-
-*Note*: This assumes that we have the release tag checked out locally.
-
-- If the `Release` GitHub Action fails:
-    - Check the logs for the error first.
-    - Create the helm packages locally by running:
-      ```bash
-      ./hack/prepare-artifacts.sh {{ .VERSION }}
-      ```
-    - Create the draft release by running:
-      ```bash
-      ./hack/create-release.sh {{ .VERSION }}
-      ```

build/container/Dockerfile.centos

@@ -12,32 +12,24 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+ARG BASE_DIST
+ARG CUDA_VERSION
 ARG GOLANG_VERSION=x.x.x
 ARG VERSION="N/A"
 
-FROM nvidia/cuda:12.9.0-base-ubi8 as build
+# NOTE: In cases where the libc version is a concern, we would have to use an
+# image based on the target OS to build the golang executables here -- especially
+# if cgo code is included.
+FROM golang:${GOLANG_VERSION} as build
 
-RUN yum install -y \
-    wget make git gcc \
-     && \
-    rm -rf /var/cache/yum/*
+# We override the GOPATH to ensure that the binaries are installed to
+# /artifacts/bin
+ARG GOPATH=/artifacts
 
-ARG GOLANG_VERSION=x.x.x
-RUN set -eux; \
-    \
-    arch="$(uname -m)"; \
-    case "${arch##*-}" in \
-        x86_64 | amd64) ARCH='amd64' ;; \
-        ppc64el | ppc64le) ARCH='ppc64le' ;; \
-        aarch64 | arm64) ARCH='arm64' ;; \
-        *) echo "unsupported architecture" ; exit 1 ;; \
-    esac; \
-    wget -nv -O - https://storage.googleapis.com/golang/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz \
-    | tar -C /usr/local -xz
-
-
-ENV GOPATH /go
-ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH
+# Install the experiemental nvidia-container-runtime
+# NOTE: This will be integrated into the nvidia-container-toolkit package / repo
+ARG NVIDIA_CONTAINER_RUNTIME_EXPERIMENTAL_VERSION=experimental
+RUN GOPATH=/artifacts go install github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-container-runtime.experimental@${NVIDIA_CONTAINER_RUNTIME_EXPERIMENTAL_VERSION}
 
 WORKDIR /build
 COPY . .
@@ -48,10 +40,10 @@ COPY . .
 RUN GOPATH=/artifacts go install -ldflags="-s -w -X 'main.Version=${VERSION}'" ./tools/...
 
 
-FROM nvidia/cuda:12.9.0-base-ubi8
+FROM nvidia/cuda:${CUDA_VERSION}-base-${BASE_DIST}
 
 ENV NVIDIA_DISABLE_REQUIRE="true"
-ENV NVIDIA_VISIBLE_DEVICES=void
+ENV NVIDIA_VISIBLE_DEVICES=all
 ENV NVIDIA_DRIVER_CAPABILITIES=utility
 
 ARG ARTIFACTS_ROOT
@@ -61,13 +53,11 @@ COPY ${ARTIFACTS_ROOT}/${PACKAGE_DIST} /artifacts/packages/${PACKAGE_DIST}
 WORKDIR /artifacts/packages
 
 ARG PACKAGE_VERSION
-ARG TARGETARCH
-ENV PACKAGE_ARCH ${TARGETARCH}
-RUN PACKAGE_ARCH=${PACKAGE_ARCH/amd64/x86_64} && PACKAGE_ARCH=${PACKAGE_ARCH/arm64/aarch64} && \
-    yum localinstall -y \
-    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container1-1.*.rpm \
-    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container-tools-1.*.rpm \
-    ${PACKAGE_DIST}/${PACKAGE_ARCH}/nvidia-container-toolkit*-${PACKAGE_VERSION}*.rpm
+ARG PACKAGE_ARCH
+RUN yum localinstall -y \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container1-${PACKAGE_VERSION}*.rpm \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container-tools-${PACKAGE_VERSION}*.rpm \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/nvidia-container-toolkit-${PACKAGE_VERSION}*.rpm
 
 WORKDIR /work
 
@@ -83,6 +73,13 @@ LABEL release="N/A"
 LABEL summary="Automatically Configure your Container Runtime for GPU support."
 LABEL description="See summary"
 
-RUN mkdir /licenses && mv /NGC-DL-CONTAINER-LICENSE /licenses/NGC-DL-CONTAINER-LICENSE
+COPY ./LICENSE /licenses/LICENSE
+
+# Install / upgrade packages here that are required to resolve CVEs
+ARG CVE_UPDATES
+RUN if [ -n "${CVE_UPDATES}" ]; then \
+        yum update -y ${CVE_UPDATES} && \
+        rm -rf /var/cache/yum/*; \
+    fi
 
 ENTRYPOINT ["/work/nvidia-toolkit"]

build/container/Dockerfile.packaging

@@ -1,5 +1,4 @@
-/**
-# Copyright 2024 NVIDIA CORPORATION
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,24 +11,19 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-**/
 
-package toml
+ARG BASE_DIST
+ARG CUDA_VERSION
+ARG GOLANG_VERSION=x.x.x
+ARG VERSION="N/A"
 
-import (
-	"github.com/pelletier/go-toml"
-)
+FROM nvidia/cuda:${CUDA_VERSION}-base-${BASE_DIST}
 
-type empty string
+ENV NVIDIA_CONTAINER_TOOLKIT_VERSION="${VERSION}"
 
-var _ Loader = (*empty)(nil)
+ARG ARTIFACTS_ROOT
+COPY ${ARTIFACTS_ROOT} /artifacts/packages/
 
-// Load is a no-op for an empty source.
-func (e empty) Load() (*Tree, error) {
-	return newEmpty(), nil
-}
+WORKDIR /artifacts/packages
 
-func newEmpty() *Tree {
-	tomlTree, _ := toml.TreeFromMap(nil)
-	return (*Tree)(tomlTree)
-}
+COPY ./LICENSE /licenses/LICENSE

build/container/Dockerfile.ubuntu

@@ -12,31 +12,24 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+ARG BASE_DIST
+ARG CUDA_VERSION
 ARG GOLANG_VERSION=x.x.x
 ARG VERSION="N/A"
 
-FROM nvidia/cuda:12.9.0-base-ubuntu20.04 as build
+# NOTE: In cases where the libc version is a concern, we would have to use an
+# image based on the target OS to build the golang executables here -- especially
+# if cgo code is included.
+FROM golang:${GOLANG_VERSION} as build
 
-RUN apt-get update && \
-    apt-get install -y wget make git gcc \
-    && \
-    rm -rf /var/lib/apt/lists/*
+# We override the GOPATH to ensure that the binaries are installed to
+# /artifacts/bin
+ARG GOPATH=/artifacts
 
-ARG GOLANG_VERSION=x.x.x
-RUN set -eux; \
-    \
-    arch="$(uname -m)"; \
-    case "${arch##*-}" in \
-        x86_64 | amd64) ARCH='amd64' ;; \
-        ppc64el | ppc64le) ARCH='ppc64le' ;; \
-        aarch64 | arm64) ARCH='arm64' ;; \
-        *) echo "unsupported architecture" ; exit 1 ;; \
-    esac; \
-    wget -nv -O - https://storage.googleapis.com/golang/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz \
-    | tar -C /usr/local -xz
-
-ENV GOPATH /go
-ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH
+# Install the experiemental nvidia-container-runtime
+# NOTE: This will be integrated into the nvidia-container-toolkit package / repo
+ARG NVIDIA_CONTAINER_RUNTIME_EXPERIMENTAL_VERSION=experimental
+RUN GOPATH=/artifacts go install github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-container-runtime.experimental@${NVIDIA_CONTAINER_RUNTIME_EXPERIMENTAL_VERSION}
 
 WORKDIR /build
 COPY . .
@@ -47,20 +40,16 @@ COPY . .
 RUN GOPATH=/artifacts go install -ldflags="-s -w -X 'main.Version=${VERSION}'" ./tools/...
 
 
-FROM nvcr.io/nvidia/cuda:12.9.0-base-ubuntu20.04
-
-# Remove the CUDA repository configurations to avoid issues with rotated GPG keys
-RUN rm -f /etc/apt/sources.list.d/cuda.list
+FROM nvidia/cuda:${CUDA_VERSION}-base-${BASE_DIST}
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libcap2 \
-    curl \
         && \
     rm -rf /var/lib/apt/lists/*
 
 ENV NVIDIA_DISABLE_REQUIRE="true"
-ENV NVIDIA_VISIBLE_DEVICES=void
+ENV NVIDIA_VISIBLE_DEVICES=all
 ENV NVIDIA_DRIVER_CAPABILITIES=utility
 
 ARG ARTIFACTS_ROOT
@@ -70,13 +59,11 @@ COPY ${ARTIFACTS_ROOT}/${PACKAGE_DIST} /artifacts/packages/${PACKAGE_DIST}
 WORKDIR /artifacts/packages
 
 ARG PACKAGE_VERSION
-ARG TARGETARCH
-ENV PACKAGE_ARCH ${TARGETARCH}
-
+ARG PACKAGE_ARCH
 RUN dpkg -i \
-    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container1_1.*.deb \
-    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container-tools_1.*.deb \
-    ${PACKAGE_DIST}/${PACKAGE_ARCH}/nvidia-container-toolkit*_${PACKAGE_VERSION}*.deb
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container1_${PACKAGE_VERSION}*.deb \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container-tools_${PACKAGE_VERSION}*.deb \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/nvidia-container-toolkit_${PACKAGE_VERSION}*.deb
 
 WORKDIR /work
 
@@ -92,6 +79,6 @@ LABEL release="N/A"
 LABEL summary="Automatically Configure your Container Runtime for GPU support."
 LABEL description="See summary"
 
-RUN mkdir /licenses && mv /NGC-DL-CONTAINER-LICENSE /licenses/NGC-DL-CONTAINER-LICENSE
+COPY ./LICENSE /licenses/LICENSE
 
 ENTRYPOINT ["/work/nvidia-toolkit"]

build/container/Makefile

@@ -0,0 +1,136 @@
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+DOCKER   ?= docker
+MKDIR    ?= mkdir
+DIST_DIR ?= $(CURDIR)/dist
+
+##### Global variables #####
+include $(CURDIR)/versions.mk
+
+ifeq ($(IMAGE_NAME),)
+REGISTRY ?= nvidia
+IMAGE_NAME := $(REGISTRY)/container-toolkit
+endif
+
+VERSION ?= $(LIB_VERSION)$(if $(LIB_TAG),-$(LIB_TAG))
+
+IMAGE_TAG ?= $(VERSION)-$(DIST)
+IMAGE = $(IMAGE_NAME):$(IMAGE_TAG)
+
+##### Public rules #####
+DEFAULT_PUSH_TARGET := ubuntu18.04
+TARGETS := ubuntu20.04 ubuntu18.04 ubi8 centos7 centos8
+
+META_TARGETS := packaging
+
+BUILD_TARGETS := $(patsubst %,build-%,$(TARGETS) $(META_TARGETS))
+PUSH_TARGETS := $(patsubst %,push-%,$(TARGETS) $(META_TARGETS))
+TEST_TARGETS := $(patsubst %,test-%, $(TARGETS))
+
+.PHONY: $(TARGETS) $(PUSH_TARGETS) $(BUILD_TARGETS) $(TEST_TARGETS)
+
+push-%: DIST = $(*)
+$(PUSH_TARGETS): push-%:
+	$(DOCKER) push "$(IMAGE_NAME):$(IMAGE_TAG)"
+
+# For the default push target we also push a short tag equal to the version.
+# We skip this for the development release
+DEVEL_RELEASE_IMAGE_VERSION ?= devel
+ifneq ($(strip $(VERSION)),$(DEVEL_RELEASE_IMAGE_VERSION))
+push-$(DEFAULT_PUSH_TARGET): push-short
+endif
+push-short:
+	$(DOCKER) tag "$(IMAGE_NAME):$(VERSION)-$(DEFAULT_PUSH_TARGET)" "$(IMAGE_NAME):$(VERSION)"
+	$(DOCKER) push "$(IMAGE_NAME):$(VERSION)"
+
+
+build-%: DIST = $(*)
+build-%: DOCKERFILE = $(CURDIR)/build/container/Dockerfile.$(DOCKERFILE_SUFFIX)
+
+ARTIFACTS_ROOT ?= $(shell realpath --relative-to=$(CURDIR) $(DIST_DIR))
+
+# Use a generic build target to build the relevant images
+$(BUILD_TARGETS): build-%: $(ARTIFACTS_ROOT)
+	DOCKER_BUILDKIT=1 \
+		$(DOCKER) build --pull \
+		--platform=linux/amd64 \
+		--tag $(IMAGE) \
+		--build-arg ARTIFACTS_ROOT="$(ARTIFACTS_ROOT)" \
+		--build-arg BASE_DIST="$(BASE_DIST)" \
+		--build-arg CUDA_VERSION="$(CUDA_VERSION)" \
+		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
+		--build-arg PACKAGE_DIST="$(PACKAGE_DIST)" \
+		--build-arg PACKAGE_VERSION="$(PACKAGE_VERSION)" \
+		--build-arg PACKAGE_ARCH="$(PACKAGE_ARCH)" \
+		--build-arg VERSION="$(VERSION)" \
+		--build-arg CVE_UPDATES="$(CVE_UPDATES)" \
+		-f $(DOCKERFILE) \
+		$(CURDIR)
+
+
+build-ubuntu%: BASE_DIST = $(*)
+build-ubuntu%: DOCKERFILE_SUFFIX := ubuntu
+build-ubuntu%: PACKAGE_ARCH := amd64
+build-ubuntu%: PACKAGE_DIST = $(BASE_DIST)
+build-ubuntu%: PACKAGE_VERSION := $(LIB_VERSION)$(if $(LIB_TAG),~$(LIB_TAG))
+
+# TODO: Update this to use the centos8 packages
+build-ubi8: BASE_DIST := ubi8
+build-ubi8: DOCKERFILE_SUFFIX := centos
+build-ubi8: PACKAGE_ARCH := x86_64
+build-ubi8: PACKAGE_DIST = centos7
+build-ubi8: PACKAGE_VERSION := $(LIB_VERSION)-$(if $(LIB_TAG),0.1.$(LIB_TAG),1)
+
+build-centos%: BASE_DIST = $(*)
+build-centos%: DOCKERFILE_SUFFIX := centos
+build-centos%: PACKAGE_ARCH := x86_64
+build-centos%: PACKAGE_DIST = $(BASE_DIST)
+build-centos%: PACKAGE_VERSION := $(LIB_VERSION)-$(if $(LIB_TAG),0.1.$(LIB_TAG),1)
+
+build-packaging: BASE_DIST := ubuntu20.04
+build-packaging: DOCKERFILE_SUFFIX := packaging
+build-packaging: PACKAGE_ARCH := amd64
+build-packaging: PACKAGE_DIST = all
+build-packaging: PACKAGE_VERSION := $(LIB_VERSION)$(if $(LIB_TAG),-$(LIB_TAG))
+
+# Test targets
+test-%: DIST = $(*)
+
+TEST_CASES ?= toolkit docker crio containerd
+$(TEST_TARGETS): test-%:
+	TEST_CASES="$(TEST_CASES)" bash -x $(CURDIR)/test/container/main.sh run \
+		$(CURDIR)/shared-$(*) \
+		$(IMAGE) \
+			--no-cleanup-on-error
+
+.PHONY: test-packaging
+test-packaging: DIST = packaging
+test-packaging:
+	@echo "Testing package image contents"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/amazonlinux2/aarch64" || echo "Missing amazonlinux2/aarch64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/amazonlinux2/x86_64" || echo "Missing amazonlinux2/x86_64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/centos7/ppc64le" || echo "Missing centos7/ppc64le"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/centos7/x86_64" || echo "Missing centos7/x86_64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/centos8/aarch64" || echo "Missing centos8/aarch64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/centos8/ppc64le" || echo "Missing centos8/ppc64le"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/centos8/x86_64" || echo "Missing centos8/x86_64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/debian10/amd64" || echo "Missing debian10/amd64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/debian9/amd64" || echo "Missing debian9/amd64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/opensuse-leap15.1/x86_64" || echo "Missing opensuse-leap15.1/x86_64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/ubuntu16.04/amd64" || echo "Missing ubuntu16.04/amd64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/ubuntu16.04/ppc64le" || echo "Missing ubuntu16.04/ppc64le"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/ubuntu18.04/amd64" || echo "Missing ubuntu18.04/amd64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/ubuntu18.04/arm64" || echo "Missing ubuntu18.04/arm64"
+	@$(DOCKER) run --rm $(IMAGE) test -d "/artifacts/packages/ubuntu18.04/ppc64le" || echo "Missing ubuntu18.04/ppc64le"

cmd/nvidia-cdi-hook/README.md

@@ -1,31 +0,0 @@
-# NVIDIA CDI Hook
-
-The CLI `nvidia-cdi-hook` provides container device runtime hook capabilities when
-called by a container runtime, as specific in a
-[Container Device Interface](https://tags.cncf.io/container-device-interface/blob/main/SPEC.md)
-file.
-
-## Generating a CDI
-
-The CDI itself is created for an NVIDIA-capable device using the
-[`nvidia-ctk cdi generate`](../nvidia-ctk/) command.
-
-When `nvidia-ctk cdi generate` is run, the CDI specification is generated as a yaml file.
-The CDI specification provides instructions for a container runtime to set up devices, files and
-other resources for the container prior to starting it. Those instructions
-may include executing command-line tools to prepare the filesystem. The execution
-of such command-line tools is called a hook.
-
-`nvidia-cdi-hook` is the CLI tool that is expected to be called by the container runtime,
-when specified by the CDI file.
-
-See the [`nvidia-ctk` documentation](../nvidia-ctk/README.md) for more information
-on generating a CDI file.
-
-## Functionality
-
-The `nvidia-cdi-hook` CLI provides the following functionality:
-
-* `chmod` - Change the permissions of a file or directory inside the directory path to be mounted into a container.
-* `create-symlinks` - Create symlinks inside the directory path to be mounted into a container.
-* `update-ldcache` - Update the dynamic linker cache inside the directory path to be mounted into a container.

cmd/nvidia-cdi-hook/chmod/chmod.go

@@ -1,160 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package chmod
-
-import (
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type config struct {
-	paths         cli.StringSlice
-	modeStr       string
-	mode          fs.FileMode
-	containerSpec string
-}
-
-// NewCommand constructs a chmod command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build the chmod command
-func (m command) build() *cli.Command {
-	cfg := config{}
-
-	// Create the 'chmod' command
-	c := cli.Command{
-		Name:  "chmod",
-		Usage: "Set the permissions of folders in the container by running chmod. The container root is prefixed to the specified paths.",
-		Before: func(c *cli.Context) error {
-			return validateFlags(c, &cfg)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringSliceFlag{
-			Name:        "path",
-			Usage:       "Specify a path to apply the specified mode to",
-			Destination: &cfg.paths,
-		},
-		&cli.StringFlag{
-			Name:        "mode",
-			Usage:       "Specify the file mode",
-			Destination: &cfg.modeStr,
-		},
-		&cli.StringFlag{
-			Name:        "container-spec",
-			Usage:       "Specify the path to the OCI container spec. If empty or '-' the spec will be read from STDIN",
-			Destination: &cfg.containerSpec,
-		},
-	}
-
-	return &c
-}
-
-func validateFlags(c *cli.Context, cfg *config) error {
-	if strings.TrimSpace(cfg.modeStr) == "" {
-		return fmt.Errorf("a non-empty mode must be specified")
-	}
-
-	modeInt, err := strconv.ParseUint(cfg.modeStr, 8, 32)
-	if err != nil {
-		return fmt.Errorf("failed to parse mode as octal: %v", err)
-	}
-	cfg.mode = fs.FileMode(modeInt)
-
-	for _, p := range cfg.paths.Value() {
-		if strings.TrimSpace(p) == "" {
-			return fmt.Errorf("paths must not be empty")
-		}
-	}
-
-	return nil
-}
-
-func (m command) run(c *cli.Context, cfg *config) error {
-	s, err := oci.LoadContainerState(cfg.containerSpec)
-	if err != nil {
-		return fmt.Errorf("failed to load container state: %v", err)
-	}
-
-	containerRoot, err := s.GetContainerRoot()
-	if err != nil {
-		return fmt.Errorf("failed to determined container root: %v", err)
-	}
-	if containerRoot == "" {
-		return fmt.Errorf("empty container root detected")
-	}
-
-	paths := m.getPaths(containerRoot, cfg.paths.Value(), cfg.mode)
-	if len(paths) == 0 {
-		m.logger.Debugf("No paths specified; exiting")
-		return nil
-	}
-
-	for _, path := range paths {
-		err = os.Chmod(path, cfg.mode)
-		// in some cases this is not an issue (e.g. whole /dev mounted), see #143
-		if errors.Is(err, fs.ErrPermission) {
-			m.logger.Debugf("Ignoring permission error with chmod: %v", err)
-			err = nil
-		}
-	}
-
-	return err
-}
-
-// getPaths updates the specified paths relative to the root.
-func (m command) getPaths(root string, paths []string, desiredMode fs.FileMode) []string {
-	var pathsInRoot []string
-	for _, f := range paths {
-		path := filepath.Join(root, f)
-		stat, err := os.Stat(path)
-		if err != nil {
-			m.logger.Debugf("Skipping path %q: %v", path, err)
-			continue
-		}
-		if (stat.Mode()&(fs.ModePerm|fs.ModeSetuid|fs.ModeSetgid|fs.ModeSticky))^desiredMode == 0 {
-			m.logger.Debugf("Skipping path %q: already desired mode", path)
-			continue
-		}
-		pathsInRoot = append(pathsInRoot, path)
-	}
-
-	return pathsInRoot
-}

cmd/nvidia-cdi-hook/commands/commands.go

@@ -1,38 +0,0 @@
-/**
-# Copyright 2024 NVIDIA CORPORATION
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package commands
-
-import (
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/chmod"
-	symlinks "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/create-symlinks"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/cudacompat"
-	ldcache "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/update-ldcache"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-// New creates the commands associated with supported CDI hooks.
-// These are shared by the nvidia-cdi-hook and nvidia-ctk hook commands.
-func New(logger logger.Interface) []*cli.Command {
-	return []*cli.Command{
-		ldcache.NewCommand(logger),
-		symlinks.NewCommand(logger),
-		chmod.NewCommand(logger),
-		cudacompat.NewCommand(logger),
-	}
-}

cmd/nvidia-cdi-hook/create-symlinks/create-symlinks.go

@@ -1,172 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package symlinks
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/moby/sys/symlink"
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup/symlinks"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type config struct {
-	links         cli.StringSlice
-	containerSpec string
-}
-
-// NewCommand constructs a hook command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build creates the create-symlink command.
-func (m command) build() *cli.Command {
-	cfg := config{}
-
-	c := cli.Command{
-		Name:  "create-symlinks",
-		Usage: "A hook to create symlinks in the container.",
-		Action: func(c *cli.Context) error {
-			return m.run(c, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringSliceFlag{
-			Name:        "link",
-			Usage:       "Specify a specific link to create. The link is specified as target::link. If the link exists in the container root, it is removed.",
-			Destination: &cfg.links,
-		},
-		// The following flags are testing-only flags.
-		&cli.StringFlag{
-			Name:        "container-spec",
-			Usage:       "Specify the path to the OCI container spec. If empty or '-' the spec will be read from STDIN. This is only intended for testing.",
-			Destination: &cfg.containerSpec,
-			Hidden:      true,
-		},
-	}
-
-	return &c
-}
-
-func (m command) run(c *cli.Context, cfg *config) error {
-	s, err := oci.LoadContainerState(cfg.containerSpec)
-	if err != nil {
-		return fmt.Errorf("failed to load container state: %v", err)
-	}
-
-	containerRoot, err := s.GetContainerRoot()
-	if err != nil {
-		return fmt.Errorf("failed to determined container root: %v", err)
-	}
-
-	created := make(map[string]bool)
-	for _, l := range cfg.links.Value() {
-		if created[l] {
-			m.logger.Debugf("Link %v already processed", l)
-			continue
-		}
-		parts := strings.Split(l, "::")
-		if len(parts) != 2 {
-			return fmt.Errorf("invalid symlink specification %v", l)
-		}
-
-		err := m.createLink(containerRoot, parts[0], parts[1])
-		if err != nil {
-			return fmt.Errorf("failed to create link %v: %w", parts, err)
-		}
-		created[l] = true
-	}
-	return nil
-}
-
-// createLink creates a symbolic link in the specified container root.
-// This is equivalent to:
-//
-//	chroot {{ .containerRoot }} ln -f -s {{ .target }} {{ .link }}
-//
-// If the specified link already exists and points to the same target, this
-// operation is a no-op.
-// If a file exists at the link path or the link points to a different target
-// this file is removed before creating the link.
-//
-// Note that if the link path resolves to an absolute path oudside of the
-// specified root, this is treated as an absolute path in this root.
-func (m command) createLink(containerRoot string, targetPath string, link string) error {
-	linkPath := filepath.Join(containerRoot, link)
-
-	exists, err := linkExists(targetPath, linkPath)
-	if err != nil {
-		return fmt.Errorf("failed to check if link exists: %w", err)
-	}
-	if exists {
-		m.logger.Debugf("Link %s already exists", linkPath)
-		return nil
-	}
-
-	// We resolve the parent of the symlink that we're creating in the container root.
-	// If we resolve the full link path, an existing link at the location itself
-	// is also resolved here and we are unable to force create the link.
-	resolvedLinkParent, err := symlink.FollowSymlinkInScope(filepath.Dir(linkPath), containerRoot)
-	if err != nil {
-		return fmt.Errorf("failed to follow path for link %v relative to %v: %w", link, containerRoot, err)
-	}
-	resolvedLinkPath := filepath.Join(resolvedLinkParent, filepath.Base(linkPath))
-
-	m.logger.Infof("Symlinking %v to %v", resolvedLinkPath, targetPath)
-	err = os.MkdirAll(filepath.Dir(resolvedLinkPath), 0755)
-	if err != nil {
-		return fmt.Errorf("failed to create directory: %v", err)
-	}
-	err = symlinks.ForceCreate(targetPath, resolvedLinkPath)
-	if err != nil {
-		return fmt.Errorf("failed to create symlink: %v", err)
-	}
-
-	return nil
-}
-
-// linkExists checks whether the specified link exists.
-// A link exists if the path exists, is a symlink, and points to the specified target.
-func linkExists(target string, link string) (bool, error) {
-	currentTarget, err := symlinks.Resolve(link)
-	if errors.Is(err, os.ErrNotExist) {
-		return false, nil
-	}
-	if err != nil {
-		return false, fmt.Errorf("failed to resolve existing symlink %s: %w", link, err)
-	}
-	if currentTarget == target {
-		return true, nil
-	}
-	return false, nil
-}

cmd/nvidia-cdi-hook/create-symlinks/create-symlinks_test.go

@@ -1,297 +0,0 @@
-package symlinks
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	testlog "github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/require"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup/symlinks"
-)
-
-func TestLinkExist(t *testing.T) {
-	tmpDir := t.TempDir()
-	require.NoError(
-		t,
-		makeFs(tmpDir,
-			dirOrLink{path: "/a/b/c", target: "d"},
-			dirOrLink{path: "/a/b/e", target: "/a/b/f"},
-		),
-	)
-
-	exists, err := linkExists("d", filepath.Join(tmpDir, "/a/b/c"))
-	require.NoError(t, err)
-	require.True(t, exists)
-
-	exists, err = linkExists("/a/b/f", filepath.Join(tmpDir, "/a/b/e"))
-	require.NoError(t, err)
-	require.True(t, exists)
-
-	exists, err = linkExists("different-target", filepath.Join(tmpDir, "/a/b/c"))
-	require.NoError(t, err)
-	require.False(t, exists)
-
-	exists, err = linkExists("/a/b/d", filepath.Join(tmpDir, "/a/b/c"))
-	require.NoError(t, err)
-	require.False(t, exists)
-
-	exists, err = linkExists("foo", filepath.Join(tmpDir, "/a/b/does-not-exist"))
-	require.NoError(t, err)
-	require.False(t, exists)
-}
-
-func TestCreateLink(t *testing.T) {
-	type link struct {
-		path   string
-		target string
-	}
-	type expectedLink struct {
-		link
-		err error
-	}
-
-	testCases := []struct {
-		description         string
-		containerContents   []dirOrLink
-		link                link
-		expectedCreateError error
-		expectedLinks       []expectedLink
-	}{
-		{
-			description: "link to / resolves to container root",
-			containerContents: []dirOrLink{
-				{path: "/lib/foo", target: "/"},
-			},
-			link: link{
-				path:   "/lib/foo/libfoo.so",
-				target: "libfoo.so.1",
-			},
-			expectedLinks: []expectedLink{
-				{
-					link: link{
-						path:   "{{ .containerRoot }}/libfoo.so",
-						target: "libfoo.so.1",
-					},
-				},
-			},
-		},
-		{
-			description: "link to / resolves to container root; parent relative link",
-			containerContents: []dirOrLink{
-				{path: "/lib/foo", target: "/"},
-			},
-			link: link{
-				path:   "/lib/foo/libfoo.so",
-				target: "../libfoo.so.1",
-			},
-			expectedLinks: []expectedLink{
-				{
-					link: link{
-						path:   "{{ .containerRoot }}/libfoo.so",
-						target: "../libfoo.so.1",
-					},
-				},
-			},
-		},
-		{
-			description: "link to / resolves to container root; absolute link",
-			containerContents: []dirOrLink{
-				{path: "/lib/foo", target: "/"},
-			},
-			link: link{
-				path:   "/lib/foo/libfoo.so",
-				target: "/a-path-in-container/foo/libfoo.so.1",
-			},
-			expectedLinks: []expectedLink{
-				{
-					link: link{
-						path:   "{{ .containerRoot }}/libfoo.so",
-						target: "/a-path-in-container/foo/libfoo.so.1",
-					},
-				},
-				{
-					// We also check that the target is NOT created.
-					link: link{
-						path: "{{ .containerRoot }}/a-path-in-container/foo/libfoo.so.1",
-					},
-					err: os.ErrNotExist,
-				},
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			tmpDir := t.TempDir()
-			hostRoot := filepath.Join(tmpDir, "/host-root/")
-			containerRoot := filepath.Join(tmpDir, "/container-root")
-
-			require.NoError(t, makeFs(hostRoot))
-			require.NoError(t, makeFs(containerRoot, tc.containerContents...))
-
-			// nvidia-cdi-hook create-symlinks --link linkSpec
-			err := getTestCommand().createLink(containerRoot, tc.link.target, tc.link.path)
-			// TODO: We may be able to replace this with require.ErrorIs.
-			if tc.expectedCreateError != nil {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
-
-			for _, expectedLink := range tc.expectedLinks {
-				path := strings.ReplaceAll(expectedLink.path, "{{ .containerRoot }}", containerRoot)
-				path = strings.ReplaceAll(path, "{{ .hostRoot }}", hostRoot)
-				if expectedLink.target != "" {
-					target, err := symlinks.Resolve(path)
-					require.ErrorIs(t, err, expectedLink.err)
-					require.Equal(t, expectedLink.target, target)
-				} else {
-					_, err := os.Stat(path)
-					require.ErrorIs(t, err, expectedLink.err)
-				}
-			}
-		})
-	}
-}
-
-func TestCreateLinkRelativePath(t *testing.T) {
-	tmpDir := t.TempDir()
-	hostRoot := filepath.Join(tmpDir, "/host-root/")
-	containerRoot := filepath.Join(tmpDir, "/container-root")
-
-	require.NoError(t, makeFs(hostRoot))
-	require.NoError(t, makeFs(containerRoot, dirOrLink{path: "/lib/"}))
-
-	// nvidia-cdi-hook create-symlinks --link libfoo.so.1::/lib/libfoo.so
-	err := getTestCommand().createLink(containerRoot, "libfoo.so.1", "/lib/libfoo.so")
-	require.NoError(t, err)
-
-	target, err := symlinks.Resolve(filepath.Join(containerRoot, "/lib/libfoo.so"))
-	require.NoError(t, err)
-	require.Equal(t, "libfoo.so.1", target)
-}
-
-func TestCreateLinkAbsolutePath(t *testing.T) {
-	tmpDir := t.TempDir()
-	hostRoot := filepath.Join(tmpDir, "/host-root/")
-	containerRoot := filepath.Join(tmpDir, "/container-root")
-
-	require.NoError(t, makeFs(hostRoot))
-	require.NoError(t, makeFs(containerRoot, dirOrLink{path: "/lib/"}))
-
-	// nvidia-cdi-hook create-symlinks --link /lib/libfoo.so.1::/lib/libfoo.so
-	err := getTestCommand().createLink(containerRoot, "/lib/libfoo.so.1", "/lib/libfoo.so")
-	require.NoError(t, err)
-
-	target, err := symlinks.Resolve(filepath.Join(containerRoot, "/lib/libfoo.so"))
-	require.NoError(t, err)
-	require.Equal(t, "/lib/libfoo.so.1", target)
-}
-
-func TestCreateLinkAlreadyExists(t *testing.T) {
-	testCases := []struct {
-		description       string
-		containerContents []dirOrLink
-		shouldExist       []string
-	}{
-		{
-			description:       "link already exists with correct target",
-			containerContents: []dirOrLink{{path: "/lib/libfoo.so", target: "libfoo.so.1"}},
-			shouldExist:       []string{},
-		},
-		{
-			description:       "link already exists with different target",
-			containerContents: []dirOrLink{{path: "/lib/libfoo.so", target: "different-target"}, {path: "different-target"}},
-			shouldExist:       []string{"{{ .containerRoot }}/different-target"},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			tmpDir := t.TempDir()
-			hostRoot := filepath.Join(tmpDir, "/host-root/")
-			containerRoot := filepath.Join(tmpDir, "/container-root")
-			require.NoError(t, makeFs(hostRoot))
-			require.NoError(t, makeFs(containerRoot, tc.containerContents...))
-
-			// nvidia-cdi-hook create-symlinks --link libfoo.so.1::/lib/libfoo.so
-			err := getTestCommand().createLink(containerRoot, "libfoo.so.1", "/lib/libfoo.so")
-			require.NoError(t, err)
-			target, err := symlinks.Resolve(filepath.Join(containerRoot, "lib/libfoo.so"))
-			require.NoError(t, err)
-			require.Equal(t, "libfoo.so.1", target)
-
-			for _, p := range tc.shouldExist {
-				require.DirExists(t, strings.ReplaceAll(p, "{{ .containerRoot }}", containerRoot))
-			}
-		})
-	}
-}
-
-func TestCreateLinkOutOfBounds(t *testing.T) {
-	tmpDir := t.TempDir()
-	hostRoot := filepath.Join(tmpDir, "/host-root")
-	containerRoot := filepath.Join(tmpDir, "/container-root")
-
-	require.NoError(t,
-		makeFs(hostRoot,
-			dirOrLink{path: "libfoo.so"},
-		),
-	)
-	require.NoError(t,
-		makeFs(containerRoot,
-			dirOrLink{path: "/lib"},
-			dirOrLink{path: "/lib/foo", target: hostRoot},
-		),
-	)
-
-	path, err := symlinks.Resolve(filepath.Join(containerRoot, "/lib/foo"))
-	require.NoError(t, err)
-	require.Equal(t, hostRoot, path)
-
-	// nvidia-cdi-hook create-symlinks --link ../libfoo.so.1::/lib/foo/libfoo.so
-	_ = getTestCommand().createLink(containerRoot, "../libfoo.so.1", "/lib/foo/libfoo.so")
-	require.NoError(t, err)
-
-	target, err := symlinks.Resolve(filepath.Join(containerRoot, hostRoot, "libfoo.so"))
-	require.NoError(t, err)
-	require.Equal(t, "../libfoo.so.1", target)
-
-	require.DirExists(t, filepath.Join(hostRoot, "libfoo.so"))
-}
-
-type dirOrLink struct {
-	path   string
-	target string
-}
-
-func makeFs(tmpdir string, fs ...dirOrLink) error {
-	if err := os.MkdirAll(tmpdir, 0o755); err != nil {
-		return err
-	}
-	for _, s := range fs {
-		s.path = filepath.Join(tmpdir, s.path)
-		if s.target == "" {
-			_ = os.MkdirAll(s.path, 0o755)
-			continue
-		}
-		if err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {
-			return err
-		}
-		if err := os.Symlink(s.target, s.path); err != nil && !os.IsExist(err) {
-			return err
-		}
-	}
-	return nil
-}
-
-// getTestCommand creates a command for running tests against.
-func getTestCommand() *command {
-	logger, _ := testlog.NewNullLogger()
-	return &command{
-		logger: logger,
-	}
-}

cmd/nvidia-cdi-hook/cudacompat/container-root.go

@@ -1,76 +0,0 @@
-/**
-# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package cudacompat
-
-import (
-	"os"
-	"path/filepath"
-
-	"github.com/moby/sys/symlink"
-)
-
-// A containerRoot represents the root filesystem of a container.
-type containerRoot string
-
-// hasPath checks whether the specified path exists in the root.
-func (r containerRoot) hasPath(path string) bool {
-	resolved, err := r.resolve(path)
-	if err != nil {
-		return false
-	}
-	if _, err := os.Stat(resolved); err != nil && os.IsNotExist(err) {
-		return false
-	}
-	return true
-}
-
-// globFiles matches the specified pattern in the root.
-// The files that match must be regular files.
-func (r containerRoot) globFiles(pattern string) ([]string, error) {
-	patternPath, err := r.resolve(pattern)
-	if err != nil {
-		return nil, err
-	}
-	matches, err := filepath.Glob(patternPath)
-	if err != nil {
-		return nil, err
-	}
-	var files []string
-	for _, match := range matches {
-		info, err := os.Lstat(match)
-		if err != nil {
-			return nil, err
-		}
-		// Ignore symlinks.
-		if info.Mode()&os.ModeSymlink != 0 {
-			continue
-		}
-		// Ignore directories.
-		if info.IsDir() {
-			continue
-		}
-		files = append(files, match)
-	}
-	return files, nil
-}
-
-// resolve returns the absolute path including root path.
-// Symlinks are resolved, but are guaranteed to resolve in the root.
-func (r containerRoot) resolve(path string) (string, error) {
-	absolute := filepath.Clean(filepath.Join(string(r), path))
-	return symlink.FollowSymlinkInScope(absolute, string(r))
-}

cmd/nvidia-cdi-hook/cudacompat/cudacompat.go

@@ -1,221 +0,0 @@
-/**
-# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package cudacompat
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
-)
-
-const (
-	cudaCompatPath = "/usr/local/cuda/compat"
-	// cudaCompatLdsoconfdFilenamePattern specifies the pattern for the filename
-	// in ld.so.conf.d that includes a reference to the CUDA compat path.
-	// The 00-compat prefix is chosen to ensure that these libraries have a
-	// higher precedence than other libraries on the system.
-	cudaCompatLdsoconfdFilenamePattern = "00-compat-*.conf"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type options struct {
-	hostDriverVersion string
-	containerSpec     string
-}
-
-// NewCommand constructs a cuda-compat command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build the enable-cuda-compat command
-func (m command) build() *cli.Command {
-	cfg := options{}
-
-	// Create the 'enable-cuda-compat' command
-	c := cli.Command{
-		Name:  "enable-cuda-compat",
-		Usage: "This hook ensures that the folder containing the CUDA compat libraries is added to the ldconfig search path if required.",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &cfg)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:        "host-driver-version",
-			Usage:       "Specify the host driver version. If the CUDA compat libraries detected in the container do not have a higher MAJOR version, the hook is a no-op.",
-			Destination: &cfg.hostDriverVersion,
-		},
-		&cli.StringFlag{
-			Name:        "container-spec",
-			Hidden:      true,
-			Category:    "testing-only",
-			Usage:       "Specify the path to the OCI container spec. If empty or '-' the spec will be read from STDIN",
-			Destination: &cfg.containerSpec,
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(_ *cli.Context, cfg *options) error {
-	return nil
-}
-
-func (m command) run(_ *cli.Context, cfg *options) error {
-	if cfg.hostDriverVersion == "" {
-		return nil
-	}
-
-	s, err := oci.LoadContainerState(cfg.containerSpec)
-	if err != nil {
-		return fmt.Errorf("failed to load container state: %w", err)
-	}
-
-	containerRootDir, err := s.GetContainerRoot()
-	if err != nil {
-		return fmt.Errorf("failed to determined container root: %w", err)
-	}
-
-	containerForwardCompatDir, err := m.getContainerForwardCompatDir(containerRoot(containerRootDir), cfg.hostDriverVersion)
-	if err != nil {
-		return fmt.Errorf("failed to get container forward compat directory: %w", err)
-	}
-	if containerForwardCompatDir == "" {
-		return nil
-	}
-
-	return m.createLdsoconfdFile(containerRoot(containerRootDir), cudaCompatLdsoconfdFilenamePattern, containerForwardCompatDir)
-}
-
-func (m command) getContainerForwardCompatDir(containerRoot containerRoot, hostDriverVersion string) (string, error) {
-	if hostDriverVersion == "" {
-		m.logger.Debugf("Host driver version not specified")
-		return "", nil
-	}
-	if !containerRoot.hasPath(cudaCompatPath) {
-		m.logger.Debugf("No CUDA forward compatibility libraries directory in container")
-		return "", nil
-	}
-	if !containerRoot.hasPath("/etc/ld.so.cache") {
-		m.logger.Debugf("The container does not have an LDCache")
-		return "", nil
-	}
-
-	libs, err := containerRoot.globFiles(filepath.Join(cudaCompatPath, "libcuda.so.*.*"))
-	if err != nil {
-		m.logger.Warningf("Failed to find CUDA compat library: %w", err)
-		return "", nil
-	}
-
-	if len(libs) == 0 {
-		m.logger.Debugf("No CUDA forward compatibility libraries container")
-		return "", nil
-	}
-
-	if len(libs) != 1 {
-		m.logger.Warningf("Unexpected number of CUDA compat libraries in container: %v", libs)
-		return "", nil
-	}
-
-	compatDriverVersion := strings.TrimPrefix(filepath.Base(libs[0]), "libcuda.so.")
-	compatMajor, err := extractMajorVersion(compatDriverVersion)
-	if err != nil {
-		return "", fmt.Errorf("failed to extract major version from %q: %v", compatDriverVersion, err)
-	}
-
-	driverMajor, err := extractMajorVersion(hostDriverVersion)
-	if err != nil {
-		return "", fmt.Errorf("failed to extract major version from %q: %v", hostDriverVersion, err)
-	}
-
-	if driverMajor >= compatMajor {
-		m.logger.Debugf("Compat major version is not greater than the host driver major version (%v >= %v)", hostDriverVersion, compatDriverVersion)
-		return "", nil
-	}
-
-	resolvedCompatDir := strings.TrimPrefix(filepath.Dir(libs[0]), string(containerRoot))
-	return resolvedCompatDir, nil
-}
-
-// createLdsoconfdFile creates a file at /etc/ld.so.conf.d/ in the specified root.
-// The file is created at /etc/ld.so.conf.d/{{ .pattern }} using `CreateTemp` and
-// contains the specified directories on each line.
-func (m command) createLdsoconfdFile(in containerRoot, pattern string, dirs ...string) error {
-	if len(dirs) == 0 {
-		m.logger.Debugf("No directories to add to /etc/ld.so.conf")
-		return nil
-	}
-
-	ldsoconfdDir, err := in.resolve("/etc/ld.so.conf.d")
-	if err != nil {
-		return err
-	}
-	if err := os.MkdirAll(ldsoconfdDir, 0755); err != nil {
-		return fmt.Errorf("failed to create ld.so.conf.d: %w", err)
-	}
-
-	configFile, err := os.CreateTemp(ldsoconfdDir, pattern)
-	if err != nil {
-		return fmt.Errorf("failed to create config file: %w", err)
-	}
-	defer configFile.Close()
-
-	m.logger.Debugf("Adding directories %v to %v", dirs, configFile.Name())
-
-	added := make(map[string]bool)
-	for _, dir := range dirs {
-		if added[dir] {
-			continue
-		}
-		_, err = configFile.WriteString(fmt.Sprintf("%s\n", dir))
-		if err != nil {
-			return fmt.Errorf("failed to update config file: %w", err)
-		}
-		added[dir] = true
-	}
-
-	// The created file needs to be world readable for the cases where the container is run as a non-root user.
-	if err := configFile.Chmod(0644); err != nil {
-		return fmt.Errorf("failed to chmod config file: %w", err)
-	}
-
-	return nil
-}
-
-// extractMajorVersion parses a version string and returns the major version as an int.
-func extractMajorVersion(version string) (int, error) {
-	majorString := strings.SplitN(version, ".", 2)[0]
-	return strconv.Atoi(majorString)
-}

cmd/nvidia-cdi-hook/cudacompat/cudacompat_test.go

@@ -1,182 +0,0 @@
-/*
-# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-*/
-
-package cudacompat
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	testlog "github.com/sirupsen/logrus/hooks/test"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCompatLibs(t *testing.T) {
-	logger, _ := testlog.NewNullLogger()
-
-	testCases := []struct {
-		description                       string
-		contents                          map[string]string
-		hostDriverVersion                 string
-		expectedContainerForwardCompatDir string
-	}{
-		{
-			description:       "empty root",
-			hostDriverVersion: "222.55.66",
-		},
-		{
-			description: "compat lib is newer; no ldcache",
-			contents: map[string]string{
-				"/usr/local/cuda/compat/libcuda.so.333.88.99": "",
-			},
-			hostDriverVersion: "222.55.66",
-		},
-		{
-			description: "compat lib is newer; ldcache",
-			contents: map[string]string{
-				"/etc/ld.so.cache": "",
-				"/usr/local/cuda/compat/libcuda.so.333.88.99": "",
-			},
-			hostDriverVersion:                 "222.55.66",
-			expectedContainerForwardCompatDir: "/usr/local/cuda/compat",
-		},
-		{
-			description: "compat lib is older; ldcache",
-			contents: map[string]string{
-				"/etc/ld.so.cache": "",
-				"/usr/local/cuda/compat/libcuda.so.111.88.99": "",
-			},
-			hostDriverVersion:                 "222.55.66",
-			expectedContainerForwardCompatDir: "",
-		},
-		{
-			description: "compat lib has same major version; ldcache",
-			contents: map[string]string{
-				"/etc/ld.so.cache": "",
-				"/usr/local/cuda/compat/libcuda.so.222.88.99": "",
-			},
-			hostDriverVersion:                 "222.55.66",
-			expectedContainerForwardCompatDir: "",
-		},
-		{
-			description: "numeric comparison is used; ldcache",
-			contents: map[string]string{
-				"/etc/ld.so.cache": "",
-				"/usr/local/cuda/compat/libcuda.so.222.88.99": "",
-			},
-			hostDriverVersion:                 "99.55.66",
-			expectedContainerForwardCompatDir: "/usr/local/cuda/compat",
-		},
-		{
-			description: "driver version empty; ldcache",
-			contents: map[string]string{
-				"/etc/ld.so.cache": "",
-				"/usr/local/cuda/compat/libcuda.so.222.88.99": "",
-			},
-			hostDriverVersion: "",
-		},
-		{
-			description: "symlinks are followed",
-			contents: map[string]string{
-				"/etc/ld.so.cache": "",
-				"/etc/alternatives/cuda/compat/libcuda.so.333.88.99": "",
-				"/usr/local/cuda": "symlink=/etc/alternatives/cuda",
-			},
-			hostDriverVersion:                 "222.55.66",
-			expectedContainerForwardCompatDir: "/etc/alternatives/cuda/compat",
-		},
-		{
-			description: "symlinks stay in container",
-			contents: map[string]string{
-				"/etc/ld.so.cache":             "",
-				"/compat/libcuda.so.333.88.99": "",
-				"/usr/local/cuda":              "symlink=../../../../../../",
-			},
-			hostDriverVersion:                 "222.55.66",
-			expectedContainerForwardCompatDir: "/compat",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			containerRootDir := t.TempDir()
-			for name, contents := range tc.contents {
-				target := filepath.Join(containerRootDir, name)
-				require.NoError(t, os.MkdirAll(filepath.Dir(target), 0755))
-
-				if strings.HasPrefix(contents, "symlink=") {
-					require.NoError(t, os.Symlink(strings.TrimPrefix(contents, "symlink="), target))
-					continue
-				}
-
-				require.NoError(t, os.WriteFile(target, []byte(contents), 0600))
-			}
-
-			c := command{
-				logger: logger,
-			}
-			containerForwardCompatDir, err := c.getContainerForwardCompatDir(containerRoot(containerRootDir), tc.hostDriverVersion)
-			require.NoError(t, err)
-			require.EqualValues(t, tc.expectedContainerForwardCompatDir, containerForwardCompatDir)
-		})
-	}
-}
-
-func TestUpdateLdconfig(t *testing.T) {
-	logger, _ := testlog.NewNullLogger()
-	testCases := []struct {
-		description      string
-		folders          []string
-		expectedContents string
-	}{
-		{
-			description: "no folders; have no contents",
-		},
-		{
-			description:      "single folder is added",
-			folders:          []string{"/usr/local/cuda/compat"},
-			expectedContents: "/usr/local/cuda/compat\n",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			containerRootDir := t.TempDir()
-			c := command{
-				logger: logger,
-			}
-			err := c.createLdsoconfdFile(containerRoot(containerRootDir), cudaCompatLdsoconfdFilenamePattern, tc.folders...)
-			require.NoError(t, err)
-
-			matches, err := filepath.Glob(filepath.Join(containerRootDir, "/etc/ld.so.conf.d/00-compat-*.conf"))
-			require.NoError(t, err)
-
-			if tc.expectedContents == "" {
-				require.Empty(t, matches)
-				return
-			}
-
-			require.Len(t, matches, 1)
-			contents, err := os.ReadFile(matches[0])
-			require.NoError(t, err)
-
-			require.EqualValues(t, tc.expectedContents, string(contents))
-		})
-	}
-
-}

cmd/nvidia-cdi-hook/main.go

@@ -1,95 +0,0 @@
-/**
-# Copyright (c) 2024, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package main
-
-import (
-	"os"
-
-	"github.com/sirupsen/logrus"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/info"
-
-	cli "github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/commands"
-)
-
-// options defines the options that can be set for the CLI through config files,
-// environment variables, or command line flags
-type options struct {
-	// Debug indicates whether the CLI is started in "debug" mode
-	Debug bool
-	// Quiet indicates whether the CLI is started in "quiet" mode
-	Quiet bool
-}
-
-func main() {
-	logger := logrus.New()
-
-	// Create a options struct to hold the parsed environment variables or command line flags
-	opts := options{}
-
-	// Create the top-level CLI
-	c := cli.NewApp()
-	c.Name = "NVIDIA CDI Hook"
-	c.UseShortOptionHandling = true
-	c.EnableBashCompletion = true
-	c.Usage = "Command to structure files for usage inside a container, called as hooks from a container runtime, defined in a CDI yaml file"
-	c.Version = info.GetVersionString()
-
-	// Setup the flags for this command
-	c.Flags = []cli.Flag{
-		&cli.BoolFlag{
-			Name:        "debug",
-			Aliases:     []string{"d"},
-			Usage:       "Enable debug-level logging",
-			Destination: &opts.Debug,
-			// TODO: Support for NVIDIA_CDI_DEBUG is deprecated and NVIDIA_CTK_DEBUG should be used instead.
-			EnvVars: []string{"NVIDIA_CTK_DEBUG", "NVIDIA_CDI_DEBUG"},
-		},
-		&cli.BoolFlag{
-			Name:        "quiet",
-			Usage:       "Suppress all output except for errors; overrides --debug",
-			Destination: &opts.Quiet,
-			// TODO: Support for NVIDIA_CDI_QUIET is deprecated and NVIDIA_CTK_QUIET should be used instead.
-			EnvVars: []string{"NVDIA_CTK_QUIET", "NVIDIA_CDI_QUIET"},
-		},
-	}
-
-	// Set log-level for all subcommands
-	c.Before = func(c *cli.Context) error {
-		logLevel := logrus.InfoLevel
-		if opts.Debug {
-			logLevel = logrus.DebugLevel
-		}
-		if opts.Quiet {
-			logLevel = logrus.ErrorLevel
-		}
-		logger.SetLevel(logLevel)
-		return nil
-	}
-
-	// Define the subcommands
-	c.Commands = commands.New(logger)
-
-	// Run the CLI
-	err := c.Run(os.Args)
-	if err != nil {
-		logger.Errorf("%v", err)
-		os.Exit(1)
-	}
-}

cmd/nvidia-cdi-hook/update-ldcache/container-root.go

@@ -1,46 +0,0 @@
-/**
-# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package ldcache
-
-import (
-	"os"
-	"path/filepath"
-
-	"github.com/moby/sys/symlink"
-)
-
-// A containerRoot represents the root filesystem of a container.
-type containerRoot string
-
-// hasPath checks whether the specified path exists in the root.
-func (r containerRoot) hasPath(path string) bool {
-	resolved, err := r.resolve(path)
-	if err != nil {
-		return false
-	}
-	if _, err := os.Stat(resolved); err != nil && os.IsNotExist(err) {
-		return false
-	}
-	return true
-}
-
-// resolve returns the absolute path including root path.
-// Symlinks are resolved, but are guaranteed to resolve in the root.
-func (r containerRoot) resolve(path string) (string, error) {
-	absolute := filepath.Clean(filepath.Join(string(r), path))
-	return symlink.FollowSymlinkInScope(absolute, string(r))
-}

cmd/nvidia-cdi-hook/update-ldcache/ldconfig_linux.go

@@ -1,200 +0,0 @@
-//go:build linux
-
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package ldcache
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"syscall"
-
-	securejoin "github.com/cyphar/filepath-securejoin"
-
-	"github.com/moby/sys/reexec"
-	"github.com/opencontainers/runc/libcontainer/utils"
-	"golang.org/x/sys/unix"
-)
-
-// pivotRoot will call pivot_root such that rootfs becomes the new root
-// filesystem, and everything else is cleaned up.
-// This is adapted from the implementation here:
-//
-//	https://github.com/opencontainers/runc/blob/e89a29929c775025419ab0d218a43588b4c12b9a/libcontainer/rootfs_linux.go#L1056-L1113
-//
-// With the `mount` and `unmount` calls changed to direct unix.Mount and unix.Unmount calls.
-func pivotRoot(rootfs string) error {
-	// While the documentation may claim otherwise, pivot_root(".", ".") is
-	// actually valid. What this results in is / being the new root but
-	// /proc/self/cwd being the old root. Since we can play around with the cwd
-	// with pivot_root this allows us to pivot without creating directories in
-	// the rootfs. Shout-outs to the LXC developers for giving us this idea.
-
-	oldroot, err := unix.Open("/", unix.O_DIRECTORY|unix.O_RDONLY, 0)
-	if err != nil {
-		return &os.PathError{Op: "open", Path: "/", Err: err}
-	}
-	defer unix.Close(oldroot) //nolint: errcheck
-
-	newroot, err := unix.Open(rootfs, unix.O_DIRECTORY|unix.O_RDONLY, 0)
-	if err != nil {
-		return &os.PathError{Op: "open", Path: rootfs, Err: err}
-	}
-	defer unix.Close(newroot) //nolint: errcheck
-
-	// Change to the new root so that the pivot_root actually acts on it.
-	if err := unix.Fchdir(newroot); err != nil {
-		return &os.PathError{Op: "fchdir", Path: "fd " + strconv.Itoa(newroot), Err: err}
-	}
-
-	if err := unix.PivotRoot(".", "."); err != nil {
-		return &os.PathError{Op: "pivot_root", Path: ".", Err: err}
-	}
-
-	// Currently our "." is oldroot (according to the current kernel code).
-	// However, purely for safety, we will fchdir(oldroot) since there isn't
-	// really any guarantee from the kernel what /proc/self/cwd will be after a
-	// pivot_root(2).
-
-	if err := unix.Fchdir(oldroot); err != nil {
-		return &os.PathError{Op: "fchdir", Path: "fd " + strconv.Itoa(oldroot), Err: err}
-	}
-
-	// Make oldroot rslave to make sure our unmounts don't propagate to the
-	// host (and thus bork the machine). We don't use rprivate because this is
-	// known to cause issues due to races where we still have a reference to a
-	// mount while a process in the host namespace are trying to operate on
-	// something they think has no mounts (devicemapper in particular).
-	if err := unix.Mount("", ".", "", unix.MS_SLAVE|unix.MS_REC, ""); err != nil {
-		return err
-	}
-	// Perform the unmount. MNT_DETACH allows us to unmount /proc/self/cwd.
-	if err := unix.Unmount(".", unix.MNT_DETACH); err != nil {
-		return err
-	}
-
-	// Switch back to our shiny new root.
-	if err := unix.Chdir("/"); err != nil {
-		return &os.PathError{Op: "chdir", Path: "/", Err: err}
-	}
-	return nil
-}
-
-// mountLdConfig mounts the host ldconfig to the mount namespace of the hook.
-// We use WithProcfd to perform the mount operations to ensure that the changes
-// are persisted across the pivot root.
-func mountLdConfig(hostLdconfigPath string, containerRootDirPath string) (string, error) {
-	hostLdconfigInfo, err := os.Stat(hostLdconfigPath)
-	if err != nil {
-		return "", fmt.Errorf("error reading host ldconfig: %w", err)
-	}
-
-	hookScratchDirPath := "/var/run/nvidia-ctk-hook"
-	ldconfigPath := filepath.Join(hookScratchDirPath, "ldconfig")
-	if err := utils.MkdirAllInRoot(containerRootDirPath, hookScratchDirPath, 0755); err != nil {
-		return "", fmt.Errorf("error creating hook scratch folder: %w", err)
-	}
-
-	err = utils.WithProcfd(containerRootDirPath, hookScratchDirPath, func(hookScratchDirFdPath string) error {
-		return createTmpFs(hookScratchDirFdPath, int(hostLdconfigInfo.Size()))
-
-	})
-	if err != nil {
-		return "", fmt.Errorf("error creating tmpfs: %w", err)
-	}
-
-	if _, err := createFileInRoot(containerRootDirPath, ldconfigPath, hostLdconfigInfo.Mode()); err != nil {
-		return "", fmt.Errorf("error creating ldconfig: %w", err)
-	}
-
-	err = utils.WithProcfd(containerRootDirPath, ldconfigPath, func(ldconfigFdPath string) error {
-		return unix.Mount(hostLdconfigPath, ldconfigFdPath, "", unix.MS_BIND|unix.MS_RDONLY|unix.MS_NODEV|unix.MS_PRIVATE|unix.MS_NOSYMFOLLOW, "")
-	})
-	if err != nil {
-		return "", fmt.Errorf("error bind mounting host ldconfig: %w", err)
-	}
-
-	return ldconfigPath, nil
-}
-
-func createFileInRoot(containerRootDirPath string, destinationPath string, mode os.FileMode) (string, error) {
-	dest, err := securejoin.SecureJoin(containerRootDirPath, destinationPath)
-	if err != nil {
-		return "", err
-	}
-	// Make the parent directory.
-	destDir, destBase := filepath.Split(dest)
-	destDirFd, err := utils.MkdirAllInRootOpen(containerRootDirPath, destDir, 0755)
-	if err != nil {
-		return "", fmt.Errorf("error creating parent dir: %w", err)
-	}
-	defer destDirFd.Close()
-	// Make the target file. We want to avoid opening any file that is
-	// already there because it could be a "bad" file like an invalid
-	// device or hung tty that might cause a DoS, so we use mknodat.
-	// destBase does not contain any "/" components, and mknodat does
-	// not follow trailing symlinks, so we can safely just call mknodat
-	// here.
-	if err := unix.Mknodat(int(destDirFd.Fd()), destBase, unix.S_IFREG|uint32(mode), 0); err != nil {
-		// If we get EEXIST, there was already an inode there and
-		// we can consider that a success.
-		if !errors.Is(err, unix.EEXIST) {
-			return "", fmt.Errorf("error creating empty file: %w", err)
-		}
-	}
-	return dest, nil
-}
-
-// mountProc mounts a clean proc filesystem in the new root.
-func mountProc(newroot string) error {
-	target := filepath.Join(newroot, "/proc")
-
-	if err := os.MkdirAll(target, 0755); err != nil {
-		return fmt.Errorf("error creating directory: %w", err)
-	}
-	return unix.Mount("proc", target, "proc", 0, "")
-}
-
-// createTmpFs creates a tmpfs at the specified location with the specified size.
-func createTmpFs(target string, size int) error {
-	return unix.Mount("tmpfs", target, "tmpfs", 0, fmt.Sprintf("size=%d", size))
-}
-
-// createReexecCommand creates a command that can be used to trigger the reexec
-// initializer.
-// On linux this command runs in new namespaces.
-func createReexecCommand(args []string) *exec.Cmd {
-	cmd := reexec.Command(args...)
-	cmd.Stdin = os.Stdin
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Cloneflags: syscall.CLONE_NEWNS |
-			syscall.CLONE_NEWUTS |
-			syscall.CLONE_NEWIPC |
-			syscall.CLONE_NEWPID |
-			syscall.CLONE_NEWNET,
-	}
-
-	return cmd
-}

cmd/nvidia-cdi-hook/update-ldcache/ldconfig_other.go

@@ -1,51 +0,0 @@
-//go:build !linux
-
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package ldcache
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-
-	"github.com/moby/sys/reexec"
-)
-
-func pivotRoot(newroot string) error {
-	return fmt.Errorf("not supported")
-}
-
-func mountLdConfig(hostLdconfigPath string, containerRootDirPath string) (string, error) {
-	return "", fmt.Errorf("not supported")
-}
-
-func mountProc(newroot string) error {
-	return fmt.Errorf("not supported")
-}
-
-// createReexecCommand creates a command that can be used ot trigger the reexec
-// initializer.
-func createReexecCommand(args []string) *exec.Cmd {
-	cmd := reexec.Command(args...)
-	cmd.Stdin = os.Stdin
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-
-	return cmd
-}

cmd/nvidia-cdi-hook/update-ldcache/safe-exec_linux.go

@@ -1,58 +0,0 @@
-//go:build linux
-
-/**
-# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package ldcache
-
-import (
-	"fmt"
-	"os"
-	"strconv"
-	"syscall"
-
-	"github.com/opencontainers/runc/libcontainer/dmz"
-)
-
-// SafeExec attempts to clone the specified binary (as an memfd, for example) before executing it.
-func SafeExec(path string, args []string, envv []string) error {
-	safeExe, err := cloneBinary(path)
-	if err != nil {
-		//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
-		return syscall.Exec(path, args, envv)
-	}
-	defer safeExe.Close()
-
-	exePath := "/proc/self/fd/" + strconv.Itoa(int(safeExe.Fd()))
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
-	return syscall.Exec(exePath, args, envv)
-}
-
-func cloneBinary(path string) (*os.File, error) {
-	exe, err := os.Open(path)
-	if err != nil {
-		return nil, fmt.Errorf("opening current binary: %w", err)
-	}
-	defer exe.Close()
-
-	stat, err := exe.Stat()
-	if err != nil {
-		return nil, fmt.Errorf("checking %v size: %w", path, err)
-	}
-	size := stat.Size()
-
-	return dmz.CloneBinary(exe, size, path, os.TempDir())
-}

cmd/nvidia-cdi-hook/update-ldcache/safe-exec_other.go

@@ -1,28 +0,0 @@
-//go:build !linux
-
-/**
-# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package ldcache
-
-import "syscall"
-
-// SafeExec is not implemented on non-linux systems and forwards directly to the
-// Exec syscall.
-func SafeExec(path string, args []string, envv []string) error {
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
-	return syscall.Exec(path, args, envv)
-}

cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go

@@ -1,255 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package ldcache
-
-import (
-	"errors"
-	"fmt"
-	"log"
-	"os"
-	"strings"
-
-	"github.com/moby/sys/reexec"
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
-)
-
-const (
-	// ldsoconfdFilenamePattern specifies the pattern for the filename
-	// in ld.so.conf.d that includes references to the specified directories.
-	// The 00-nvcr prefix is chosen to ensure that these libraries have a
-	// higher precedence than other libraries on the system, but lower than
-	// the 00-cuda-compat that is included in some containers.
-	ldsoconfdFilenamePattern = "00-nvcr-*.conf"
-
-	reexecUpdateLdCacheCommandName = "reexec-update-ldcache"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type options struct {
-	folders       cli.StringSlice
-	ldconfigPath  string
-	containerSpec string
-}
-
-func init() {
-	reexec.Register(reexecUpdateLdCacheCommandName, updateLdCacheHandler)
-	if reexec.Init() {
-		os.Exit(0)
-	}
-}
-
-// NewCommand constructs an update-ldcache command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build the update-ldcache command
-func (m command) build() *cli.Command {
-	cfg := options{}
-
-	// Create the 'update-ldcache' command
-	c := cli.Command{
-		Name:  "update-ldcache",
-		Usage: "Update ldcache in a container by running ldconfig",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &cfg)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringSliceFlag{
-			Name:        "folder",
-			Usage:       "Specify a folder to add to /etc/ld.so.conf before updating the ld cache",
-			Destination: &cfg.folders,
-		},
-		&cli.StringFlag{
-			Name:        "ldconfig-path",
-			Usage:       "Specify the path to the ldconfig program",
-			Destination: &cfg.ldconfigPath,
-			Value:       "/sbin/ldconfig",
-		},
-		&cli.StringFlag{
-			Name:        "container-spec",
-			Usage:       "Specify the path to the OCI container spec. If empty or '-' the spec will be read from STDIN",
-			Destination: &cfg.containerSpec,
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(c *cli.Context, cfg *options) error {
-	if cfg.ldconfigPath == "" {
-		return errors.New("ldconfig-path must be specified")
-	}
-	return nil
-}
-
-func (m command) run(c *cli.Context, cfg *options) error {
-	s, err := oci.LoadContainerState(cfg.containerSpec)
-	if err != nil {
-		return fmt.Errorf("failed to load container state: %v", err)
-	}
-
-	containerRootDir, err := s.GetContainerRoot()
-	if err != nil || containerRootDir == "" || containerRootDir == "/" {
-		return fmt.Errorf("failed to determined container root: %v", err)
-	}
-
-	args := []string{
-		reexecUpdateLdCacheCommandName,
-		strings.TrimPrefix(config.NormalizeLDConfigPath("@"+cfg.ldconfigPath), "@"),
-		containerRootDir,
-	}
-	args = append(args, cfg.folders.Value()...)
-
-	cmd := createReexecCommand(args)
-
-	return cmd.Run()
-}
-
-// updateLdCacheHandler wraps updateLdCache with error handling.
-func updateLdCacheHandler() {
-	if err := updateLdCache(os.Args); err != nil {
-		log.Printf("Error updating ldcache: %v", err)
-		os.Exit(1)
-	}
-}
-
-// updateLdCache is invoked from a reexec'd handler and provides namespace
-// isolation for the operations performed by this hook.
-// At the point where this is invoked, we are in a new mount namespace that is
-// cloned from the parent.
-//
-// args[0] is the reexec initializer function name
-// args[1] is the path of the ldconfig binary on the host
-// args[2] is the container root directory
-// The remaining args are folders that need to be added to the ldcache.
-func updateLdCache(args []string) error {
-	if len(args) < 3 {
-		return fmt.Errorf("incorrect arguments: %v", args)
-	}
-	hostLdconfigPath := args[1]
-	containerRootDirPath := args[2]
-
-	// To prevent leaking the parent proc filesystem, we create a new proc mount
-	// in the container root.
-	if err := mountProc(containerRootDirPath); err != nil {
-		return fmt.Errorf("error mounting /proc: %w", err)
-	}
-
-	// We mount the host ldconfig before we pivot root since host paths are not
-	// visible after the pivot root operation.
-	ldconfigPath, err := mountLdConfig(hostLdconfigPath, containerRootDirPath)
-	if err != nil {
-		return fmt.Errorf("error mounting host ldconfig: %w", err)
-	}
-
-	// We pivot to the container root for the new process, this further limits
-	// access to the host.
-	if err := pivotRoot(containerRootDirPath); err != nil {
-		return fmt.Errorf("error running pivot_root: %w", err)
-	}
-
-	return runLdconfig(ldconfigPath, args[3:]...)
-}
-
-// runLdconfig runs the ldconfig binary and ensures that the specified directories
-// are processed for the ldcache.
-func runLdconfig(ldconfigPath string, directories ...string) error {
-	args := []string{
-		"ldconfig",
-		// Explicitly specify using /etc/ld.so.conf since the host's ldconfig may
-		// be configured to use a different config file by default.
-		// Note that since we apply the `-r {{ .containerRootDir }}` argument, /etc/ld.so.conf is
-		// in the container.
-		"-f", "/etc/ld.so.conf",
-	}
-
-	containerRoot := containerRoot("/")
-
-	if containerRoot.hasPath("/etc/ld.so.cache") {
-		args = append(args, "-C", "/etc/ld.so.cache")
-	} else {
-		args = append(args, "-N")
-	}
-
-	if containerRoot.hasPath("/etc/ld.so.conf.d") {
-		err := createLdsoconfdFile(ldsoconfdFilenamePattern, directories...)
-		if err != nil {
-			return fmt.Errorf("failed to update ld.so.conf.d: %w", err)
-		}
-	} else {
-		args = append(args, directories...)
-	}
-
-	return SafeExec(ldconfigPath, args, nil)
-}
-
-// createLdsoconfdFile creates a file at /etc/ld.so.conf.d/.
-// The file is created at /etc/ld.so.conf.d/{{ .pattern }} using `CreateTemp` and
-// contains the specified directories on each line.
-func createLdsoconfdFile(pattern string, dirs ...string) error {
-	if len(dirs) == 0 {
-		return nil
-	}
-
-	ldsoconfdDir := "/etc/ld.so.conf.d"
-	if err := os.MkdirAll(ldsoconfdDir, 0755); err != nil {
-		return fmt.Errorf("failed to create ld.so.conf.d: %w", err)
-	}
-
-	configFile, err := os.CreateTemp(ldsoconfdDir, pattern)
-	if err != nil {
-		return fmt.Errorf("failed to create config file: %w", err)
-	}
-	defer func() {
-		_ = configFile.Close()
-	}()
-
-	added := make(map[string]bool)
-	for _, dir := range dirs {
-		if added[dir] {
-			continue
-		}
-		_, err = fmt.Fprintf(configFile, "%s\n", dir)
-		if err != nil {
-			return fmt.Errorf("failed to update config file: %w", err)
-		}
-		added[dir] = true
-	}
-
-	// The created file needs to be world readable for the cases where the container is run as a non-root user.
-	if err := configFile.Chmod(0644); err != nil {
-		return fmt.Errorf("failed to chmod config file: %w", err)
-	}
-
-	return nil
-}

cmd/nvidia-container-runtime-hook/capabilities.go

@@ -1,27 +0,0 @@
-package main
-
-import (
-	"log"
-)
-
-func capabilityToCLI(cap string) string {
-	switch cap {
-	case "compute":
-		return "--compute"
-	case "compat32":
-		return "--compat32"
-	case "graphics":
-		return "--graphics"
-	case "utility":
-		return "--utility"
-	case "video":
-		return "--video"
-	case "display":
-		return "--display"
-	case "ngx":
-		return "--ngx"
-	default:
-		log.Panicln("unknown driver capability:", cap)
-	}
-	return ""
-}

cmd/nvidia-container-runtime-hook/container_config.go

@@ -1,325 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"os"
-	"path"
-
-	"github.com/opencontainers/runtime-spec/specs-go"
-	"golang.org/x/mod/semver"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config/image"
-)
-
-const (
-	capSysAdmin = "CAP_SYS_ADMIN"
-)
-
-type nvidiaConfig struct {
-	Devices            []string
-	MigConfigDevices   string
-	MigMonitorDevices  string
-	ImexChannels       []string
-	DriverCapabilities string
-	// Requirements defines the requirements DSL for the container to run.
-	// This is empty if no specific requirements are needed, or if requirements are
-	// explicitly disabled.
-	Requirements []string
-}
-
-type containerConfig struct {
-	Pid    int
-	Rootfs string
-	Image  image.CUDA
-	Nvidia *nvidiaConfig
-}
-
-// Root from OCI runtime spec
-// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L94-L100
-type Root struct {
-	Path string `json:"path"`
-}
-
-// Process from OCI runtime spec
-// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L30-L57
-type Process struct {
-	Env          []string         `json:"env,omitempty"`
-	Capabilities *json.RawMessage `json:"capabilities,omitempty" platform:"linux"`
-}
-
-// LinuxCapabilities from OCI runtime spec
-// https://github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L61
-type LinuxCapabilities struct {
-	Bounding    []string `json:"bounding,omitempty" platform:"linux"`
-	Effective   []string `json:"effective,omitempty" platform:"linux"`
-	Inheritable []string `json:"inheritable,omitempty" platform:"linux"`
-	Permitted   []string `json:"permitted,omitempty" platform:"linux"`
-	Ambient     []string `json:"ambient,omitempty" platform:"linux"`
-}
-
-// Spec from OCI runtime spec
-// We use pointers to structs, similarly to the latest version of runtime-spec:
-// https://github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L5-L28
-type Spec struct {
-	Version *string       `json:"ociVersion"`
-	Process *Process      `json:"process,omitempty"`
-	Root    *Root         `json:"root,omitempty"`
-	Mounts  []specs.Mount `json:"mounts,omitempty"`
-}
-
-// HookState holds state information about the hook
-type HookState struct {
-	Pid int `json:"pid,omitempty"`
-	// After 17.06, runc is using the runtime spec:
-	// github.com/docker/runc/blob/17.06/libcontainer/configs/config.go#L262-L263
-	// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/state.go#L3-L17
-	Bundle string `json:"bundle"`
-	// Before 17.06, runc used a custom struct that didn't conform to the spec:
-	// github.com/docker/runc/blob/17.03.x/libcontainer/configs/config.go#L245-L252
-	BundlePath string `json:"bundlePath"`
-}
-
-func loadSpec(path string) (spec *Spec) {
-	f, err := os.Open(path)
-	if err != nil {
-		log.Panicln("could not open OCI spec:", err)
-	}
-	defer f.Close()
-
-	if err = json.NewDecoder(f).Decode(&spec); err != nil {
-		log.Panicln("could not decode OCI spec:", err)
-	}
-	if spec.Version == nil {
-		log.Panicln("Version is empty in OCI spec")
-	}
-	if spec.Process == nil {
-		log.Panicln("Process is empty in OCI spec")
-	}
-	if spec.Root == nil {
-		log.Panicln("Root is empty in OCI spec")
-	}
-	return
-}
-
-func isPrivileged(s *Spec) bool {
-	if s.Process.Capabilities == nil {
-		return false
-	}
-
-	var caps []string
-	// If v1.0.0-rc1 <= OCI version < v1.0.0-rc5 parse s.Process.Capabilities as:
-	// github.com/opencontainers/runtime-spec/blob/v1.0.0-rc1/specs-go/config.go#L30-L54
-	rc1cmp := semver.Compare("v"+*s.Version, "v1.0.0-rc1")
-	rc5cmp := semver.Compare("v"+*s.Version, "v1.0.0-rc5")
-	if (rc1cmp == 1 || rc1cmp == 0) && (rc5cmp == -1) {
-		err := json.Unmarshal(*s.Process.Capabilities, &caps)
-		if err != nil {
-			log.Panicln("could not decode Process.Capabilities in OCI spec:", err)
-		}
-		for _, c := range caps {
-			if c == capSysAdmin {
-				return true
-			}
-		}
-		return false
-	}
-
-	// Otherwise, parse s.Process.Capabilities as:
-	// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L30-L54
-	process := specs.Process{
-		Env: s.Process.Env,
-	}
-
-	err := json.Unmarshal(*s.Process.Capabilities, &process.Capabilities)
-	if err != nil {
-		log.Panicln("could not decode Process.Capabilities in OCI spec:", err)
-	}
-
-	fullSpec := specs.Spec{
-		Version: *s.Version,
-		Process: &process,
-	}
-
-	return image.IsPrivileged(&fullSpec)
-}
-
-func getDevicesFromEnvvar(containerImage image.CUDA, swarmResourceEnvvars []string) []string {
-	// We check if the image has at least one of the Swarm resource envvars defined and use this
-	// if specified.
-	for _, envvar := range swarmResourceEnvvars {
-		if containerImage.HasEnvvar(envvar) {
-			return containerImage.DevicesFromEnvvars(swarmResourceEnvvars...).List()
-		}
-	}
-
-	return containerImage.VisibleDevicesFromEnvVar()
-}
-
-func (hookConfig *hookConfig) getDevices(image image.CUDA, privileged bool) []string {
-	// If enabled, try and get the device list from volume mounts first
-	if hookConfig.AcceptDeviceListAsVolumeMounts {
-		devices := image.VisibleDevicesFromMounts()
-		if len(devices) > 0 {
-			return devices
-		}
-	}
-
-	// Fallback to reading from the environment variable if privileges are correct
-	devices := getDevicesFromEnvvar(image, hookConfig.getSwarmResourceEnvvars())
-	if len(devices) == 0 {
-		return nil
-	}
-	if privileged || hookConfig.AcceptEnvvarUnprivileged {
-		return devices
-	}
-
-	configName := hookConfig.getConfigOption("AcceptEnvvarUnprivileged")
-	log.Printf("Ignoring devices specified in NVIDIA_VISIBLE_DEVICES (privileged=%v, %v=%v) ", privileged, configName, hookConfig.AcceptEnvvarUnprivileged)
-
-	return nil
-}
-
-func getMigConfigDevices(i image.CUDA) *string {
-	return getMigDevices(i, image.EnvVarNvidiaMigConfigDevices)
-}
-
-func getMigMonitorDevices(i image.CUDA) *string {
-	return getMigDevices(i, image.EnvVarNvidiaMigMonitorDevices)
-}
-
-func getMigDevices(image image.CUDA, envvar string) *string {
-	if !image.HasEnvvar(envvar) {
-		return nil
-	}
-	devices := image.Getenv(envvar)
-	return &devices
-}
-
-func (hookConfig *hookConfig) getImexChannels(image image.CUDA, privileged bool) []string {
-	if hookConfig.Features.IgnoreImexChannelRequests.IsEnabled() {
-		return nil
-	}
-
-	// If enabled, try and get the device list from volume mounts first
-	if hookConfig.AcceptDeviceListAsVolumeMounts {
-		devices := image.ImexChannelsFromMounts()
-		if len(devices) > 0 {
-			return devices
-		}
-	}
-	devices := image.ImexChannelsFromEnvVar()
-	if len(devices) == 0 {
-		return nil
-	}
-
-	if privileged || hookConfig.AcceptEnvvarUnprivileged {
-		return devices
-	}
-
-	return nil
-}
-
-func (hookConfig *hookConfig) getDriverCapabilities(cudaImage image.CUDA, legacyImage bool) image.DriverCapabilities {
-	// We use the default driver capabilities by default. This is filtered to only include the
-	// supported capabilities
-	supportedDriverCapabilities := image.NewDriverCapabilities(hookConfig.SupportedDriverCapabilities)
-
-	capabilities := supportedDriverCapabilities.Intersection(image.DefaultDriverCapabilities)
-
-	capsEnvSpecified := cudaImage.HasEnvvar(image.EnvVarNvidiaDriverCapabilities)
-	capsEnv := cudaImage.Getenv(image.EnvVarNvidiaDriverCapabilities)
-
-	if !capsEnvSpecified && legacyImage {
-		// Environment variable unset with legacy image: set all capabilities.
-		return supportedDriverCapabilities
-	}
-
-	if capsEnvSpecified && len(capsEnv) > 0 {
-		// If the envvironment variable is specified and is non-empty, use the capabilities value
-		envCapabilities := image.NewDriverCapabilities(capsEnv)
-		capabilities = supportedDriverCapabilities.Intersection(envCapabilities)
-		if !envCapabilities.IsAll() && len(capabilities) != len(envCapabilities) {
-			log.Panicln(fmt.Errorf("unsupported capabilities found in '%v' (allowed '%v')", envCapabilities, capabilities))
-		}
-	}
-
-	return capabilities
-}
-
-func (hookConfig *hookConfig) getNvidiaConfig(image image.CUDA, privileged bool) *nvidiaConfig {
-	legacyImage := image.IsLegacy()
-
-	devices := hookConfig.getDevices(image, privileged)
-	if len(devices) == 0 {
-		// empty devices means this is not a GPU container.
-		return nil
-	}
-
-	var migConfigDevices string
-	if d := getMigConfigDevices(image); d != nil {
-		migConfigDevices = *d
-	}
-	if !privileged && migConfigDevices != "" {
-		log.Panicln("cannot set MIG_CONFIG_DEVICES in non privileged container")
-	}
-
-	var migMonitorDevices string
-	if d := getMigMonitorDevices(image); d != nil {
-		migMonitorDevices = *d
-	}
-	if !privileged && migMonitorDevices != "" {
-		log.Panicln("cannot set MIG_MONITOR_DEVICES in non privileged container")
-	}
-
-	imexChannels := hookConfig.getImexChannels(image, privileged)
-
-	driverCapabilities := hookConfig.getDriverCapabilities(image, legacyImage).String()
-
-	requirements, err := image.GetRequirements()
-	if err != nil {
-		log.Panicln("failed to get requirements", err)
-	}
-
-	return &nvidiaConfig{
-		Devices:            devices,
-		MigConfigDevices:   migConfigDevices,
-		MigMonitorDevices:  migMonitorDevices,
-		ImexChannels:       imexChannels,
-		DriverCapabilities: driverCapabilities,
-		Requirements:       requirements,
-	}
-}
-
-func (hookConfig *hookConfig) getContainerConfig() (config containerConfig) {
-	var h HookState
-	d := json.NewDecoder(os.Stdin)
-	if err := d.Decode(&h); err != nil {
-		log.Panicln("could not decode container state:", err)
-	}
-
-	b := h.Bundle
-	if len(b) == 0 {
-		b = h.BundlePath
-	}
-
-	s := loadSpec(path.Join(b, "config.json"))
-
-	image, err := image.New(
-		image.WithEnv(s.Process.Env),
-		image.WithMounts(s.Mounts),
-		image.WithDisableRequire(hookConfig.DisableRequire),
-	)
-	if err != nil {
-		log.Panicln(err)
-	}
-
-	privileged := isPrivileged(s)
-	return containerConfig{
-		Pid:    h.Pid,
-		Rootfs: s.Root.Path,
-		Image:  image,
-		Nvidia: hookConfig.getNvidiaConfig(image, privileged),
-	}
-}

cmd/nvidia-container-runtime-hook/container_config_test.go

@@ -1,977 +0,0 @@
-package main
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/stretchr/testify/require"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config/image"
-)
-
-func TestGetNvidiaConfig(t *testing.T) {
-	var tests = []struct {
-		description    string
-		env            map[string]string
-		privileged     bool
-		hookConfig     *hookConfig
-		expectedConfig *nvidiaConfig
-		expectedPanic  bool
-	}{
-		{
-			description:    "No environment, unprivileged",
-			env:            map[string]string{},
-			privileged:     false,
-			expectedConfig: nil,
-		},
-		{
-			description:    "No environment, privileged",
-			env:            map[string]string{},
-			privileged:     true,
-			expectedConfig: nil,
-		},
-		{
-			description: "Legacy image, no devices, no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion: "9.0",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				DriverCapabilities: image.SupportedDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Legacy image, devices 'all', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:          "9.0",
-				image.EnvVarNvidiaVisibleDevices: "all",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				DriverCapabilities: image.SupportedDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Legacy image, devices 'empty', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:          "9.0",
-				image.EnvVarNvidiaVisibleDevices: "",
-			},
-			privileged:     false,
-			expectedConfig: nil,
-		},
-		{
-			description: "Legacy image, devices 'void', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:          "9.0",
-				image.EnvVarNvidiaVisibleDevices: "void",
-			},
-			privileged:     false,
-			expectedConfig: nil,
-		},
-		{
-			description: "Legacy image, devices 'none', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:          "9.0",
-				image.EnvVarNvidiaVisibleDevices: "none",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{""},
-				DriverCapabilities: image.SupportedDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Legacy image, devices set, no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:          "9.0",
-				image.EnvVarNvidiaVisibleDevices: "gpu0,gpu1",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: image.SupportedDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Legacy image, devices set, capabilities 'empty', no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:              "9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Legacy image, devices set, capabilities 'all', no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:              "9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "all",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: image.SupportedDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Legacy image, devices set, capabilities set, no requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:              "9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "video,display",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: "display,video",
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Legacy image, devices set, capabilities set, requirements set",
-			env: map[string]string{
-				image.EnvVarCudaVersion:              "9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "video,display",
-				image.NvidiaRequirePrefix + "REQ0":   "req0=true",
-				image.NvidiaRequirePrefix + "REQ1":   "req1=false",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: "display,video",
-				Requirements:       []string{"cuda>=9.0", "req0=true", "req1=false"},
-			},
-		},
-		{
-			description: "Legacy image, devices set, capabilities set, requirements set, disable requirements",
-			env: map[string]string{
-				image.EnvVarCudaVersion:              "9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "video,display",
-				image.NvidiaRequirePrefix + "REQ0":   "req0=true",
-				image.NvidiaRequirePrefix + "REQ1":   "req1=false",
-				image.EnvVarNvidiaDisableRequire:     "true",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: "display,video",
-				Requirements:       []string{},
-			},
-		},
-		{
-			description: "Modern image, no devices, no capabilities, no requirements, no image.EnvVarCudaVersion",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda: "cuda>=9.0",
-			},
-			privileged:     false,
-			expectedConfig: nil,
-		},
-		{
-			description: "Modern image, no devices, no capabilities, no requirement, image.EnvVarCudaVersion set",
-			env: map[string]string{
-				image.EnvVarCudaVersion:       "9.0",
-				image.EnvVarNvidiaRequireCuda: "cuda>=9.0",
-			},
-			privileged:     false,
-			expectedConfig: nil,
-		},
-		{
-			description: "Modern image, devices 'all', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:    "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices: "all",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices 'empty', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:    "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices: "",
-			},
-			privileged:     false,
-			expectedConfig: nil,
-		},
-		{
-			description: "Modern image, devices 'void', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:    "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices: "void",
-			},
-			privileged:     false,
-			expectedConfig: nil,
-		},
-		{
-			description: "Modern image, devices 'none', no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:    "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices: "none",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{""},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices set, no capabilities, no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:    "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices: "gpu0,gpu1",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices set, capabilities 'empty', no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:        "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices set, capabilities 'all', no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:        "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "all",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: image.SupportedDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices set, capabilities set, no requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:        "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "video,display",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: "display,video",
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices set, capabilities set, requirements set",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:        "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "video,display",
-				image.NvidiaRequirePrefix + "REQ0":   "req0=true",
-				image.NvidiaRequirePrefix + "REQ1":   "req1=false",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: "display,video",
-				Requirements:       []string{"cuda>=9.0", "req0=true", "req1=false"},
-			},
-		},
-		{
-			description: "Modern image, devices set, capabilities set, requirements set, disable requirements",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:        "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:     "gpu0,gpu1",
-				image.EnvVarNvidiaDriverCapabilities: "video,display",
-				image.NvidiaRequirePrefix + "REQ0":   "req0=true",
-				image.NvidiaRequirePrefix + "REQ1":   "req1=false",
-				image.EnvVarNvidiaDisableRequire:     "true",
-			},
-			privileged: false,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"gpu0", "gpu1"},
-				DriverCapabilities: "display,video",
-				Requirements:       []string{},
-			},
-		},
-		{
-			description: "No cuda envs, devices 'all'",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "all",
-			},
-			privileged: false,
-
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{},
-			},
-		},
-		{
-			description: "Modern image, devices 'all', migConfig set, privileged",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:      "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:   "all",
-				image.EnvVarNvidiaMigConfigDevices: "mig0,mig1",
-			},
-			privileged: true,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				MigConfigDevices:   "mig0,mig1",
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices 'all', migConfig set, unprivileged",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:      "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:   "all",
-				image.EnvVarNvidiaMigConfigDevices: "mig0,mig1",
-			},
-			privileged:    false,
-			expectedPanic: true,
-		},
-		{
-			description: "Modern image, devices 'all', migMonitor set, privileged",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:       "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:    "all",
-				image.EnvVarNvidiaMigMonitorDevices: "mig0,mig1",
-			},
-			privileged: true,
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				MigMonitorDevices:  "mig0,mig1",
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-				Requirements:       []string{"cuda>=9.0"},
-			},
-		},
-		{
-			description: "Modern image, devices 'all', migMonitor set, unprivileged",
-			env: map[string]string{
-				image.EnvVarNvidiaRequireCuda:       "cuda>=9.0",
-				image.EnvVarNvidiaVisibleDevices:    "all",
-				image.EnvVarNvidiaMigMonitorDevices: "mig0,mig1",
-			},
-			privileged:    false,
-			expectedPanic: true,
-		},
-		{
-			description: "Hook config set as driver-capabilities-all",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices:     "all",
-				image.EnvVarNvidiaDriverCapabilities: "all",
-			},
-			privileged: true,
-			hookConfig: &hookConfig{
-				Config: &config.Config{
-					SupportedDriverCapabilities: "video,display",
-				},
-			},
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				DriverCapabilities: "display,video",
-			},
-		},
-		{
-			description: "Hook config set, envvar sets driver-capabilities",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices:     "all",
-				image.EnvVarNvidiaDriverCapabilities: "video,display",
-			},
-			privileged: true,
-			hookConfig: &hookConfig{
-				Config: &config.Config{
-					SupportedDriverCapabilities: "video,display,compute,utility",
-				},
-			},
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				DriverCapabilities: "display,video",
-			},
-		},
-		{
-			description: "Hook config set, envvar unset sets default driver-capabilities",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "all",
-			},
-			privileged: true,
-			hookConfig: &hookConfig{
-				Config: &config.Config{
-					SupportedDriverCapabilities: "video,display,utility,compute",
-				},
-			},
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"all"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-			},
-		},
-		{
-			description: "Hook config set, swarmResource overrides device selection",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "all",
-				"DOCKER_SWARM_RESOURCE":          "GPU1,GPU2",
-			},
-			privileged: true,
-			hookConfig: &hookConfig{
-				Config: &config.Config{
-					SwarmResource:               "DOCKER_SWARM_RESOURCE",
-					SupportedDriverCapabilities: "video,display,utility,compute",
-				},
-			},
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"GPU1", "GPU2"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-			},
-		},
-		{
-			description: "Hook config set, comma separated swarmResource is split and overrides device selection",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "all",
-				"DOCKER_SWARM_RESOURCE":          "GPU1,GPU2",
-			},
-			privileged: true,
-			hookConfig: &hookConfig{
-				Config: &config.Config{
-					SwarmResource:               "NOT_DOCKER_SWARM_RESOURCE,DOCKER_SWARM_RESOURCE",
-					SupportedDriverCapabilities: "video,display,utility,compute",
-				},
-			},
-			expectedConfig: &nvidiaConfig{
-				Devices:            []string{"GPU1", "GPU2"},
-				DriverCapabilities: image.DefaultDriverCapabilities.String(),
-			},
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.description, func(t *testing.T) {
-			image, _ := image.New(
-				image.WithEnvMap(tc.env),
-			)
-			// Wrap the call to getNvidiaConfig() in a closure.
-			var cfg *nvidiaConfig
-			getConfig := func() {
-				hookCfg := tc.hookConfig
-				if hookCfg == nil {
-					defaultConfig, _ := config.GetDefault()
-					hookCfg = &hookConfig{defaultConfig}
-				}
-				cfg = hookCfg.getNvidiaConfig(image, tc.privileged)
-			}
-
-			// For any tests that are expected to panic, make sure they do.
-			if tc.expectedPanic {
-				require.Panics(t, getConfig)
-				return
-			}
-
-			// For all other tests, just grab the config
-			getConfig()
-
-			// And start comparing the test results to the expected results.
-			if tc.expectedConfig == nil {
-				require.Nil(t, cfg, tc.description)
-				return
-			}
-
-			require.NotNil(t, cfg, tc.description)
-
-			require.Equal(t, tc.expectedConfig.Devices, cfg.Devices)
-			require.Equal(t, tc.expectedConfig.MigConfigDevices, cfg.MigConfigDevices)
-			require.Equal(t, tc.expectedConfig.MigMonitorDevices, cfg.MigMonitorDevices)
-			require.Equal(t, tc.expectedConfig.DriverCapabilities, cfg.DriverCapabilities)
-
-			require.ElementsMatch(t, tc.expectedConfig.Requirements, cfg.Requirements)
-		})
-	}
-}
-
-func TestDeviceListSourcePriority(t *testing.T) {
-	var tests = []struct {
-		description        string
-		mountDevices       []specs.Mount
-		envvarDevices      string
-		privileged         bool
-		acceptUnprivileged bool
-		acceptMounts       bool
-		expectedDevices    []string
-	}{
-		{
-			description: "Mount devices, unprivileged, no accept unprivileged",
-			mountDevices: []specs.Mount{
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU0"),
-				},
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU1"),
-				},
-			},
-			envvarDevices:      "GPU2,GPU3",
-			privileged:         false,
-			acceptUnprivileged: false,
-			acceptMounts:       true,
-			expectedDevices:    []string{"GPU0", "GPU1"},
-		},
-		{
-			description:        "No mount devices, unprivileged, no accept unprivileged",
-			mountDevices:       nil,
-			envvarDevices:      "GPU0,GPU1",
-			privileged:         false,
-			acceptUnprivileged: false,
-			acceptMounts:       true,
-			expectedDevices:    nil,
-		},
-		{
-			description:        "No mount devices, privileged, no accept unprivileged",
-			mountDevices:       nil,
-			envvarDevices:      "GPU0,GPU1",
-			privileged:         true,
-			acceptUnprivileged: false,
-			acceptMounts:       true,
-			expectedDevices:    []string{"GPU0", "GPU1"},
-		},
-		{
-			description:        "No mount devices, unprivileged, accept unprivileged",
-			mountDevices:       nil,
-			envvarDevices:      "GPU0,GPU1",
-			privileged:         false,
-			acceptUnprivileged: true,
-			acceptMounts:       true,
-			expectedDevices:    []string{"GPU0", "GPU1"},
-		},
-		{
-			description: "Mount devices, unprivileged, accept unprivileged, no accept mounts",
-			mountDevices: []specs.Mount{
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU0"),
-				},
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU1"),
-				},
-			},
-			envvarDevices:      "GPU2,GPU3",
-			privileged:         false,
-			acceptUnprivileged: true,
-			acceptMounts:       false,
-			expectedDevices:    []string{"GPU2", "GPU3"},
-		},
-		{
-			description: "Mount devices, unprivileged, no accept unprivileged, no accept mounts",
-			mountDevices: []specs.Mount{
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU0"),
-				},
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU1"),
-				},
-			},
-			envvarDevices:      "GPU2,GPU3",
-			privileged:         false,
-			acceptUnprivileged: false,
-			acceptMounts:       false,
-			expectedDevices:    nil,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.description, func(t *testing.T) {
-			// Wrap the call to getDevices() in a closure.
-			var devices []string
-			getDevices := func() {
-				image, _ := image.New(
-					image.WithEnvMap(
-						map[string]string{
-							image.EnvVarNvidiaVisibleDevices: tc.envvarDevices,
-						},
-					),
-					image.WithMounts(tc.mountDevices),
-				)
-				defaultConfig, _ := config.GetDefault()
-				cfg := &hookConfig{defaultConfig}
-				cfg.AcceptEnvvarUnprivileged = tc.acceptUnprivileged
-				cfg.AcceptDeviceListAsVolumeMounts = tc.acceptMounts
-				devices = cfg.getDevices(image, tc.privileged)
-			}
-
-			// For all other tests, just grab the devices and check the results
-			getDevices()
-
-			require.Equal(t, tc.expectedDevices, devices)
-		})
-	}
-}
-
-func TestGetDevicesFromEnvvar(t *testing.T) {
-	envDockerResourceGPUs := "DOCKER_RESOURCE_GPUS"
-	gpuID := "GPU-12345"
-	anotherGPUID := "GPU-67890"
-	thirdGPUID := "MIG-12345"
-
-	var tests = []struct {
-		description          string
-		swarmResourceEnvvars []string
-		env                  map[string]string
-		expectedDevices      []string
-	}{
-		{
-			description: "empty env returns nil for non-legacy image",
-		},
-		{
-			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "",
-			},
-		},
-		{
-			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "void",
-			},
-		},
-		{
-			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "none",
-			},
-			expectedDevices: []string{""},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: gpuID,
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: gpuID,
-				image.EnvVarCudaVersion:          "legacy",
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "empty env returns all for legacy image",
-			env: map[string]string{
-				image.EnvVarCudaVersion: "legacy",
-			},
-			expectedDevices: []string{"all"},
-		},
-		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is ignored when
-		// not enabled
-		{
-			description: "missing NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				envDockerResourceGPUs: anotherGPUID,
-			},
-		},
-		{
-			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "",
-				envDockerResourceGPUs:            anotherGPUID,
-			},
-		},
-		{
-			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "void",
-				envDockerResourceGPUs:            anotherGPUID,
-			},
-		},
-		{
-			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: "none",
-				envDockerResourceGPUs:            anotherGPUID,
-			},
-			expectedDevices: []string{""},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: gpuID,
-				envDockerResourceGPUs:            anotherGPUID,
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: gpuID,
-				envDockerResourceGPUs:            anotherGPUID,
-				image.EnvVarCudaVersion:          "legacy",
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "empty env returns all for legacy image",
-			env: map[string]string{
-				envDockerResourceGPUs:   anotherGPUID,
-				image.EnvVarCudaVersion: "legacy",
-			},
-			expectedDevices: []string{"all"},
-		},
-		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is selected when
-		// enabled
-		{
-			description:          "empty env returns nil for non-legacy image",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-		},
-		{
-			description:          "blank DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: "",
-			},
-		},
-		{
-			description:          "'void' DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: "void",
-			},
-		},
-		{
-			description:          "'none' DOCKER_RESOURCE_GPUS returns empty for non-legacy image",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: "none",
-			},
-			expectedDevices: []string{""},
-		},
-		{
-			description:          "DOCKER_RESOURCE_GPUS set returns value for non-legacy image",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: gpuID,
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description:          "DOCKER_RESOURCE_GPUS set returns value for legacy image",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs:   gpuID,
-				image.EnvVarCudaVersion: "legacy",
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description:          "DOCKER_RESOURCE_GPUS is selected if present",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-		{
-			description:          "DOCKER_RESOURCE_GPUS overrides NVIDIA_VISIBLE_DEVICES if present",
-			swarmResourceEnvvars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices: gpuID,
-				envDockerResourceGPUs:            anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-		{
-			description:          "DOCKER_RESOURCE_GPUS_ADDITIONAL overrides NVIDIA_VISIBLE_DEVICES if present",
-			swarmResourceEnvvars: []string{"DOCKER_RESOURCE_GPUS_ADDITIONAL"},
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices:  gpuID,
-				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-		{
-			description:          "All available swarm resource envvars are selected and override NVIDIA_VISIBLE_DEVICES if present",
-			swarmResourceEnvvars: []string{"DOCKER_RESOURCE_GPUS", "DOCKER_RESOURCE_GPUS_ADDITIONAL"},
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices:  gpuID,
-				"DOCKER_RESOURCE_GPUS":            thirdGPUID,
-				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
-			},
-			expectedDevices: []string{thirdGPUID, anotherGPUID},
-		},
-		{
-			description:          "DOCKER_RESOURCE_GPUS_ADDITIONAL or DOCKER_RESOURCE_GPUS override NVIDIA_VISIBLE_DEVICES if present",
-			swarmResourceEnvvars: []string{"DOCKER_RESOURCE_GPUS", "DOCKER_RESOURCE_GPUS_ADDITIONAL"},
-			env: map[string]string{
-				image.EnvVarNvidiaVisibleDevices:  gpuID,
-				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.description, func(t *testing.T) {
-			image, _ := image.New(
-				image.WithEnvMap(tc.env),
-			)
-			devices := getDevicesFromEnvvar(image, tc.swarmResourceEnvvars)
-			require.EqualValues(t, tc.expectedDevices, devices)
-		})
-	}
-}
-
-func TestGetDriverCapabilities(t *testing.T) {
-
-	supportedCapabilities := "compute,display,utility,video"
-
-	testCases := []struct {
-		description           string
-		env                   map[string]string
-		legacyImage           bool
-		supportedCapabilities string
-		expectedPanic         bool
-		expectedCapabilities  string
-	}{
-		{
-			description: "Env is set for legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaDriverCapabilities: "display,video",
-			},
-			legacyImage:           true,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  "display,video",
-		},
-		{
-			description: "Env is all for legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaDriverCapabilities: "all",
-			},
-			legacyImage:           true,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  supportedCapabilities,
-		},
-		{
-			description: "Env is empty for legacy image",
-			env: map[string]string{
-				image.EnvVarNvidiaDriverCapabilities: "",
-			},
-			legacyImage:           true,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  image.DefaultDriverCapabilities.String(),
-		},
-		{
-			description:           "Env unset for legacy image is 'all'",
-			env:                   map[string]string{},
-			legacyImage:           true,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  supportedCapabilities,
-		},
-		{
-			description: "Env is set for modern image",
-			env: map[string]string{
-				image.EnvVarNvidiaDriverCapabilities: "display,video",
-			},
-			legacyImage:           false,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  "display,video",
-		},
-		{
-			description:           "Env unset for modern image is default",
-			env:                   map[string]string{},
-			legacyImage:           false,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  image.DefaultDriverCapabilities.String(),
-		},
-		{
-			description: "Env is all for modern image",
-			env: map[string]string{
-				image.EnvVarNvidiaDriverCapabilities: "all",
-			},
-			legacyImage:           false,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  supportedCapabilities,
-		},
-		{
-			description: "Env is empty for modern image",
-			env: map[string]string{
-				image.EnvVarNvidiaDriverCapabilities: "",
-			},
-			legacyImage:           false,
-			supportedCapabilities: supportedCapabilities,
-			expectedCapabilities:  image.DefaultDriverCapabilities.String(),
-		},
-		{
-			description: "Invalid capabilities panic",
-			env: map[string]string{
-				image.EnvVarNvidiaDriverCapabilities: "compute,utility",
-			},
-			supportedCapabilities: "not-compute,not-utility",
-			expectedPanic:         true,
-		},
-		{
-			description:           "Default is restricted for modern image",
-			legacyImage:           false,
-			supportedCapabilities: "compute",
-			expectedCapabilities:  "compute",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			var capabilities string
-
-			c := hookConfig{
-				Config: &config.Config{
-					SupportedDriverCapabilities: tc.supportedCapabilities,
-				},
-			}
-
-			image, _ := image.New(
-				image.WithEnvMap(tc.env),
-			)
-			getDriverCapabilities := func() {
-				capabilities = c.getDriverCapabilities(image, tc.legacyImage).String()
-			}
-
-			if tc.expectedPanic {
-				require.Panics(t, getDriverCapabilities)
-				return
-			}
-
-			getDriverCapabilities()
-			require.EqualValues(t, tc.expectedCapabilities, capabilities)
-		})
-	}
-}

cmd/nvidia-container-runtime-hook/hook_config.go

@@ -1,129 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"log"
-	"os"
-	"path"
-	"reflect"
-	"strings"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config/image"
-)
-
-const (
-	configPath = "/etc/nvidia-container-runtime/config.toml"
-	driverPath = "/run/nvidia/driver"
-)
-
-// hookConfig wraps the toolkit config.
-// This allows for functions to be defined on the local type.
-type hookConfig struct {
-	*config.Config
-}
-
-// loadConfig loads the required paths for the hook config.
-func loadConfig() (*config.Config, error) {
-	var configPaths []string
-	var required bool
-	if len(*configflag) != 0 {
-		configPaths = append(configPaths, *configflag)
-		required = true
-	} else {
-		configPaths = append(configPaths, path.Join(driverPath, configPath), configPath)
-	}
-
-	for _, p := range configPaths {
-		cfg, err := config.New(
-			config.WithConfigFile(p),
-			config.WithRequired(true),
-		)
-		if err == nil {
-			return cfg.Config()
-		} else if os.IsNotExist(err) && !required {
-			continue
-		}
-		return nil, fmt.Errorf("couldn't open required configuration file: %v", err)
-	}
-
-	return config.GetDefault()
-}
-
-func getHookConfig() (*hookConfig, error) {
-	cfg, err := loadConfig()
-	if err != nil {
-		return nil, fmt.Errorf("failed to load config: %v", err)
-	}
-	config := &hookConfig{cfg}
-
-	allSupportedDriverCapabilities := image.SupportedDriverCapabilities
-	if config.SupportedDriverCapabilities == "all" {
-		config.SupportedDriverCapabilities = allSupportedDriverCapabilities.String()
-	}
-	configuredCapabilities := image.NewDriverCapabilities(config.SupportedDriverCapabilities)
-	// We ensure that the configured value is a subset of all supported capabilities
-	if !allSupportedDriverCapabilities.IsSuperset(configuredCapabilities) {
-		configName := config.getConfigOption("SupportedDriverCapabilities")
-		log.Panicf("Invalid value for config option '%v'; %v (supported: %v)\n", configName, config.SupportedDriverCapabilities, allSupportedDriverCapabilities.String())
-	}
-
-	return config, nil
-}
-
-// getConfigOption returns the toml config option associated with the
-// specified struct field.
-func (c hookConfig) getConfigOption(fieldName string) string {
-	t := reflect.TypeOf(c)
-	f, ok := t.FieldByName(fieldName)
-	if !ok {
-		return fieldName
-	}
-	v, ok := f.Tag.Lookup("toml")
-	if !ok {
-		return fieldName
-	}
-	return v
-}
-
-// getSwarmResourceEnvvars returns the swarm resource envvars for the config.
-func (c *hookConfig) getSwarmResourceEnvvars() []string {
-	if c.SwarmResource == "" {
-		return nil
-	}
-
-	candidates := strings.Split(c.SwarmResource, ",")
-
-	var envvars []string
-	for _, c := range candidates {
-		trimmed := strings.TrimSpace(c)
-		if len(trimmed) > 0 {
-			envvars = append(envvars, trimmed)
-		}
-	}
-
-	return envvars
-}
-
-// nvidiaContainerCliCUDACompatModeFlags returns required --cuda-compat-mode
-// flag(s) depending on the hook and runtime configurations.
-func (c *hookConfig) nvidiaContainerCliCUDACompatModeFlags() []string {
-	var flag string
-	switch c.NVIDIAContainerRuntimeConfig.Modes.Legacy.CUDACompatMode {
-	case config.CUDACompatModeLdconfig:
-		flag = "--cuda-compat-mode=ldconfig"
-	case config.CUDACompatModeMount:
-		flag = "--cuda-compat-mode=mount"
-	case config.CUDACompatModeDisabled, config.CUDACompatModeHook:
-		flag = "--cuda-compat-mode=disabled"
-	default:
-		if !c.Features.AllowCUDACompatLibsFromContainer.IsEnabled() {
-			flag = "--cuda-compat-mode=disabled"
-		}
-	}
-
-	if flag == "" {
-		return nil
-	}
-	return []string{flag}
-}

cmd/nvidia-container-runtime-hook/main.go

@@ -1,203 +0,0 @@
-package main
-
-import (
-	"flag"
-	"fmt"
-	"log"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"runtime/debug"
-	"strconv"
-	"strings"
-	"syscall"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/info"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup"
-)
-
-var (
-	debugflag   = flag.Bool("debug", false, "enable debug output")
-	versionflag = flag.Bool("version", false, "enable version output")
-	configflag  = flag.String("config", "", "configuration file")
-)
-
-func exit() {
-	if err := recover(); err != nil {
-		if _, ok := err.(runtime.Error); ok {
-			log.Println(err)
-		}
-		if *debugflag {
-			log.Printf("%s", debug.Stack())
-		}
-		os.Exit(1)
-	}
-	os.Exit(0)
-}
-
-func getCLIPath(config config.ContainerCLIConfig) string {
-	if config.Path != "" {
-		return config.Path
-	}
-
-	if err := os.Setenv("PATH", lookup.GetPath(config.Root)); err != nil {
-		log.Panicln("couldn't set PATH variable:", err)
-	}
-
-	path, err := exec.LookPath("nvidia-container-cli")
-	if err != nil {
-		log.Panicln("couldn't find binary nvidia-container-cli in", os.Getenv("PATH"), ":", err)
-	}
-	return path
-}
-
-// getRootfsPath returns an absolute path. We don't need to resolve symlinks for now.
-func getRootfsPath(config containerConfig) string {
-	rootfs, err := filepath.Abs(config.Rootfs)
-	if err != nil {
-		log.Panicln(err)
-	}
-	return rootfs
-}
-
-func doPrestart() {
-	var err error
-
-	defer exit()
-	log.SetFlags(0)
-
-	hook, err := getHookConfig()
-	if err != nil || hook == nil {
-		log.Panicln("error getting hook config:", err)
-	}
-	cli := hook.NVIDIAContainerCLIConfig
-
-	container := hook.getContainerConfig()
-	nvidia := container.Nvidia
-	if nvidia == nil {
-		// Not a GPU container, nothing to do.
-		return
-	}
-
-	if !hook.NVIDIAContainerRuntimeHookConfig.SkipModeDetection && info.ResolveAutoMode(&logInterceptor{}, hook.NVIDIAContainerRuntimeConfig.Mode, container.Image) != "legacy" {
-		log.Panicln("invoking the NVIDIA Container Runtime Hook directly (e.g. specifying the docker --gpus flag) is not supported. Please use the NVIDIA Container Runtime (e.g. specify the --runtime=nvidia flag) instead.")
-	}
-
-	rootfs := getRootfsPath(container)
-
-	args := []string{getCLIPath(cli)}
-	if cli.Root != "" {
-		args = append(args, fmt.Sprintf("--root=%s", cli.Root))
-	}
-	if cli.LoadKmods {
-		args = append(args, "--load-kmods")
-	}
-	if hook.Features.DisableImexChannelCreation.IsEnabled() {
-		args = append(args, "--no-create-imex-channels")
-	}
-	if cli.NoPivot {
-		args = append(args, "--no-pivot")
-	}
-	if *debugflag {
-		args = append(args, "--debug=/dev/stderr")
-	} else if cli.Debug != "" {
-		args = append(args, fmt.Sprintf("--debug=%s", cli.Debug))
-	}
-	if cli.Ldcache != "" {
-		args = append(args, fmt.Sprintf("--ldcache=%s", cli.Ldcache))
-	}
-	if cli.User != "" {
-		args = append(args, fmt.Sprintf("--user=%s", cli.User))
-	}
-	args = append(args, "configure")
-
-	args = append(args, hook.nvidiaContainerCliCUDACompatModeFlags()...)
-
-	if ldconfigPath := cli.NormalizeLDConfigPath(); ldconfigPath != "" {
-		args = append(args, fmt.Sprintf("--ldconfig=%s", ldconfigPath))
-	}
-	if cli.NoCgroups {
-		args = append(args, "--no-cgroups")
-	}
-	if devicesString := strings.Join(nvidia.Devices, ","); len(devicesString) > 0 {
-		args = append(args, fmt.Sprintf("--device=%s", devicesString))
-	}
-	if len(nvidia.MigConfigDevices) > 0 {
-		args = append(args, fmt.Sprintf("--mig-config=%s", nvidia.MigConfigDevices))
-	}
-	if len(nvidia.MigMonitorDevices) > 0 {
-		args = append(args, fmt.Sprintf("--mig-monitor=%s", nvidia.MigMonitorDevices))
-	}
-	if imexString := strings.Join(nvidia.ImexChannels, ","); len(imexString) > 0 {
-		args = append(args, fmt.Sprintf("--imex-channel=%s", imexString))
-	}
-
-	for _, cap := range strings.Split(nvidia.DriverCapabilities, ",") {
-		if len(cap) == 0 {
-			break
-		}
-		args = append(args, capabilityToCLI(cap))
-	}
-
-	for _, req := range nvidia.Requirements {
-		args = append(args, fmt.Sprintf("--require=%s", req))
-	}
-
-	args = append(args, fmt.Sprintf("--pid=%s", strconv.FormatUint(uint64(container.Pid), 10)))
-	args = append(args, rootfs)
-
-	env := append(os.Environ(), cli.Environment...)
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection?
-	err = syscall.Exec(args[0], args, env)
-	log.Panicln("exec failed:", err)
-}
-
-func usage() {
-	fmt.Fprintf(os.Stderr, "Usage of %s:\n", os.Args[0])
-	flag.PrintDefaults()
-	fmt.Fprintf(os.Stderr, "\nCommands:\n")
-	fmt.Fprintf(os.Stderr, "  prestart\n        run the prestart hook\n")
-	fmt.Fprintf(os.Stderr, "  poststart\n        no-op\n")
-	fmt.Fprintf(os.Stderr, "  poststop\n        no-op\n")
-}
-
-func main() {
-	flag.Usage = usage
-	flag.Parse()
-
-	if *versionflag {
-		fmt.Printf("%v version %v\n", "NVIDIA Container Runtime Hook", info.GetVersionString())
-		return
-	}
-
-	args := flag.Args()
-	if len(args) == 0 {
-		flag.Usage()
-		os.Exit(2)
-	}
-
-	switch args[0] {
-	case "prestart":
-		doPrestart()
-		os.Exit(0)
-	case "poststart":
-		fallthrough
-	case "poststop":
-		os.Exit(0)
-	default:
-		flag.Usage()
-		os.Exit(2)
-	}
-}
-
-// logInterceptor implements the logger.Interface to allow for logging from executable.
-type logInterceptor struct {
-	logger.NullLogger
-}
-
-func (l *logInterceptor) Infof(format string, args ...interface{}) {
-	log.Printf(format, args...)
-}

cmd/nvidia-container-runtime.experimental/README.md

@@ -0,0 +1,170 @@
+# The Experimental NVIDIA Container Runtime
+
+## Introduction
+
+The experimental NVIDIA Container Runtime is a proof-of-concept runtime that
+approaches the problem of making GPUs (or other NVIDIA devices) available in
+containerized environments in a different manner to the existing
+[NVIDIA Container Runtime](../nvidia-container-runtime). Wherease the current
+runtime relies on the [NVIDIA Container Library](https://github.com/NVIDIA/libnvidia-container)
+to perform the modifications to a container, the experiemental runtime aims to
+express the required modifications in terms of changes to a container's [OCI
+runtime specification](https://github.com/opencontainers/runtime-spec). This
+also aligns with open initiatives such as the [Container Device Interface (CDI)](https://github.com/container-orchestrated-devices/container-device-interface).
+
+## Known Limitations
+
+* The path of NVIDIA CUDA libraries / binaries injected into the container currently match that of the host system. This means that on an Ubuntu-based host systems these would be at `/usr/lib/x86_64-linux-gnu`
+even if the container distribution would normally expect these at another location (e.g. `/usr/lib64`)
+* Tools such as `nvidia-smi` may create additional device nodes in the container when run. This is
+prevented in the "classic" runtime (and the NVIDIA Container Library) by modifying
+the `/proc/driver/nvidia/params` file in the container.
+* Other `NVIDIA_*` environment variables (e.g. `NVIDIA_DRIVER_CAPABILITIES`) are
+not considered to filter mounted libraries or binaries. This is equivalent to
+always using `NVIDIA_DRIVER_CAPABILITIES=all`.
+
+## Building / Installing
+
+The experimental NVIDIA Container Runtime is a self-contained golang binary and
+can thus be built from source, or installed directly using `go install`.
+
+### From source
+
+After cloning the `nvidia-container-toolkit` repository from [GitLab](https://gitlab.com/nvidia/container-toolkit/container-toolkit)
+or from the read-only mirror on [GitHub](https://github.com/NVIDIA/nvidia-container-toolkit)
+running the following make command in the repository root:
+```bash
+make cmd-nvidia-container-runtime.experimental
+```
+will create an executable file `nvidia-container-runtime.experimental` in the
+root.
+
+A dockerized target:
+```bash
+make docker-cmd-nvidia-container-runtime.experimental
+```
+will also create the executable file `nvidia-container-runtime.experimental`
+without requiring the setup of a development environment (with the exception)
+of having `make` and `docker` installed.
+
+### Go install
+
+The experimental NVIDIA Container Runtime can also be `go installed` by running
+the following command:
+
+```bash
+go install github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-container-runtime.experimental@experimental
+```
+which will build and install the `nvidia-container-runtime.experimental`
+executable in the `${GOPATH}/bin` folder.
+
+## Using the Runtime
+
+The experimental NVIDIA Container Runtime is intended as a drop-in replacement
+for the "classic" NVIDIA Container Runtime. As such it is used in the same
+way (with the exception of the known limitiations noted above).
+
+In general terms, to use the experimental NVIDIA Container Runtime to launch a
+container with GPU support, it should be inserted as a shim for the desired
+low-level OCI-compliant runtime (e.g. `runc` or `crun`). How this is achieved
+depends on how containers are being launched.
+
+### Docker
+In the case of `docker` for example, the runtime must be registered with the
+Docker daemon. This can be done by modifying the `/etc/docker/daemon.json` file
+to contain the following:
+```json
+{
+    "runtimes": {
+        "nvidia-experimental": {
+                "path": "nvidia-container-runtime.experimental",
+                "runtimeArgs": []
+        }
+    },
+}
+```
+This can then be invoked from docker by including the `--runtime=nvidia-experimental`
+option when executing a `docker run` command.
+
+### Runc
+
+If `runc` is being used to run a container directly substituting the `runc`
+command for `nvidia-container-runtime.experimental` should be sufficient as
+the latter will `exec` to `runc` once the required (in-place) modifications have
+been made to the container's OCI spec (`config.json` file).
+
+## Configuration
+
+### Runtime Path
+The experimental NVIDIA Container Runtime allows for the path to the low-level
+runtime to be specified. This is done by setting the following option in the
+`/etc/nvidia-container-runtime/config.toml` file or setting the
+`NVIDIA_CONTAINER_RUNTIME_PATH` environment variable.
+
+```toml
+[nvidia-container-runtime.experimental]
+
+runtime-path = "/path/to/low-level-runtime"
+```
+This path can be set to the path for `runc` or `crun` on a system and if it is
+a relative path, the `PATH` is searched for a matching executable.
+
+### Device Selection
+In order to select a specific device, the experimental NVIDIA Container Runtime
+mimics the behaviour of the "classic" runtime. That is to say that the values of
+certain [environment variables](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/user-guide.html#environment-variables-oci-spec)
+**in the container's OCI specification** control the behaviour of the runtime.
+
+#### `NVIDIA_VISIBLE_DEVICES`
+This variable controls which GPUs will be made accessible inside the container.
+
+##### Possible values
+* `0,1,2`, `GPU-fef8089b` …: a comma-separated list of GPU UUID(s) or index(es).
+* `all`: all GPUs will be accessible, this is the default value in our container images.
+* `none`: no GPU will be accessible, but driver capabilities will be enabled.
+* `void` or *empty* or *unset*: `nvidia-container-runtime` will have the same behavior as `runc`.
+
+**Note**: When running on a MIG capable device, the following values will also be available:
+* `0:0,0:1,1:0`, `MIG-GPU-fef8089b/0/1` …: a comma-separated list of MIG Device UUID(s) or index(es).
+
+Where the MIG device indices have the form `<GPU Device Index>:<MIG Device Index>` as seen in the example output:
+```
+$ nvidia-smi -L
+GPU 0: Graphics Device (UUID: GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5)
+  MIG Device 0: (UUID: MIG-GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5/1/0)
+  MIG Device 1: (UUID: MIG-GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5/1/1)
+  MIG Device 2: (UUID: MIG-GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5/11/0)
+```
+
+#### `NVIDIA_MIG_CONFIG_DEVICES`
+This variable controls which of the visible GPUs can have their MIG
+configuration managed from within the container. This includes enabling and
+disabling MIG mode, creating and destroying GPU Instances and Compute
+Instances, etc.
+
+##### Possible values
+* `all`: Allow all MIG-capable GPUs in the visible device list to have their
+  MIG configurations managed.
+
+**Note**:
+* This feature is only available on MIG capable devices (e.g. the A100).
+* To use this feature, the container must be started with `CAP_SYS_ADMIN` privileges.
+* When not running as `root`, the container user must have read access to the
+  `/proc/driver/nvidia/capabilities/mig/config` file on the host.
+
+#### `NVIDIA_MIG_MONITOR_DEVICES`
+This variable controls which of the visible GPUs can have aggregate information
+about all of their MIG devices monitored from within the container. This
+includes inspecting the aggregate memory usage, listing the aggregate running
+processes, etc.
+
+##### Possible values
+* `all`: Allow all MIG-capable GPUs in the visible device list to have their
+  MIG devices monitored.
+
+**Note**:
+* This feature is only available on MIG capable devices (e.g. the A100).
+* To use this feature, the container must be started with `CAP_SYS_ADMIN` privileges.
+* When not running as `root`, the container user must have read access to the
+  `/proc/driver/nvidia/capabilities/mig/monitor` file on the host.
+

cmd/nvidia-container-runtime.experimental/config/composite.go

@@ -0,0 +1,52 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// list represents a list of config updaters that are applied in order, with later
+// configs having preference.
+type list struct {
+	logger  *log.Logger
+	configs []configUpdater
+}
+
+var _ configUpdater = (*list)(nil)
+
+func newListWithLogger(logger *log.Logger, ci ...configUpdater) configUpdater {
+	c := list{
+		logger:  logger,
+		configs: ci,
+	}
+	return &c
+}
+
+func (c list) Update(cfg *Config) error {
+	for i, u := range c.configs {
+		c.logger.Debugf("Applying config %v: %v", i, u)
+		err := u.Update(cfg)
+		if err != nil {
+			return fmt.Errorf("error applying config %v: %v", i, err)
+		}
+	}
+
+	return nil
+}

cmd/nvidia-container-runtime.experimental/config/composite_test.go

@@ -0,0 +1,100 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"testing"
+
+	testlog "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestComposite(t *testing.T) {
+	logger, _ := testlog.NewNullLogger()
+
+	// Empty list
+	c := newListWithLogger(logger)
+
+	cfg := &Config{}
+	err := c.Update(cfg)
+
+	require.NoError(t, err)
+	require.EqualValues(t, &Config{}, cfg)
+
+	// Add a single mock config
+	mockConfigUpdater := &configUpdaterMock{
+		UpdateFunc: func(cfg *Config) error {
+			cfg.DebugFilePath = "updated"
+			return nil
+		},
+	}
+
+	c = newListWithLogger(logger, mockConfigUpdater)
+	cfg = &Config{}
+	err = c.Update(cfg)
+	require.NoError(t, err)
+	require.EqualValues(t, &Config{DebugFilePath: "updated"}, cfg)
+
+	require.Len(t, mockConfigUpdater.UpdateCalls(), 1)
+
+	// Reset the calls
+	mockConfigUpdater.calls = struct{ Update []struct{ Config *Config } }{}
+
+	// define an error config
+	errorConfigUpdater := &configUpdaterMock{
+		UpdateFunc: func(cfg *Config) error {
+			return fmt.Errorf("mock error")
+		},
+	}
+
+	c = newListWithLogger(logger, errorConfigUpdater, mockConfigUpdater)
+	cfg = &Config{}
+	err = c.Update(cfg)
+	require.Error(t, err)
+	require.EqualValues(t, &Config{}, cfg)
+
+	require.Len(t, errorConfigUpdater.UpdateCalls(), 1)
+	require.Len(t, mockConfigUpdater.UpdateCalls(), 0)
+
+	// Reset the calls
+	mockConfigUpdater.calls = struct{ Update []struct{ Config *Config } }{}
+	errorConfigUpdater.calls = struct{ Update []struct{ Config *Config } }{}
+
+	// Change the order of the config and error
+	c = newListWithLogger(logger, mockConfigUpdater, errorConfigUpdater)
+	cfg = &Config{}
+	err = c.Update(cfg)
+	require.Error(t, err)
+	require.EqualValues(t, &Config{DebugFilePath: "updated"}, cfg)
+
+	require.Len(t, errorConfigUpdater.UpdateCalls(), 1)
+	require.Len(t, mockConfigUpdater.UpdateCalls(), 1)
+
+	// Reset the calls
+	mockConfigUpdater.calls = struct{ Update []struct{ Config *Config } }{}
+	errorConfigUpdater.calls = struct{ Update []struct{ Config *Config } }{}
+
+	// Call the mock twice
+	c = newListWithLogger(logger, mockConfigUpdater, mockConfigUpdater)
+	cfg = &Config{}
+	err = c.Update(cfg)
+	require.NoError(t, err)
+	require.EqualValues(t, &Config{DebugFilePath: "updated"}, cfg)
+
+	require.Len(t, mockConfigUpdater.UpdateCalls(), 2)
+}

cmd/nvidia-container-runtime.experimental/config/config.go

@@ -0,0 +1,63 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// Config defines the configuration options for the NVIDIA Container Runtime
+type Config struct {
+	// Root defines the root of the file system to be used for locating mounts
+	Root string
+	// DebugFilePath defines a log file to print debug output to
+	DebugFilePath string
+	// RuntimePath defines the path to an OCI compliant runtime
+	RuntimePath string
+	// LogLevel defines the logging level for the application
+	LogLevel string
+}
+
+//go:generate moq -stub -out config_mock.go . configUpdater
+
+// configUpdate represents an interface for applying updates to a config.
+type configUpdater interface {
+	Update(*Config) error
+}
+
+// GetConfig returns a config struct with the values resolved. The values are defined in order of
+// priority:
+// 1. From the associated environment variables
+// 2. From the loaded config file
+// 3. From the default values defined in the `defaultConfig` function
+func GetConfig(logger *log.Logger) (*Config, error) {
+	cfg := &Config{}
+
+	configs := newListWithLogger(logger,
+		newDefaultConfig(),
+		newDefaultConfigFileWithLogger(logger),
+		newConfigFromEnvironment(),
+	)
+
+	err := configs.Update(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("error getting config: %v", err)
+	}
+	return cfg, nil
+}

cmd/nvidia-container-runtime.experimental/config/config_mock.go

@@ -0,0 +1,76 @@
+// Code generated by moq; DO NOT EDIT.
+// github.com/matryer/moq
+
+package config
+
+import (
+	"sync"
+)
+
+// Ensure, that configUpdaterMock does implement configUpdater.
+// If this is not the case, regenerate this file with moq.
+var _ configUpdater = &configUpdaterMock{}
+
+// configUpdaterMock is a mock implementation of configUpdater.
+//
+// 	func TestSomethingThatUsesconfigUpdater(t *testing.T) {
+//
+// 		// make and configure a mocked configUpdater
+// 		mockedconfigUpdater := &configUpdaterMock{
+// 			UpdateFunc: func(config *Config) error {
+// 				panic("mock out the Update method")
+// 			},
+// 		}
+//
+// 		// use mockedconfigUpdater in code that requires configUpdater
+// 		// and then make assertions.
+//
+// 	}
+type configUpdaterMock struct {
+	// UpdateFunc mocks the Update method.
+	UpdateFunc func(config *Config) error
+
+	// calls tracks calls to the methods.
+	calls struct {
+		// Update holds details about calls to the Update method.
+		Update []struct {
+			// Config is the config argument value.
+			Config *Config
+		}
+	}
+	lockUpdate sync.RWMutex
+}
+
+// Update calls UpdateFunc.
+func (mock *configUpdaterMock) Update(config *Config) error {
+	callInfo := struct {
+		Config *Config
+	}{
+		Config: config,
+	}
+	mock.lockUpdate.Lock()
+	mock.calls.Update = append(mock.calls.Update, callInfo)
+	mock.lockUpdate.Unlock()
+	if mock.UpdateFunc == nil {
+		var (
+			errOut error
+		)
+		return errOut
+	}
+	return mock.UpdateFunc(config)
+}
+
+// UpdateCalls gets all the calls that were made to Update.
+// Check the length with:
+//     len(mockedconfigUpdater.UpdateCalls())
+func (mock *configUpdaterMock) UpdateCalls() []struct {
+	Config *Config
+} {
+	var calls []struct {
+		Config *Config
+	}
+	mock.lockUpdate.RLock()
+	calls = mock.calls.Update
+	mock.lockUpdate.RUnlock()
+	return calls
+}

cmd/nvidia-container-runtime.experimental/config/config_test.go

@@ -0,0 +1,58 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package config
+
+import (
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"testing"
+
+	testlog "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetConfigWithCustomConfig(t *testing.T) {
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+
+	// By default debug is disabled
+	contents := []byte("[nvidia-container-runtime]\ndebug = \"/nvidia-container-toolkit.log\"")
+	testDir := path.Join(wd, "test")
+	filename := path.Join(testDir, configFileRelativePath)
+
+	previousConfig, present := os.LookupEnv(configOverride)
+	os.Setenv(configOverride, testDir)
+	defer func() {
+		if present {
+			os.Setenv(configOverride, previousConfig)
+		} else {
+			os.Unsetenv(configOverride)
+		}
+	}()
+
+	require.NoError(t, os.MkdirAll(filepath.Dir(filename), 0766))
+	require.NoError(t, ioutil.WriteFile(filename, contents, 0766))
+
+	defer func() { require.NoError(t, os.RemoveAll(testDir)) }()
+
+	logger, _ := testlog.NewNullLogger()
+	cfg, err := GetConfig(logger)
+	require.NoError(t, err)
+	require.Equal(t, "/nvidia-container-toolkit.log", cfg.DebugFilePath)
+}

cmd/nvidia-container-runtime.experimental/config/default.go

@@ -14,33 +14,34 @@
 # limitations under the License.
 */
 
-package lookup
+package config
 
 import (
-	"fmt"
-	"os"
+	log "github.com/sirupsen/logrus"
 )
 
-// NewDirectoryLocator creates a Locator that can be used to find directories at the specified root.
-func NewDirectoryLocator(opts ...Option) Locator {
-	return NewFileLocator(
-		append(
-			opts,
-			WithFilter(assertDirectory),
-		)...,
-	)
+type defaultConfig struct{}
+
+var _ configUpdater = (*defaultConfig)(nil)
+
+func newDefaultConfig() configUpdater {
+	c := defaultConfig{}
+	return &c
 }
 
-// assertDirectory checks wither the specified path is a directory.
-func assertDirectory(filename string) error {
-	info, err := os.Stat(filename)
-	if err != nil {
-		return fmt.Errorf("error getting info for %v: %v", filename, err)
+// Update defines the the default values for the config options
+func (c defaultConfig) Update(cfg *Config) error {
+	*cfg = Config{
+		DebugFilePath: "/dev/null",
+		LogLevel:      log.InfoLevel.String(),
 	}
-
-	if !info.IsDir() {
-		return fmt.Errorf("specified path '%v' is not a directory", filename)
-	}
-
 	return nil
 }
+
+func getDefaultConfig() *Config {
+	cfg := &Config{}
+
+	defaultConfig{}.Update(cfg)
+
+	return cfg
+}

cmd/nvidia-container-runtime.experimental/config/default_test.go

@@ -1,5 +1,5 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,25 +12,26 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-**/
+*/
 
-package runtime
+package config
 
 import (
 	"testing"
 
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 )
 
-func TestLogger(t *testing.T) {
-	l := NewLogger()
+func TestDefaultConfigUpdate(t *testing.T) {
+	cfg := &Config{}
 
-	l.Update("", "debug", nil)
+	require.Empty(t, cfg.DebugFilePath)
 
-	ll := l.Interface.(*logrus.Logger)
-	require.Equal(t, logrus.DebugLevel, ll.Level)
+	c := defaultConfig{}
 
-	lp := l.previousLogger.(*logrus.Logger)
-	require.Equal(t, logrus.InfoLevel, lp.Level)
+	err := c.Update(cfg)
+
+	require.NoError(t, err)
+	require.Equal(t, "/dev/null", cfg.DebugFilePath)
+	require.Equal(t, "", cfg.Root)
 }

cmd/nvidia-container-runtime.experimental/config/environment.go

@@ -0,0 +1,61 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package config
+
+import (
+	"os"
+	"strings"
+)
+
+const (
+	debugFilePathEnvvarName = "NVIDIA_CONTAINER_RUNTIME_DEBUG"
+	runtimePathEnvvarName   = "NVIDIA_CONTAINER_RUNTIME_PATH"
+	rootEnvvarName          = "NVIDIA_CONTAINER_RUNTIME_ROOT"
+	logLevelEnvvarName      = "NVIDIA_CONTAINER_RUNTIME_LOG_LEVEL"
+)
+
+type envConfig struct{}
+
+func newConfigFromEnvironment() configUpdater {
+	c := envConfig{}
+
+	return &c
+}
+
+func (c envConfig) Update(cfg *Config) error {
+	debugFilePathEnvvar, exists := os.LookupEnv(debugFilePathEnvvarName)
+	if exists && strings.TrimSpace(debugFilePathEnvvar) != "" {
+		cfg.DebugFilePath = debugFilePathEnvvar
+	}
+
+	runtimePathEnvvar, exists := os.LookupEnv(runtimePathEnvvarName)
+	if exists && strings.TrimSpace(runtimePathEnvvar) != "" {
+		cfg.RuntimePath = runtimePathEnvvar
+	}
+
+	rootEnvvar, exists := os.LookupEnv(rootEnvvarName)
+	if exists && strings.TrimSpace(rootEnvvar) != "" {
+		cfg.Root = rootEnvvar
+	}
+
+	logLevelEnvvar, exists := os.LookupEnv(logLevelEnvvarName)
+	if exists && strings.TrimSpace(logLevelEnvvar) != "" {
+		cfg.LogLevel = logLevelEnvvar
+	}
+
+	return nil
+}

cmd/nvidia-container-runtime.experimental/config/noop.go

@@ -1,5 +1,5 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,11 +12,18 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-**/
+*/
 
 package config
 
-// CTKConfig stores the config options for the NVIDIA Container Toolkit CLI (nvidia-ctk)
-type CTKConfig struct {
-	Path string `toml:"path"`
+// noop implements a configUpdater that does not update a config.
+type noop struct{}
+
+func newNoopConfigUpdater() configUpdater {
+	c := noop{}
+	return &c
+}
+
+func (c noop) Update(cfg *Config) error {
+	return nil
 }

cmd/nvidia-container-runtime.experimental/config/noop_test.go

@@ -1,5 +1,5 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,21 +12,25 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-**/
+*/
 
-package edits
+package config
 
 import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/discover"
 )
 
-func TestFromDiscovererAllowsMountsToIterate(t *testing.T) {
-	edits, err := FromDiscoverer(discover.None{})
-	require.NoError(t, err)
+func TestNoopDoesNotModifyConfig(t *testing.T) {
+	cfg := &Config{
+		DebugFilePath: "test-path",
+	}
 
-	require.Empty(t, edits.Mounts)
+	c := newNoopConfigUpdater()
+
+	err := c.Update(cfg)
+
+	require.NoError(t, err)
+	require.Equal(t, "test-path", cfg.DebugFilePath)
 }

cmd/nvidia-container-runtime.experimental/config/toml.go

@@ -0,0 +1,158 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/pelletier/go-toml"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	configFileRelativePath = "nvidia-container-runtime/config.toml"
+	configOverride         = "XDG_CONFIG_HOME"
+	defaultConfigRoot      = "/etc"
+
+	nvidiaContainerCliSection                       = "nvidia-container-cli"
+	nvidiaContainerRuntimeConfigSection             = "nvidia-container-runtime"
+	nvidiaContainerRuntimeExperimentalConfigSection = "nvidia-container-runtime.experimental"
+)
+
+type tomlConfig struct {
+	logger   *log.Logger
+	path     string
+	sections []tomlSection
+}
+
+type tomlSection struct {
+	section string
+	keys    map[string]struct{}
+}
+
+func newDefaultConfigFileWithLogger(logger *log.Logger) configUpdater {
+	configDir := defaultConfigRoot
+	if XDGConfigDir := os.Getenv(configOverride); len(XDGConfigDir) != 0 {
+		configDir = XDGConfigDir
+	}
+	configFilePath := filepath.Join(configDir, configFileRelativePath)
+
+	return newConfigFromFileWithLogger(logger, configFilePath)
+}
+
+func newConfigFromFileWithLogger(logger *log.Logger, filepath string) configUpdater {
+	if _, err := os.Stat(filepath); os.IsNotExist(err) {
+		logger.Warnf("The config file '%v' does not exist", filepath)
+		return newNoopConfigUpdater()
+	}
+
+	sections := []tomlSection{
+		{
+			section: nvidiaContainerRuntimeConfigSection,
+		},
+		{
+			section: nvidiaContainerRuntimeExperimentalConfigSection,
+		},
+		{
+			section: nvidiaContainerCliSection,
+			keys: map[string]struct{}{
+				"root": {},
+			},
+		},
+	}
+
+	c := tomlConfig{
+		logger:   logger,
+		path:     filepath,
+		sections: sections,
+	}
+
+	return &c
+}
+
+func (c tomlConfig) Update(cfg *Config) error {
+	configFile, err := os.Open(c.path)
+	if err != nil {
+		return fmt.Errorf("error opening config file %v: %v", c.path, err)
+	}
+	defer configFile.Close()
+
+	return c.updateFromReader(cfg, configFile)
+}
+
+func (c tomlConfig) updateFromReader(cfg *Config, reader io.Reader) error {
+	toml, err := toml.LoadReader(reader)
+	if err != nil {
+		return fmt.Errorf("error reading TOML contents: %v", err)
+	}
+
+	for _, section := range c.sections {
+		if v, ok := section.GetStringFrom(toml, "debug"); ok {
+			cfg.DebugFilePath = v
+		}
+
+		if v, ok := section.GetStringFrom(toml, "runtime-path"); ok {
+			cfg.RuntimePath = v
+		}
+
+		if v, ok := section.GetStringFrom(toml, "root"); ok {
+			cfg.Root = v
+		}
+
+		if v, ok := section.GetStringFrom(toml, "log-level"); ok {
+			cfg.LogLevel = v
+		}
+	}
+	return nil
+}
+
+func (c tomlSection) GetStringFrom(toml *toml.Tree, key string) (string, bool) {
+	value := c.GetFrom(toml, key)
+	if value != nil {
+		if v, ok := value.(string); ok {
+			return v, ok
+		}
+	}
+	return "", false
+}
+
+func (c tomlSection) GetFrom(toml *toml.Tree, key string) interface{} {
+	if !c.validKey(key) {
+		return nil
+	}
+	return toml.Get(c.configKey(key))
+}
+
+func (c tomlSection) validKey(key string) bool {
+	if c.keys == nil {
+		return true
+	}
+
+	_, exists := c.keys[key]
+
+	return exists
+}
+
+func (c tomlSection) configKey(key string) string {
+	if c.section == "" {
+		return key
+	}
+	return c.section + "." + key
+}

cmd/nvidia-container-runtime.experimental/config/toml_test.go

@@ -0,0 +1,259 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/iotest"
+
+	testlog "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateFromReader(t *testing.T) {
+	logger, _ := testlog.NewNullLogger()
+
+	testCases := []struct {
+		description   string
+		readerError   bool
+		lines         []string
+		expected      *Config
+		expectedError bool
+	}{
+		{
+			description:   "reader error returns error",
+			readerError:   true,
+			expectedError: true,
+			expected:      getDefaultConfig(),
+		},
+		{
+			description: "empty config returns defaults",
+			lines:       []string{},
+			expected: &Config{
+				DebugFilePath: "/dev/null",
+				LogLevel:      "info",
+			},
+		},
+		{
+			description: "debug output is set",
+			lines:       []string{"nvidia-container-runtime.debug=\"nvidia-container-toolkit.log\""},
+			expected: &Config{
+				DebugFilePath: "nvidia-container-toolkit.log",
+				LogLevel:      "info",
+			},
+		},
+		{
+			description: "debug output is set in section",
+			lines:       []string{"[nvidia-container-runtime]", "debug=\"nvidia-container-toolkit.log\""},
+			expected: &Config{
+				DebugFilePath: "nvidia-container-toolkit.log",
+				LogLevel:      "info",
+			},
+		},
+		{
+			description: "blank debug is set",
+			lines:       []string{"nvidia-container-runtime.debug=\"\""},
+			expected: &Config{
+				DebugFilePath: "",
+				LogLevel:      "info",
+			},
+		},
+		{
+			description: "non-string debug is ignored",
+			lines:       []string{"nvidia-container-runtime.debug=2"},
+			expected: &Config{
+				DebugFilePath: "/dev/null",
+				LogLevel:      "info",
+			},
+		},
+		{
+			description: "log-level is set",
+			lines:       []string{"nvidia-container-runtime.log-level=\"trace\""},
+			expected: &Config{
+				DebugFilePath: "/dev/null",
+				LogLevel:      "trace",
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.description, func(t *testing.T) {
+			cfg := getDefaultConfig()
+
+			c := tomlConfig{
+				logger: logger,
+				sections: []tomlSection{
+					{section: nvidiaContainerRuntimeConfigSection},
+				},
+			}
+			var reader io.Reader
+			if tc.readerError {
+				reader = iotest.ErrReader(fmt.Errorf("error"))
+			} else {
+				reader = strings.NewReader(strings.Join(tc.lines, "\n"))
+			}
+
+			err := c.updateFromReader(cfg, reader)
+
+			if tc.expectedError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.EqualValues(t, tc.expected, cfg)
+		})
+	}
+}
+
+func TestUpdateFromReaderExperimental(t *testing.T) {
+	logger, _ := testlog.NewNullLogger()
+
+	testCases := []struct {
+		readerError   bool
+		lines         []string
+		expected      *Config
+		expectedError bool
+	}{
+		{
+			lines:    []string{"nvidia-container-runtime.debug=\"nvidia-container-toolkit.log\""},
+			expected: getDefaultConfig(),
+		},
+		{
+			lines:    []string{"[nvidia-container-runtime]", "debug=\"nvidia-container-toolkit.log\""},
+			expected: getDefaultConfig(),
+		},
+		{
+			lines: []string{"nvidia-container-runtime.experimental.debug=\"\""},
+			expected: &Config{
+				DebugFilePath: "",
+				LogLevel:      "info",
+			},
+		},
+		{
+			lines:    []string{"nvidia-container-runtime.experimental.debug=2"},
+			expected: getDefaultConfig(),
+		},
+		{
+			lines: []string{"nvidia-container-runtime.experimental.debug=\"nvidia-container-toolkit.log\""},
+			expected: &Config{
+				DebugFilePath: "nvidia-container-toolkit.log",
+				LogLevel:      "info",
+			},
+		},
+		{
+			lines: []string{"[nvidia-container-runtime.experimental]", "debug=\"nvidia-container-toolkit.log\""},
+			expected: &Config{
+				DebugFilePath: "nvidia-container-toolkit.log",
+				LogLevel:      "info",
+			},
+		},
+		{
+			lines: []string{
+				"nvidia-container-runtime.debug=\"nvidia-container-toolkit.log\"",
+				"nvidia-container-runtime.experimental.debug=\"nvidia-container-exp-toolkit.log\"",
+			},
+			expected: &Config{
+				DebugFilePath: "nvidia-container-exp-toolkit.log",
+				LogLevel:      "info",
+			},
+		},
+	}
+
+	for i, tc := range testCases {
+		cfg := getDefaultConfig()
+
+		c := tomlConfig{
+			logger: logger,
+			sections: []tomlSection{
+				{section: nvidiaContainerRuntimeExperimentalConfigSection},
+			},
+		}
+		var reader io.Reader
+		if tc.readerError {
+			reader = iotest.ErrReader(fmt.Errorf("error"))
+		} else {
+			reader = strings.NewReader(strings.Join(tc.lines, "\n"))
+		}
+
+		err := c.updateFromReader(cfg, reader)
+
+		if tc.expectedError {
+			require.Error(t, err, "%d: %v", i, tc)
+		} else {
+			require.NoError(t, err, "%d: %v", i, tc)
+		}
+		require.EqualValues(t, tc.expected, cfg, "%d: %v", i, tc)
+	}
+}
+
+func TestConfigFromFile(t *testing.T) {
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+
+	// By default debug is disabled
+	lines := []string{
+		"[nvidia-container-cli]",
+		"root = \"/run/nvidia/driver\"",
+		"[nvidia-container-runtime]",
+		"#debug = \"/nvidia-container-toolkit.log\"",
+		"",
+		"[nvidia-container-runtime.experimental]",
+		"debug = \"/nvidia-container-toolkit.experimental.log\"",
+	}
+
+	contents := []byte(strings.Join(lines, "\n"))
+	testDir := path.Join(wd, "test")
+	filename := path.Join(testDir, configFileRelativePath)
+
+	require.NoError(t, os.MkdirAll(filepath.Dir(filename), 0766))
+	require.NoError(t, ioutil.WriteFile(filename, contents, 0766))
+	defer func() { require.NoError(t, os.RemoveAll(testDir)) }()
+
+	logger, _ := testlog.NewNullLogger()
+	c := newConfigFromFileWithLogger(logger, filename)
+
+	cfg := getDefaultConfig()
+
+	err = c.Update(cfg)
+
+	require.NoError(t, err)
+	require.Equal(t, "/nvidia-container-toolkit.experimental.log", cfg.DebugFilePath)
+
+	require.Equal(t, "/run/nvidia/driver", cfg.Root)
+}
+
+func TestConfigFromNonexistentFileReturnsNoop(t *testing.T) {
+	logger, _ := testlog.NewNullLogger()
+	c := newConfigFromFileWithLogger(logger, "/does/not/exist")
+
+	n, ok := c.(*noop)
+
+	require.True(t, ok)
+	require.NotNil(t, n)
+}
+
+func TestGetConfigKey(t *testing.T) {
+	require.Equal(t, "key", tomlSection{}.configKey("key"))
+	require.Equal(t, "section.key", tomlSection{section: "section"}.configKey("key"))
+}

cmd/nvidia-container-runtime.experimental/main.go

@@ -0,0 +1,144 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/discover"
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/ensure"
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/filter"
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/modify"
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/runtime"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-container-runtime.experimental/config"
+)
+
+const (
+	visibleDevicesEnvvar = "NVIDIA_VISIBLE_DEVICES"
+	visibleDevicesVoid   = "void"
+)
+
+var logger = log.New()
+
+func main() {
+	cfg, err := config.GetConfig(logger)
+	if err != nil {
+		logger.Errorf("Error loading config: %v", err)
+		os.Exit(1)
+	}
+
+	if cfg.DebugFilePath != "" && cfg.DebugFilePath != "/dev/null" {
+		logFile, err := os.OpenFile(cfg.DebugFilePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+		if err != nil {
+			logger.Errorf("Error opening debug log file: %v", err)
+			os.Exit(1)
+		}
+		defer logFile.Close()
+
+		logger.SetOutput(logFile)
+	}
+
+	logLevel, err := log.ParseLevel(cfg.LogLevel)
+	if err == nil {
+		logger.SetLevel(logLevel)
+	} else {
+		logger.Warnf("Invalid log-level '%v'; using '%v'", cfg.LogLevel, logger.Level.String())
+	}
+
+	logger.Infof("Starting nvidia-container-runtime: %v", os.Args)
+	logger.Debugf("Using config=%+v", cfg)
+
+	if err := run(cfg, os.Args); err != nil {
+		logger.Errorf("Error running runtime: %v", err)
+		os.Exit(1)
+	}
+}
+
+func run(cfg *config.Config, args []string) error {
+	logger.Debugf("running with args=%v", args)
+
+	// We create a low-level runtime
+	lowLevelRuntime, err := createLowLevelRuntime(logger, cfg)
+	if err != nil {
+		return fmt.Errorf("error constructing low-level runtime: %v", err)
+	}
+
+	if !oci.HasCreateSubcommand(args) {
+		logger.Infof("No modification of OCI specification required")
+		logger.Infof("Forwarding command to runtime")
+		return lowLevelRuntime.Exec(args)
+	}
+
+	// We create the OCI spec that is to be modified
+	ociSpec, bundleDir, err := oci.NewSpecFromArgs(args)
+	if err != nil {
+		return fmt.Errorf("error constructing OCI spec: %v", err)
+	}
+
+	err = ociSpec.Load()
+	if err != nil {
+		return fmt.Errorf("error loading OCI specification: %v", err)
+	}
+
+	visibleDevices, exists := ociSpec.LookupEnv(visibleDevicesEnvvar)
+	if !exists || visibleDevices == "" || visibleDevices == visibleDevicesVoid {
+		logger.Infof("Using low-level runtime: %v=%v (exists=%v)", visibleDevicesEnvvar, visibleDevices, exists)
+		return lowLevelRuntime.Exec(os.Args)
+	}
+
+	// We create the modifier that will be applied by the Modifying Runtime Wrapper
+	modifier, err := createModifier(cfg.Root, bundleDir, visibleDevices, ociSpec)
+	if err != nil {
+		return fmt.Errorf("error constructing modifer: %v", err)
+	}
+
+	// We construct the Modifying runtime
+	r := runtime.NewModifyingRuntimeWrapperWithLogger(logger, lowLevelRuntime, ociSpec, modifier)
+
+	return r.Exec(os.Args)
+}
+
+func createLowLevelRuntime(logger *log.Logger, cfg *config.Config) (oci.Runtime, error) {
+	if cfg.RuntimePath == "" {
+		return oci.NewLowLevelRuntimeWithLogger(logger, "docker-runc", "runc")
+	}
+	logger.Infof("Creating runtime with path %v", cfg.RuntimePath)
+	return oci.NewRuntimeForPathWithLogger(logger, cfg.RuntimePath)
+}
+
+func createModifier(root string, bundleDir string, visibleDevices string, env filter.EnvLookup) (modify.Modifier, error) {
+	// We set up the modifier using discovery
+	discovered, err := discover.NewNVMLServerWithLogger(logger, root)
+	if err != nil {
+		return nil, fmt.Errorf("error discovering devices: %v", err)
+	}
+
+	// We apply a filter to the discovered devices
+	selected := filter.NewSelectDevicesFromWithLogger(logger, discovered, visibleDevices, env)
+
+	// We ensure that the selected devices are available
+	available := ensure.NewEnsureDevicesWithLogger(logger, selected, root)
+
+	// We construct the modifer for the OCI spec
+	modifier := modify.NewModifierWithLoggerFor(logger, available, root, bundleDir)
+
+	return modifier, nil
+}

cmd/nvidia-container-runtime/README.md

@@ -1,210 +0,0 @@
-# The NVIDIA Container Runtime
-
-The NVIDIA Container Runtime is a shim for OCI-compliant low-level runtimes such as [runc](https://github.com/opencontainers/runc). When a `create` command is detected, the incoming [OCI runtime specification](https://github.com/opencontainers/runtime-spec) is modified in place and the command is forwarded to the low-level runtime.
-
-## Configuration
-
-The NVIDIA Container Runtime uses file-based configuration, with the config stored in `/etc/nvidia-container-runtime/config.toml`. The `/etc` path can be overridden using the `XDG_CONFIG_HOME` environment variable with the `${XDG_CONFIG_HOME}/nvidia-container-runtime/config.toml` file used instead if this environment variable is set.
-
-This config file may contain options for other components of the NVIDIA container stack and for the NVIDIA Container Runtime, the relevant config section is `nvidia-container-runtime`
-
-### Logging
-
-The `log-level` config option (default: `"info"`) specifies the log level to use and the `debug` option, if set, specifies a log file to which logs for the NVIDIA Container Runtime must be written.
-
-In addition to this, the NVIDIA Container Runtime considers the value of `--log` and `--log-format` flags that may be passed to it by a container runtime such as docker or containerd. If the `--debug` flag is present the log-level specified in the config file is overridden as `"debug"`.
-
-### Low-level Runtime Path
-
-The `runtimes` config option allows for the low-level runtime to be specified. The first entry in this list that is an existing executable file is used as the low-level runtime. If the entry is not a path, the `PATH` is searched for a matching executable. If the entry is a path this is checked instead.
-
-The default value for this setting is:
-```toml
-runtimes = [
-    "docker-runc",
-    "runc",
-]
-```
-
-and if, for example, `crun` is to be used instead this can be changed to:
-```toml
-runtimes = [
-    "crun",
-]
-```
-
-### Runtime Mode
-
-The `mode` config option (default `"auto"`) controls the high-level behaviour of the runtime.
-
-#### Auto Mode
-
-When `mode` is set to `"auto"`, the runtime employs heuristics to determine which mode to use based on, for example, the platform where the runtime is being run.
-
-#### Legacy Mode
-
-When `mode` is set to `"legacy"`, the NVIDIA Container Runtime adds a [`prestart` hook](https://github.com/opencontainers/runtime-spec/blob/master/config.md#prestart) to the incomming OCI specification that invokes the NVIDIA Container Runtime Hook for all containers created. This hook checks whether NVIDIA devices are requested and ensures GPU access is configured using the `nvidia-container-cli` from the [libnvidia-container](https://github.com/NVIDIA/libnvidia-container) project.
-
-#### CSV Mode
-
-When `mode` is set to `"csv"`, CSV files at `/etc/nvidia-container-runtime/host-files-for-container.d` define the devices and mounts that are to be injected into a container when it is created. The search path for the files can be overridden by modifying the `nvidia-container-runtime.modes.csv.mount-spec-path` in the config as below:
-
-```toml
-[nvidia-container-runtime]
-    [nvidia-container-runtime.modes.csv]
-    mount-spec-path = "/etc/nvidia-container-runtime/host-files-for-container.d"
-```
-
-This mode is primarily targeted at Tegra-based systems without NVML available.
-
-### Notes on using the docker CLI
-
-Note that only the `"legacy"` NVIDIA Container Runtime mode is directly compatible with the `--gpus` flag implemented by the `docker` CLI (assuming the NVIDIA Container Runtime is not used). The reason for this is that `docker` inserts the same NVIDIA Container Runtime Hook into the OCI runtime specification.
-
-
-If a different mode is explicitly set or detected, the NVIDIA Container Runtime Hook will raise the following error when `--gpus` is set:
-```
-$ docker run --rm --gpus all ubuntu:18.04
-docker: Error response from daemon: failed to create shim: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:545: container init caused: Running hook #0:: error running hook: exit status 1, stdout: , stderr: Auto-detected mode as 'csv'
-invoking the NVIDIA Container Runtime Hook directly (e.g. specifying the docker --gpus flag) is not supported. Please use the NVIDIA Container Runtime instead.: unknown.
-```
-Here NVIDIA Container Runtime must be used explicitly. The recommended way to do this is to specify the `--runtime=nvidia` command line argument as part of the `docker run` commmand as follows:
-```
-$ docker run --rm --gpus all --runtime=nvidia ubuntu:18.04
-```
-
-Alternatively the NVIDIA Container Runtime can be set as the default runtime for docker. This can be done by modifying the `/etc/docker/daemon.json` file as follows:
-```json
-{
-    "default-runtime": "nvidia",
-    "runtimes": {
-        "nvidia": {
-            "path": "nvidia-container-runtime",
-            "runtimeArgs": []
-        }
-    }
-}
-```
-
-## Environment variables (OCI spec)
-
-Each environment variable maps to an command-line argument for `nvidia-container-cli` from [libnvidia-container](https://github.com/NVIDIA/libnvidia-container).
-These variables are already set in our [official CUDA images](https://hub.docker.com/r/nvidia/cuda/).
-
-### `NVIDIA_VISIBLE_DEVICES`
-This variable controls which GPUs will be made accessible inside the container.
-
-#### Possible values
-* `0,1,2`, `GPU-fef8089b` …: a comma-separated list of GPU UUID(s) or index(es).
-* `all`: all GPUs will be accessible, this is the default value in our container images.
-* `none`: no GPU will be accessible, but driver capabilities will be enabled.
-* `void` or *empty* or *unset*: `nvidia-container-runtime` will have the same behavior as `runc`.
-
-**Note**: When running on a MIG capable device, the following values will also be available:
-* `0:0,0:1,1:0`, `MIG-GPU-fef8089b/0/1` …: a comma-separated list of MIG Device UUID(s) or index(es).
-
-Where the MIG device indices have the form `<GPU Device Index>:<MIG Device Index>` as seen in the example output:
-```
-$ nvidia-smi -L
-GPU 0: Graphics Device (UUID: GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5)
-  MIG Device 0: (UUID: MIG-GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5/1/0)
-  MIG Device 1: (UUID: MIG-GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5/1/1)
-  MIG Device 2: (UUID: MIG-GPU-b8ea3855-276c-c9cb-b366-c6fa655957c5/11/0)
-```
-
-### `NVIDIA_MIG_CONFIG_DEVICES`
-This variable controls which of the visible GPUs can have their MIG
-configuration managed from within the container. This includes enabling and
-disabling MIG mode, creating and destroying GPU Instances and Compute
-Instances, etc.
-
-#### Possible values
-* `all`: Allow all MIG-capable GPUs in the visible device list to have their
-  MIG configurations managed.
-
-**Note**:
-* This feature is only available on MIG capable devices (e.g. the A100).
-* To use this feature, the container must be started with `CAP_SYS_ADMIN` privileges.
-* When not running as `root`, the container user must have read access to the
-  `/proc/driver/nvidia/capabilities/mig/config` file on the host.
-
-### `NVIDIA_MIG_MONITOR_DEVICES`
-This variable controls which of the visible GPUs can have aggregate information
-about all of their MIG devices monitored from within the container. This
-includes inspecting the aggregate memory usage, listing the aggregate running
-processes, etc.
-
-#### Possible values
-* `all`: Allow all MIG-capable GPUs in the visible device list to have their
-  MIG devices monitored.
-
-**Note**:
-* This feature is only available on MIG capable devices (e.g. the A100).
-* To use this feature, the container must be started with `CAP_SYS_ADMIN` privileges.
-* When not running as `root`, the container user must have read access to the
-  `/proc/driver/nvidia/capabilities/mig/monitor` file on the host.
-
-### `NVIDIA_DRIVER_CAPABILITIES`
-This option controls which driver libraries/binaries will be mounted inside the container.
-
-#### Possible values
-* `compute,video`, `graphics,utility` …: a comma-separated list of driver features the container needs.
-* `all`: enable all available driver capabilities.
-* *empty* or *unset*: use default driver capability: `utility,compute`.
-
-#### Supported driver capabilities
-* `compute`: required for CUDA and OpenCL applications.
-* `compat32`: required for running 32-bit applications.
-* `graphics`: required for running OpenGL and Vulkan applications.
-* `utility`: required for using `nvidia-smi` and NVML.
-* `video`: required for using the Video Codec SDK.
-* `display`: required for leveraging X11 display.
-
-### `NVIDIA_REQUIRE_*`
-A logical expression to define constraints on the configurations supported by the container.
-
-#### Supported constraints
-* `cuda`: constraint on the CUDA driver version.
-* `driver`: constraint on the driver version.
-* `arch`: constraint on the compute architectures of the selected GPUs.
-* `brand`: constraint on the brand of the selected GPUs (e.g. GeForce, Tesla, GRID).
-
-#### Expressions
-Multiple constraints can be expressed in a single environment variable: space-separated constraints are ORed, comma-separated constraints are ANDed.
-Multiple environment variables of the form `NVIDIA_REQUIRE_*` are ANDed together.
-
-### `NVIDIA_DISABLE_REQUIRE`
-Single switch to disable all the constraints of the form `NVIDIA_REQUIRE_*`.
-
-### `NVIDIA_REQUIRE_CUDA`
-
-The version of the CUDA toolkit used by the container. It is an instance of the generic `NVIDIA_REQUIRE_*` case and it is set by official CUDA images.
-If the version of the NVIDIA driver is insufficient to run this version of CUDA, the container will not be started.
-
-#### Possible values
-* `cuda>=7.5`, `cuda>=8.0`, `cuda>=9.0` …: any valid CUDA version in the form `major.minor`.
-
-### `CUDA_VERSION`
-Similar to `NVIDIA_REQUIRE_CUDA`, for legacy CUDA images.
-In addition, if `NVIDIA_REQUIRE_CUDA` is not set, `NVIDIA_VISIBLE_DEVICES` and `NVIDIA_DRIVER_CAPABILITIES` will default to `all`.
-
-## Usage example
-
-**NOTE:** The use of the `nvidia-container-runtime` as CLI replacement for `runc` is uncommon and is only provided for completeness.
-
-Although the `nvidia-container-runtime` is typically configured as a replacement for `runc` or `crun` in various container engines, it can also be
-invoked from the command line as `runc` would. For example:
-
-```sh
-# Setup a rootfs based on Ubuntu 16.04
-cd $(mktemp -d) && mkdir rootfs
-curl -sS http://cdimage.ubuntu.com/ubuntu-base/releases/16.04/release/ubuntu-base-16.04.6-base-amd64.tar.gz | tar --exclude 'dev/*' -C rootfs -xz
-
-# Create an OCI runtime spec
-nvidia-container-runtime spec
-sed -i 's;"sh";"nvidia-smi";' config.json
-sed -i 's;\("TERM=xterm"\);\1, "NVIDIA_VISIBLE_DEVICES=0";' config.json
-
-# Run the container
-sudo nvidia-container-runtime run nvidia_smi
-```

cmd/nvidia-container-runtime/logger.go

@@ -0,0 +1,79 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/sirupsen/logrus"
+	"github.com/tsaikd/KDGoLib/logrusutil"
+)
+
+// Logger adds a way to manage output to a log file to a logrus.Logger
+type Logger struct {
+	*logrus.Logger
+	previousOutput io.Writer
+	logFile        *os.File
+}
+
+// NewLogger constructs a Logger with a preddefined formatter
+func NewLogger() *Logger {
+	logrusLogger := logrus.New()
+
+	formatter := &logrusutil.ConsoleLogFormatter{
+		TimestampFormat: "2006/01/02 15:04:07",
+		Flag:            logrusutil.Ltime,
+	}
+
+	logger := &Logger{
+		Logger: logrusLogger,
+	}
+	logger.SetFormatter(formatter)
+
+	return logger
+}
+
+// LogToFile opens the specified file for appending and sets the logger to
+// output to the opened file. A reference to the file pointer is stored to
+// allow this to be closed.
+func (l *Logger) LogToFile(filename string) error {
+	logFile, err := os.OpenFile(filename, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+	if err != nil {
+		return fmt.Errorf("error opening debug log file: %v", err)
+	}
+
+	l.logFile = logFile
+	l.previousOutput = l.Out
+	l.SetOutput(logFile)
+
+	return nil
+}
+
+// CloseFile closes the log file (if any) and resets the logger output to what it
+// was before LogToFile was called.
+func (l *Logger) CloseFile() error {
+	if l.logFile == nil {
+		return nil
+	}
+	logFile := l.logFile
+	l.SetOutput(l.previousOutput)
+	l.logFile = nil
+
+	return logFile.Close()
+}

cmd/nvidia-container-runtime/main.go

@@ -1,15 +1,89 @@
 package main
 
 import (
+	"fmt"
 	"os"
+	"path"
 
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/runtime"
+	"github.com/pelletier/go-toml"
 )
 
+const (
+	configOverride = "XDG_CONFIG_HOME"
+	configFilePath = "nvidia-container-runtime/config.toml"
+
+	hookDefaultFilePath = "/usr/bin/nvidia-container-runtime-hook"
+)
+
+var (
+	configDir = "/etc/"
+)
+
+var logger = NewLogger()
+
 func main() {
-	r := runtime.New()
-	err := r.Run(os.Args)
+	err := run(os.Args)
 	if err != nil {
+		logger.Errorf("Error running %v: %v", os.Args, err)
 		os.Exit(1)
 	}
 }
+
+// run is an entry point that allows for idiomatic handling of errors
+// when calling from the main function.
+func run(argv []string) (err error) {
+	cfg, err := getConfig()
+	if err != nil {
+		return fmt.Errorf("error loading config: %v", err)
+	}
+
+	err = logger.LogToFile(cfg.debugFilePath)
+	if err != nil {
+		return fmt.Errorf("error opening debug log file: %v", err)
+	}
+	defer func() {
+		// We capture and log a returning error before closing the log file.
+		if err != nil {
+			logger.Errorf("Error running %v: %v", argv, err)
+		}
+		logger.CloseFile()
+	}()
+
+	r, err := newRuntime(argv)
+	if err != nil {
+		return fmt.Errorf("error creating runtime: %v", err)
+	}
+
+	logger.Printf("Running %s\n", argv[0])
+	return r.Exec(argv)
+}
+
+type config struct {
+	debugFilePath string
+}
+
+// getConfig sets up the config struct. Values are read from a toml file
+// or set via the environment.
+func getConfig() (*config, error) {
+	cfg := &config{}
+
+	if XDGConfigDir := os.Getenv(configOverride); len(XDGConfigDir) != 0 {
+		configDir = XDGConfigDir
+	}
+
+	configFilePath := path.Join(configDir, configFilePath)
+
+	tomlContent, err := os.ReadFile(configFilePath)
+	if err != nil {
+		return nil, err
+	}
+
+	toml, err := toml.Load(string(tomlContent))
+	if err != nil {
+		return nil, err
+	}
+
+	cfg.debugFilePath = toml.GetDefault("nvidia-container-runtime.debug", "/dev/null").(string)
+
+	return cfg, nil
+}

cmd/nvidia-container-runtime/main_test.go

@@ -3,32 +3,25 @@ package main
 import (
 	"bytes"
 	"encoding/json"
-	"io"
-	"log"
+	"fmt"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
-	testlog "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/require"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/modifier"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/test"
 )
 
 const (
 	nvidiaRuntime            = "nvidia-container-runtime"
 	nvidiaHook               = "nvidia-container-runtime-hook"
-	bundlePathSuffix         = "tests/output/bundle/"
+	bundlePathSuffix         = "test/output/bundle/"
 	specFile                 = "config.json"
-	unmodifiedSpecFileSuffix = "tests/input/test_spec.json"
-)
-
-const (
-	runcExecutableName = "runc"
+	unmodifiedSpecFileSuffix = "test/input/test_spec.json"
 )
 
 type testConfig struct {
@@ -42,25 +35,25 @@ func TestMain(m *testing.M) {
 	// TEST SETUP
 	// Determine the module root and the test binary path
 	var err error
-	moduleRoot, err := test.GetModuleRoot()
+	moduleRoot, err := getModuleRoot()
 	if err != nil {
-		log.Fatalf("error in test setup: could not get module root: %v", err)
+		logger.Fatalf("error in test setup: could not get module root: %v", err)
 	}
-	testBinPath := filepath.Join(moduleRoot, "tests", "bin")
-	testInputPath := filepath.Join(moduleRoot, "tests", "input")
+	testBinPath := filepath.Join(moduleRoot, "test", "bin")
+	testInputPath := filepath.Join(moduleRoot, "test", "input")
 
 	// Set the environment variables for the test
-	os.Setenv("PATH", test.PrependToPath(testBinPath, moduleRoot))
+	os.Setenv("PATH", prependToPath(testBinPath, moduleRoot))
 	os.Setenv("XDG_CONFIG_HOME", testInputPath)
 
 	// Confirm that the environment is configured correctly
 	runcPath, err := exec.LookPath(runcExecutableName)
 	if err != nil || filepath.Join(testBinPath, runcExecutableName) != runcPath {
-		log.Fatalf("error in test setup: mock runc path set incorrectly in TestMain(): %v", err)
+		logger.Fatalf("error in test setup: mock runc path set incorrectly in TestMain(): %v", err)
 	}
 	hookPath, err := exec.LookPath(nvidiaHook)
 	if err != nil || filepath.Join(testBinPath, nvidiaHook) != hookPath {
-		log.Fatalf("error in test setup: mock hook path set incorrectly in TestMain(): %v", err)
+		logger.Fatalf("error in test setup: mock hook path set incorrectly in TestMain(): %v", err)
 	}
 
 	// Store the root and binary paths in the test Config
@@ -78,16 +71,45 @@ func TestMain(m *testing.M) {
 	os.Exit(exitCode)
 }
 
+func getModuleRoot() (string, error) {
+	_, filename, _, _ := runtime.Caller(0)
+
+	return hasGoMod(filename)
+}
+
+func hasGoMod(dir string) (string, error) {
+	if dir == "" || dir == "/" {
+		return "", fmt.Errorf("module root not found")
+	}
+
+	_, err := os.Stat(filepath.Join(dir, "go.mod"))
+	if err != nil {
+		return hasGoMod(filepath.Dir(dir))
+	}
+	return dir, nil
+}
+
+func prependToPath(additionalPaths ...string) string {
+	paths := strings.Split(os.Getenv("PATH"), ":")
+	paths = append(additionalPaths, paths...)
+
+	return strings.Join(paths, ":")
+}
+
 // case 1) nvidia-container-runtime run --bundle
 // case 2) nvidia-container-runtime create --bundle
-//   - Confirm the runtime handles bad input correctly
+//		- Confirm the runtime handles bad input correctly
 func TestBadInput(t *testing.T) {
 	err := cfg.generateNewRuntimeSpec()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
+	cmdRun := exec.Command(nvidiaRuntime, "run", "--bundle")
+	t.Logf("executing: %s\n", strings.Join(cmdRun.Args, " "))
+	output, err := cmdRun.CombinedOutput()
+	require.Errorf(t, err, "runtime should return an error", "output=%v", string(output))
+
 	cmdCreate := exec.Command(nvidiaRuntime, "create", "--bundle")
 	t.Logf("executing: %s\n", strings.Join(cmdCreate.Args, " "))
 	err = cmdCreate.Run()
@@ -95,17 +117,15 @@ func TestBadInput(t *testing.T) {
 }
 
 // case 1) nvidia-container-runtime run --bundle <bundle-name> <ctr-name>
-//   - Confirm the runtime runs with no errors
-//
+//		- Confirm the runtime runs with no errors
 // case 2) nvidia-container-runtime create --bundle <bundle-name> <ctr-name>
-//   - Confirm the runtime inserts the NVIDIA prestart hook correctly
+//		- Confirm the runtime inserts the NVIDIA prestart hook correctly
 func TestGoodInput(t *testing.T) {
 	err := cfg.generateNewRuntimeSpec()
 	if err != nil {
 		t.Fatalf("error generating runtime spec: %v", err)
 	}
 
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
 	cmdRun := exec.Command(nvidiaRuntime, "run", "--bundle", cfg.bundlePath(), "testcontainer")
 	t.Logf("executing: %s\n", strings.Join(cmdRun.Args, " "))
 	output, err := cmdRun.CombinedOutput()
@@ -116,7 +136,6 @@ func TestGoodInput(t *testing.T) {
 	require.NoError(t, err, "should be no errors when reading and parsing spec from config.json")
 	require.Empty(t, spec.Hooks, "there should be no hooks in config.json")
 
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
 	cmdCreate := exec.Command(nvidiaRuntime, "create", "--bundle", cfg.bundlePath(), "testcontainer")
 	t.Logf("executing: %s\n", strings.Join(cmdCreate.Args, " "))
 	err = cmdCreate.Run()
@@ -162,7 +181,6 @@ func TestDuplicateHook(t *testing.T) {
 	}
 
 	// Test how runtime handles already existing prestart hook in config.json
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
 	cmdCreate := exec.Command(nvidiaRuntime, "create", "--bundle", cfg.bundlePath(), "testcontainer")
 	t.Logf("executing: %s\n", strings.Join(cmdCreate.Args, " "))
 	output, err := cmdCreate.CombinedOutput()
@@ -175,12 +193,11 @@ func TestDuplicateHook(t *testing.T) {
 	require.Equal(t, 1, nvidiaHookCount(spec.Hooks), "exactly one nvidia prestart hook should be inserted correctly into config.json")
 }
 
-// addNVIDIAHook is a basic wrapper for an addHookModifier that is used for
+// addNVIDIAHook is a basic wrapper for nvidiaContainerRunime.addNVIDIAHook that is used for
 // testing.
 func addNVIDIAHook(spec *specs.Spec) error {
-	logger, _ := testlog.NewNullLogger()
-	m := modifier.NewStableRuntimeModifier(logger, nvidiaHook)
-	return m.Modify(spec)
+	r := nvidiaContainerRuntime{logger: logger.Logger}
+	return r.addNVIDIAHook(spec)
 }
 
 func (c testConfig) getRuntimeSpec() (specs.Spec, error) {
@@ -193,16 +210,15 @@ func (c testConfig) getRuntimeSpec() (specs.Spec, error) {
 	}
 	defer jsonFile.Close()
 
-	jsonContent, err := io.ReadAll(jsonFile)
-	switch {
-	case err != nil:
+	jsonContent, err := ioutil.ReadAll(jsonFile)
+	if err != nil {
 		return spec, err
-	case json.Valid(jsonContent):
+	} else if json.Valid(jsonContent) {
 		err = json.Unmarshal(jsonContent, &spec)
 		if err != nil {
 			return spec, err
 		}
-	default:
+	} else {
 		err = json.NewDecoder(bytes.NewReader(jsonContent)).Decode(&spec)
 		if err != nil {
 			return spec, err
@@ -232,7 +248,6 @@ func (c testConfig) generateNewRuntimeSpec() error {
 		return err
 	}
 
-	//nolint:gosec // TODO: Can we harden this so that there is less risk of command injection
 	cmd := exec.Command("cp", c.unmodifiedSpecFile(), c.specFilePath())
 	err = cmd.Run()
 	if err != nil {
@@ -255,3 +270,24 @@ func nvidiaHookCount(hooks *specs.Hooks) int {
 	}
 	return count
 }
+
+func TestGetConfigWithCustomConfig(t *testing.T) {
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+
+	// By default debug is disabled
+	contents := []byte("[nvidia-container-runtime]\ndebug = \"/nvidia-container-toolkit.log\"")
+	testDir := filepath.Join(wd, "test")
+	filename := filepath.Join(testDir, configFilePath)
+
+	os.Setenv(configOverride, testDir)
+
+	require.NoError(t, os.MkdirAll(filepath.Dir(filename), 0766))
+	require.NoError(t, ioutil.WriteFile(filename, contents, 0766))
+
+	defer func() { require.NoError(t, os.RemoveAll(testDir)) }()
+
+	cfg, err := getConfig()
+	require.NoError(t, err)
+	require.Equal(t, cfg.debugFilePath, "/nvidia-container-toolkit.log")
+}

cmd/nvidia-container-runtime/nvcr.go

@@ -0,0 +1,132 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
+	"github.com/opencontainers/runtime-spec/specs-go"
+	log "github.com/sirupsen/logrus"
+)
+
+// nvidiaContainerRuntime encapsulates the NVIDIA Container Runtime. It wraps the specified runtime, conditionally
+// modifying the specified OCI specification before invoking the runtime.
+type nvidiaContainerRuntime struct {
+	logger  *log.Logger
+	runtime oci.Runtime
+	ociSpec oci.Spec
+}
+
+var _ oci.Runtime = (*nvidiaContainerRuntime)(nil)
+
+// newNvidiaContainerRuntime is a constructor for a standard runtime shim.
+func newNvidiaContainerRuntimeWithLogger(logger *log.Logger, runtime oci.Runtime, ociSpec oci.Spec) (oci.Runtime, error) {
+	r := nvidiaContainerRuntime{
+		logger:  logger,
+		runtime: runtime,
+		ociSpec: ociSpec,
+	}
+
+	return &r, nil
+}
+
+// Exec defines the entrypoint for the NVIDIA Container Runtime. A check is performed to see whether modifications
+// to the OCI spec are required -- and applicable modifcations applied. The supplied arguments are then
+// forwarded to the underlying runtime's Exec method.
+func (r nvidiaContainerRuntime) Exec(args []string) error {
+	if r.modificationRequired(args) {
+		err := r.modifyOCISpec()
+		if err != nil {
+			return fmt.Errorf("error modifying OCI spec: %v", err)
+		}
+	}
+
+	r.logger.Println("Forwarding command to runtime")
+	return r.runtime.Exec(args)
+}
+
+// modificationRequired checks the intput arguments to determine whether a modification
+// to the OCI spec is required.
+func (r nvidiaContainerRuntime) modificationRequired(args []string) bool {
+	if oci.HasCreateSubcommand(args) {
+		r.logger.Infof("'create' command detected; modification required")
+		return true
+	}
+
+	r.logger.Infof("No modification required")
+	return false
+}
+
+// modifyOCISpec loads and modifies the OCI spec specified in the nvidiaContainerRuntime
+// struct. The spec is modified in-place and written to the same file as the input after
+// modifcationas are applied.
+func (r nvidiaContainerRuntime) modifyOCISpec() error {
+	err := r.ociSpec.Load()
+	if err != nil {
+		return fmt.Errorf("error loading OCI specification for modification: %v", err)
+	}
+
+	err = r.ociSpec.Modify(r.addNVIDIAHook)
+	if err != nil {
+		return fmt.Errorf("error injecting NVIDIA Container Runtime hook: %v", err)
+	}
+
+	err = r.ociSpec.Flush()
+	if err != nil {
+		return fmt.Errorf("error writing modified OCI specification: %v", err)
+	}
+	return nil
+}
+
+// addNVIDIAHook modifies the specified OCI specification in-place, inserting a
+// prestart hook.
+func (r nvidiaContainerRuntime) addNVIDIAHook(spec *specs.Spec) error {
+	path, err := exec.LookPath("nvidia-container-runtime-hook")
+	if err != nil {
+		path = hookDefaultFilePath
+		_, err = os.Stat(path)
+		if err != nil {
+			return err
+		}
+	}
+
+	r.logger.Printf("prestart hook path: %s\n", path)
+
+	args := []string{path}
+	if spec.Hooks == nil {
+		spec.Hooks = &specs.Hooks{}
+	} else if len(spec.Hooks.Prestart) != 0 {
+		for _, hook := range spec.Hooks.Prestart {
+			if !strings.Contains(hook.Path, "nvidia-container-runtime-hook") {
+				continue
+			}
+			r.logger.Println("existing nvidia prestart hook in OCI spec file")
+			return nil
+		}
+	}
+
+	spec.Hooks.Prestart = append(spec.Hooks.Prestart, specs.Hook{
+		Path: path,
+		Args: append(args, "prestart"),
+	})
+
+	return nil
+}

cmd/nvidia-container-runtime/nvcr_test.go

@@ -0,0 +1,203 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
+	"github.com/opencontainers/runtime-spec/specs-go"
+	testlog "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAddNvidiaHook(t *testing.T) {
+	logger, logHook := testlog.NewNullLogger()
+	shim := nvidiaContainerRuntime{
+		logger: logger,
+	}
+
+	testCases := []struct {
+		spec         *specs.Spec
+		errorPrefix  string
+		shouldNotAdd bool
+	}{
+		{
+			spec: &specs.Spec{},
+		},
+		{
+			spec: &specs.Spec{
+				Hooks: &specs.Hooks{},
+			},
+		},
+		{
+			spec: &specs.Spec{
+				Hooks: &specs.Hooks{
+					Prestart: []specs.Hook{{
+						Path: "some-hook",
+					}},
+				},
+			},
+		},
+		{
+			spec: &specs.Spec{
+				Hooks: &specs.Hooks{
+					Prestart: []specs.Hook{{
+						Path: "nvidia-container-runtime-hook",
+					}},
+				},
+			},
+			shouldNotAdd: true,
+		},
+	}
+
+	for i, tc := range testCases {
+		logHook.Reset()
+
+		var numPrestartHooks int
+		if tc.spec.Hooks != nil {
+			numPrestartHooks = len(tc.spec.Hooks.Prestart)
+		}
+
+		err := shim.addNVIDIAHook(tc.spec)
+
+		if tc.errorPrefix == "" {
+			require.NoErrorf(t, err, "%d: %v", i, tc)
+		} else {
+			require.Truef(t, strings.HasPrefix(err.Error(), tc.errorPrefix), "%d: %v", i, tc)
+
+			require.NotNilf(t, tc.spec.Hooks, "%d: %v", i, tc)
+			require.Equalf(t, 1, nvidiaHookCount(tc.spec.Hooks), "%d: %v", i, tc)
+
+			if tc.shouldNotAdd {
+				require.Equal(t, numPrestartHooks+1, len(tc.spec.Hooks.Poststart), "%d: %v", i, tc)
+			} else {
+				require.Equal(t, numPrestartHooks+1, len(tc.spec.Hooks.Poststart), "%d: %v", i, tc)
+
+				nvidiaHook := tc.spec.Hooks.Poststart[len(tc.spec.Hooks.Poststart)-1]
+
+				// TODO: This assumes that the hook has been set up in the makefile
+				expectedPath := "/usr/bin/nvidia-container-runtime-hook"
+				require.Equalf(t, expectedPath, nvidiaHook.Path, "%d: %v", i, tc)
+				require.Equalf(t, []string{expectedPath, "prestart"}, nvidiaHook.Args, "%d: %v", i, tc)
+				require.Emptyf(t, nvidiaHook.Env, "%d: %v", i, tc)
+				require.Nilf(t, nvidiaHook.Timeout, "%d: %v", i, tc)
+			}
+		}
+	}
+}
+
+func TestNvidiaContainerRuntime(t *testing.T) {
+	logger, hook := testlog.NewNullLogger()
+
+	testCases := []struct {
+		shim         nvidiaContainerRuntime
+		shouldModify bool
+		args         []string
+		modifyError  error
+		writeError   error
+	}{
+		{
+			shim:         nvidiaContainerRuntime{},
+			shouldModify: false,
+		},
+		{
+			shim:         nvidiaContainerRuntime{},
+			args:         []string{"create"},
+			shouldModify: true,
+		},
+		{
+			shim:         nvidiaContainerRuntime{},
+			args:         []string{"--bundle=create"},
+			shouldModify: false,
+		},
+		{
+			shim:         nvidiaContainerRuntime{},
+			args:         []string{"--bundle", "create"},
+			shouldModify: false,
+		},
+		{
+			shim:         nvidiaContainerRuntime{},
+			args:         []string{"create"},
+			shouldModify: true,
+		},
+		{
+			shim:         nvidiaContainerRuntime{},
+			args:         []string{"create"},
+			modifyError:  fmt.Errorf("error modifying"),
+			shouldModify: true,
+		},
+		{
+			shim:         nvidiaContainerRuntime{},
+			args:         []string{"create"},
+			writeError:   fmt.Errorf("error writing"),
+			shouldModify: true,
+		},
+	}
+
+	for i, tc := range testCases {
+		tc.shim.logger = logger
+		hook.Reset()
+
+		ociMock := &oci.SpecMock{
+			ModifyFunc: func(specModifier oci.SpecModifier) error {
+				return tc.modifyError
+			},
+			FlushFunc: func() error {
+				return tc.writeError
+			},
+		}
+		require.Equal(t, tc.shouldModify, tc.shim.modificationRequired(tc.args), "%d: %v", i, tc)
+
+		tc.shim.ociSpec = ociMock
+		tc.shim.runtime = &MockShim{}
+
+		err := tc.shim.Exec(tc.args)
+		if tc.modifyError != nil || tc.writeError != nil {
+			require.Error(t, err, "%d: %v", i, tc)
+		} else {
+			require.NoError(t, err, "%d: %v", i, tc)
+		}
+
+		if tc.shouldModify {
+			require.Equal(t, 1, len(ociMock.ModifyCalls()), "%d: %v", i, tc)
+		} else {
+			require.Equal(t, 0, len(ociMock.ModifyCalls()), "%d: %v", i, tc)
+		}
+
+		writeExpected := tc.shouldModify && tc.modifyError == nil
+		if writeExpected {
+			require.Equal(t, 1, len(ociMock.FlushCalls()), "%d: %v", i, tc)
+		} else {
+			require.Equal(t, 0, len(ociMock.FlushCalls()), "%d: %v", i, tc)
+		}
+	}
+}
+
+type MockShim struct {
+	called      bool
+	args        []string
+	returnError error
+}
+
+func (m *MockShim) Exec(args []string) error {
+	m.called = true
+	m.args = args
+	return m.returnError
+}

cmd/nvidia-container-runtime/runtime_factory.go

@@ -0,0 +1,74 @@
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
+)
+
+const (
+	ociSpecFileName          = "config.json"
+	dockerRuncExecutableName = "docker-runc"
+	runcExecutableName       = "runc"
+)
+
+// newRuntime is a factory method that constructs a runtime based on the selected configuration.
+func newRuntime(argv []string) (oci.Runtime, error) {
+	ociSpec, err := newOCISpec(argv)
+	if err != nil {
+		return nil, fmt.Errorf("error constructing OCI specification: %v", err)
+	}
+
+	runc, err := newRuncRuntime()
+	if err != nil {
+		return nil, fmt.Errorf("error constructing runc runtime: %v", err)
+	}
+
+	r, err := newNvidiaContainerRuntimeWithLogger(logger.Logger, runc, ociSpec)
+	if err != nil {
+		return nil, fmt.Errorf("error constructing NVIDIA Container Runtime: %v", err)
+	}
+
+	return r, nil
+}
+
+// newOCISpec constructs an OCI spec for the provided arguments
+func newOCISpec(argv []string) (oci.Spec, error) {
+	bundleDir, err := oci.GetBundleDir(argv)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing command line arguments: %v", err)
+	}
+	logger.Infof("Using bundle directory: %v", bundleDir)
+
+	ociSpecPath := oci.GetSpecFilePath(bundleDir)
+	logger.Infof("Using OCI specification file path: %v", ociSpecPath)
+
+	ociSpec := oci.NewSpecFromFile(ociSpecPath)
+
+	return ociSpec, nil
+}
+
+// newRuncRuntime locates the runc binary and wraps it in a SyscallExecRuntime
+func newRuncRuntime() (oci.Runtime, error) {
+	return oci.NewLowLevelRuntimeWithLogger(
+		logger.Logger,
+		dockerRuncExecutableName,
+		runcExecutableName,
+	)
+}

cmd/nvidia-container-runtime/runtime_factory_test.go

@@ -1,8 +1,5 @@
-//go:build tools
-// +build tools
-
-/**
-# Copyright 2024 NVIDIA CORPORATION
+/*
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,12 +12,19 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-**/
+*/
 
 package main
 
-// Define the tooling required to build the device plugin.
 import (
-	_ "github.com/golangci/golangci-lint/cmd/golangci-lint"
-	_ "github.com/matryer/moq"
+	"testing"
+
+	"github.com/stretchr/testify/require"
 )
+
+func TestConstructor(t *testing.T) {
+	shim, err := newRuntime([]string{})
+
+	require.NoError(t, err)
+	require.NotNil(t, shim)
+}

cmd/nvidia-container-toolkit/capabilities.go

@@ -0,0 +1,83 @@
+package main
+
+import (
+	"log"
+	"strings"
+)
+
+const (
+	allDriverCapabilities     = DriverCapabilities("compute,compat32,graphics,utility,video,display,ngx")
+	defaultDriverCapabilities = DriverCapabilities("utility,compute")
+
+	none = DriverCapabilities("")
+	all  = DriverCapabilities("all")
+)
+
+func capabilityToCLI(cap string) string {
+	switch cap {
+	case "compute":
+		return "--compute"
+	case "compat32":
+		return "--compat32"
+	case "graphics":
+		return "--graphics"
+	case "utility":
+		return "--utility"
+	case "video":
+		return "--video"
+	case "display":
+		return "--display"
+	case "ngx":
+		return "--ngx"
+	default:
+		log.Panicln("unknown driver capability:", cap)
+	}
+	return ""
+}
+
+// DriverCapabilities is used to process the NVIDIA_DRIVER_CAPABILITIES environment
+// variable. Operations include default values, filtering, and handling meta values such as "all"
+type DriverCapabilities string
+
+// Intersection returns intersection between two sets of capabilities.
+func (d DriverCapabilities) Intersection(capabilities DriverCapabilities) DriverCapabilities {
+	if capabilities == all {
+		return d
+	}
+	if d == all {
+		return capabilities
+	}
+
+	lookup := make(map[string]bool)
+	for _, c := range d.list() {
+		lookup[c] = true
+	}
+	var found []string
+	for _, c := range capabilities.list() {
+		if lookup[c] {
+			found = append(found, c)
+		}
+	}
+
+	intersection := DriverCapabilities(strings.Join(found, ","))
+	return intersection
+}
+
+// String returns the string representation of the driver capabilities
+func (d DriverCapabilities) String() string {
+	return string(d)
+}
+
+// list returns the driver capabilities as a list
+func (d DriverCapabilities) list() []string {
+	var caps []string
+	for _, c := range strings.Split(string(d), ",") {
+		trimmed := strings.TrimSpace(c)
+		if len(trimmed) == 0 {
+			continue
+		}
+		caps = append(caps, trimmed)
+	}
+
+	return caps
+}

cmd/nvidia-container-toolkit/capabilities_test.go

@@ -0,0 +1,134 @@
+/**
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+**/
+
+package main
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDriverCapabilitiesIntersection(t *testing.T) {
+	testCases := []struct {
+		capabilities          DriverCapabilities
+		supportedCapabilities DriverCapabilities
+		expectedIntersection  DriverCapabilities
+	}{
+		{
+			capabilities:          none,
+			supportedCapabilities: none,
+			expectedIntersection:  none,
+		},
+		{
+			capabilities:          all,
+			supportedCapabilities: none,
+			expectedIntersection:  none,
+		},
+		{
+			capabilities:          all,
+			supportedCapabilities: allDriverCapabilities,
+			expectedIntersection:  allDriverCapabilities,
+		},
+		{
+			capabilities:          allDriverCapabilities,
+			supportedCapabilities: all,
+			expectedIntersection:  allDriverCapabilities,
+		},
+		{
+			capabilities:          none,
+			supportedCapabilities: all,
+			expectedIntersection:  none,
+		},
+		{
+			capabilities:          none,
+			supportedCapabilities: DriverCapabilities("cap1"),
+			expectedIntersection:  none,
+		},
+		{
+			capabilities:          DriverCapabilities("cap0,cap1"),
+			supportedCapabilities: DriverCapabilities("cap1,cap0"),
+			expectedIntersection:  DriverCapabilities("cap0,cap1"),
+		},
+		{
+			capabilities:          defaultDriverCapabilities,
+			supportedCapabilities: allDriverCapabilities,
+			expectedIntersection:  defaultDriverCapabilities,
+		},
+		{
+			capabilities:          DriverCapabilities("compute,compat32,graphics,utility,video,display"),
+			supportedCapabilities: DriverCapabilities("compute,compat32,graphics,utility,video,display,ngx"),
+			expectedIntersection:  DriverCapabilities("compute,compat32,graphics,utility,video,display"),
+		},
+		{
+			capabilities:          DriverCapabilities("cap1"),
+			supportedCapabilities: none,
+			expectedIntersection:  none,
+		},
+		{
+			capabilities:          DriverCapabilities("compute,compat32,graphics,utility,video,display,ngx"),
+			supportedCapabilities: DriverCapabilities("compute,compat32,graphics,utility,video,display"),
+			expectedIntersection:  DriverCapabilities("compute,compat32,graphics,utility,video,display"),
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("test case %d", i), func(t *testing.T) {
+			intersection := tc.supportedCapabilities.Intersection(tc.capabilities)
+			require.EqualValues(t, tc.expectedIntersection, intersection)
+		})
+	}
+}
+
+func TestDriverCapabilitiesList(t *testing.T) {
+	testCases := []struct {
+		capabilities DriverCapabilities
+		expected     []string
+	}{
+		{
+			capabilities: DriverCapabilities(""),
+		},
+		{
+			capabilities: DriverCapabilities("  "),
+		},
+		{
+			capabilities: DriverCapabilities(","),
+		},
+		{
+			capabilities: DriverCapabilities(",cap"),
+			expected:     []string{"cap"},
+		},
+		{
+			capabilities: DriverCapabilities("cap,"),
+			expected:     []string{"cap"},
+		},
+		{
+			capabilities: DriverCapabilities("cap0,,cap1"),
+			expected:     []string{"cap0", "cap1"},
+		},
+		{
+			capabilities: DriverCapabilities("cap1,cap0,cap3"),
+			expected:     []string{"cap1", "cap0", "cap3"},
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("test case %d", i), func(t *testing.T) {
+			require.EqualValues(t, tc.expected, tc.capabilities.list())
+		})
+	}
+}

cmd/nvidia-container-toolkit/container_config.go

@@ -0,0 +1,421 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"golang.org/x/mod/semver"
+)
+
+var envSwarmGPU *string
+
+const (
+	envCUDAVersion          = "CUDA_VERSION"
+	envNVRequirePrefix      = "NVIDIA_REQUIRE_"
+	envNVRequireCUDA        = envNVRequirePrefix + "CUDA"
+	envNVDisableRequire     = "NVIDIA_DISABLE_REQUIRE"
+	envNVVisibleDevices     = "NVIDIA_VISIBLE_DEVICES"
+	envNVMigConfigDevices   = "NVIDIA_MIG_CONFIG_DEVICES"
+	envNVMigMonitorDevices  = "NVIDIA_MIG_MONITOR_DEVICES"
+	envNVDriverCapabilities = "NVIDIA_DRIVER_CAPABILITIES"
+)
+
+const (
+	capSysAdmin = "CAP_SYS_ADMIN"
+)
+
+const (
+	deviceListAsVolumeMountsRoot = "/var/run/nvidia-container-devices"
+)
+
+type nvidiaConfig struct {
+	Devices            string
+	MigConfigDevices   string
+	MigMonitorDevices  string
+	DriverCapabilities string
+	Requirements       []string
+	DisableRequire     bool
+}
+
+type containerConfig struct {
+	Pid    int
+	Rootfs string
+	Env    map[string]string
+	Nvidia *nvidiaConfig
+}
+
+// Root from OCI runtime spec
+// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L94-L100
+type Root struct {
+	Path string `json:"path"`
+}
+
+// Process from OCI runtime spec
+// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L30-L57
+type Process struct {
+	Env          []string         `json:"env,omitempty"`
+	Capabilities *json.RawMessage `json:"capabilities,omitempty" platform:"linux"`
+}
+
+// LinuxCapabilities from OCI runtime spec
+// https://github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L61
+type LinuxCapabilities struct {
+	Bounding    []string `json:"bounding,omitempty" platform:"linux"`
+	Effective   []string `json:"effective,omitempty" platform:"linux"`
+	Inheritable []string `json:"inheritable,omitempty" platform:"linux"`
+	Permitted   []string `json:"permitted,omitempty" platform:"linux"`
+	Ambient     []string `json:"ambient,omitempty" platform:"linux"`
+}
+
+// Mount from OCI runtime spec
+// https://github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L103
+type Mount struct {
+	Destination string   `json:"destination"`
+	Type        string   `json:"type,omitempty" platform:"linux,solaris"`
+	Source      string   `json:"source,omitempty"`
+	Options     []string `json:"options,omitempty"`
+}
+
+// Spec from OCI runtime spec
+// We use pointers to structs, similarly to the latest version of runtime-spec:
+// https://github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L5-L28
+type Spec struct {
+	Version *string  `json:"ociVersion"`
+	Process *Process `json:"process,omitempty"`
+	Root    *Root    `json:"root,omitempty"`
+	Mounts  []Mount  `json:"mounts,omitempty"`
+}
+
+// HookState holds state information about the hook
+type HookState struct {
+	Pid int `json:"pid,omitempty"`
+	// After 17.06, runc is using the runtime spec:
+	// github.com/docker/runc/blob/17.06/libcontainer/configs/config.go#L262-L263
+	// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/state.go#L3-L17
+	Bundle string `json:"bundle"`
+	// Before 17.06, runc used a custom struct that didn't conform to the spec:
+	// github.com/docker/runc/blob/17.03.x/libcontainer/configs/config.go#L245-L252
+	BundlePath string `json:"bundlePath"`
+}
+
+func parseCudaVersion(cudaVersion string) (vmaj, vmin, vpatch uint32) {
+	if _, err := fmt.Sscanf(cudaVersion, "%d.%d.%d\n", &vmaj, &vmin, &vpatch); err != nil {
+		vpatch = 0
+		if _, err := fmt.Sscanf(cudaVersion, "%d.%d\n", &vmaj, &vmin); err != nil {
+			vmin = 0
+			if _, err := fmt.Sscanf(cudaVersion, "%d\n", &vmaj); err != nil {
+				log.Panicln("invalid CUDA version:", cudaVersion)
+			}
+		}
+	}
+
+	return
+}
+
+func getEnvMap(e []string) (m map[string]string) {
+	m = make(map[string]string)
+	for _, s := range e {
+		p := strings.SplitN(s, "=", 2)
+		if len(p) != 2 {
+			log.Panicln("environment error")
+		}
+		m[p[0]] = p[1]
+	}
+	return
+}
+
+func loadSpec(path string) (spec *Spec) {
+	f, err := os.Open(path)
+	if err != nil {
+		log.Panicln("could not open OCI spec:", err)
+	}
+	defer f.Close()
+
+	if err = json.NewDecoder(f).Decode(&spec); err != nil {
+		log.Panicln("could not decode OCI spec:", err)
+	}
+	if spec.Version == nil {
+		log.Panicln("Version is empty in OCI spec")
+	}
+	if spec.Process == nil {
+		log.Panicln("Process is empty in OCI spec")
+	}
+	if spec.Root == nil {
+		log.Panicln("Root is empty in OCI spec")
+	}
+	return
+}
+
+func isPrivileged(s *Spec) bool {
+	if s.Process.Capabilities == nil {
+		return false
+	}
+
+	var caps []string
+	// If v1.1.0-rc1 <= OCI version < v1.0.0-rc5 parse s.Process.Capabilities as:
+	// github.com/opencontainers/runtime-spec/blob/v1.0.0-rc1/specs-go/config.go#L30-L54
+	rc1cmp := semver.Compare("v"+*s.Version, "v1.0.0-rc1")
+	rc5cmp := semver.Compare("v"+*s.Version, "v1.0.0-rc5")
+	if (rc1cmp == 1 || rc1cmp == 0) && (rc5cmp == -1) {
+		err := json.Unmarshal(*s.Process.Capabilities, &caps)
+		if err != nil {
+			log.Panicln("could not decode Process.Capabilities in OCI spec:", err)
+		}
+		// Otherwise, parse s.Process.Capabilities as:
+		// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L30-L54
+	} else {
+		var lc LinuxCapabilities
+		err := json.Unmarshal(*s.Process.Capabilities, &lc)
+		if err != nil {
+			log.Panicln("could not decode Process.Capabilities in OCI spec:", err)
+		}
+		// We only make sure that the bounding capabibility set has
+		// CAP_SYS_ADMIN. This allows us to make sure that the container was
+		// actually started as '--privileged', but also allow non-root users to
+		// access the privileged NVIDIA capabilities.
+		caps = lc.Bounding
+	}
+
+	for _, c := range caps {
+		if c == capSysAdmin {
+			return true
+		}
+	}
+
+	return false
+}
+
+func isLegacyCUDAImage(env map[string]string) bool {
+	legacyCudaVersion := env[envCUDAVersion]
+	cudaRequire := env[envNVRequireCUDA]
+	return len(legacyCudaVersion) > 0 && len(cudaRequire) == 0
+}
+
+func getDevicesFromEnvvar(env map[string]string, legacyImage bool) *string {
+	// Build a list of envvars to consider.
+	envVars := []string{envNVVisibleDevices}
+	if envSwarmGPU != nil {
+		// The Swarm envvar has higher precedence.
+		envVars = append([]string{*envSwarmGPU}, envVars...)
+	}
+
+	// Grab a reference to devices from the first envvar
+	// in the list that actually exists in the environment.
+	var devices *string
+	for _, envVar := range envVars {
+		if devs, ok := env[envVar]; ok {
+			devices = &devs
+			break
+		}
+	}
+
+	// Environment variable unset with legacy image: default to "all".
+	if devices == nil && legacyImage {
+		all := "all"
+		return &all
+	}
+
+	// Environment variable unset or empty or "void": return nil
+	if devices == nil || len(*devices) == 0 || *devices == "void" {
+		return nil
+	}
+
+	// Environment variable set to "none": reset to "".
+	if *devices == "none" {
+		empty := ""
+		return &empty
+	}
+
+	// Any other value.
+	return devices
+}
+
+func getDevicesFromMounts(mounts []Mount) *string {
+	var devices []string
+	for _, m := range mounts {
+		root := filepath.Clean(deviceListAsVolumeMountsRoot)
+		source := filepath.Clean(m.Source)
+		destination := filepath.Clean(m.Destination)
+
+		// Only consider mounts who's host volume is /dev/null
+		if source != "/dev/null" {
+			continue
+		}
+		// Only consider container mount points that begin with 'root'
+		if len(destination) < len(root) {
+			continue
+		}
+		if destination[:len(root)] != root {
+			continue
+		}
+		// Grab the full path beyond 'root' and add it to the list of devices
+		device := destination[len(root):]
+		if len(device) > 0 && device[0] == '/' {
+			device = device[1:]
+		}
+		if len(device) == 0 {
+			continue
+		}
+		devices = append(devices, device)
+	}
+
+	if devices == nil {
+		return nil
+	}
+
+	ret := strings.Join(devices, ",")
+	return &ret
+}
+
+func getDevices(hookConfig *HookConfig, env map[string]string, mounts []Mount, privileged bool, legacyImage bool) *string {
+	// If enabled, try and get the device list from volume mounts first
+	if hookConfig.AcceptDeviceListAsVolumeMounts {
+		devices := getDevicesFromMounts(mounts)
+		if devices != nil {
+			return devices
+		}
+	}
+
+	// Fallback to reading from the environment variable if privileges are correct
+	devices := getDevicesFromEnvvar(env, legacyImage)
+	if devices == nil {
+		return nil
+	}
+	if privileged || hookConfig.AcceptEnvvarUnprivileged {
+		return devices
+	}
+
+	configName := hookConfig.getConfigOption("AcceptEnvvarUnprivileged")
+	log.Printf("Ignoring devices specified in NVIDIA_VISIBLE_DEVICES (privileged=%v, %v=%v) ", privileged, configName, hookConfig.AcceptEnvvarUnprivileged)
+
+	return nil
+}
+
+func getMigConfigDevices(env map[string]string) *string {
+	if devices, ok := env[envNVMigConfigDevices]; ok {
+		return &devices
+	}
+	return nil
+}
+
+func getMigMonitorDevices(env map[string]string) *string {
+	if devices, ok := env[envNVMigMonitorDevices]; ok {
+		return &devices
+	}
+	return nil
+}
+
+func getDriverCapabilities(env map[string]string, supportedDriverCapabilities DriverCapabilities, legacyImage bool) DriverCapabilities {
+	// We use the default driver capabilities by default. This is filtered to only include the
+	// supported capabilities
+	capabilities := supportedDriverCapabilities.Intersection(defaultDriverCapabilities)
+
+	capsEnv, capsEnvSpecified := env[envNVDriverCapabilities]
+
+	if !capsEnvSpecified && legacyImage {
+		// Environment variable unset with legacy image: set all capabilities.
+		return supportedDriverCapabilities
+	}
+
+	if capsEnvSpecified && len(capsEnv) > 0 {
+		// If the envvironment variable is specified and is non-empty, use the capabilities value
+		envCapabilities := DriverCapabilities(capsEnv)
+		capabilities = supportedDriverCapabilities.Intersection(envCapabilities)
+		if envCapabilities != all && capabilities != envCapabilities {
+			log.Panicln(fmt.Errorf("unsupported capabilities found in '%v' (allowed '%v')", envCapabilities, capabilities))
+		}
+	}
+
+	return capabilities
+}
+
+func getRequirements(env map[string]string, legacyImage bool) []string {
+	// All variables with the "NVIDIA_REQUIRE_" prefix are passed to nvidia-container-cli
+	var requirements []string
+	for name, value := range env {
+		if strings.HasPrefix(name, envNVRequirePrefix) {
+			requirements = append(requirements, value)
+		}
+	}
+	if legacyImage {
+		vmaj, vmin, _ := parseCudaVersion(env[envCUDAVersion])
+		cudaRequire := fmt.Sprintf("cuda>=%d.%d", vmaj, vmin)
+		requirements = append(requirements, cudaRequire)
+	}
+	return requirements
+}
+
+func getNvidiaConfig(hookConfig *HookConfig, env map[string]string, mounts []Mount, privileged bool) *nvidiaConfig {
+	legacyImage := isLegacyCUDAImage(env)
+
+	var devices string
+	if d := getDevices(hookConfig, env, mounts, privileged, legacyImage); d != nil {
+		devices = *d
+	} else {
+		// 'nil' devices means this is not a GPU container.
+		return nil
+	}
+
+	var migConfigDevices string
+	if d := getMigConfigDevices(env); d != nil {
+		migConfigDevices = *d
+	}
+	if !privileged && migConfigDevices != "" {
+		log.Panicln("cannot set MIG_CONFIG_DEVICES in non privileged container")
+	}
+
+	var migMonitorDevices string
+	if d := getMigMonitorDevices(env); d != nil {
+		migMonitorDevices = *d
+	}
+	if !privileged && migMonitorDevices != "" {
+		log.Panicln("cannot set MIG_MONITOR_DEVICES in non privileged container")
+	}
+
+	driverCapabilities := getDriverCapabilities(env, hookConfig.SupportedDriverCapabilities, legacyImage).String()
+
+	requirements := getRequirements(env, legacyImage)
+
+	// Don't fail on invalid values.
+	disableRequire, _ := strconv.ParseBool(env[envNVDisableRequire])
+
+	return &nvidiaConfig{
+		Devices:            devices,
+		MigConfigDevices:   migConfigDevices,
+		MigMonitorDevices:  migMonitorDevices,
+		DriverCapabilities: driverCapabilities,
+		Requirements:       requirements,
+		DisableRequire:     disableRequire,
+	}
+}
+
+func getContainerConfig(hook HookConfig) (config containerConfig) {
+	var h HookState
+	d := json.NewDecoder(os.Stdin)
+	if err := d.Decode(&h); err != nil {
+		log.Panicln("could not decode container state:", err)
+	}
+
+	b := h.Bundle
+	if len(b) == 0 {
+		b = h.BundlePath
+	}
+
+	s := loadSpec(path.Join(b, "config.json"))
+
+	env := getEnvMap(s.Process.Env)
+	privileged := isPrivileged(s)
+	envSwarmGPU = hook.SwarmResource
+	return containerConfig{
+		Pid:    h.Pid,
+		Rootfs: s.Root.Path,
+		Env:    env,
+		Nvidia: getNvidiaConfig(&hook, env, s.Mounts, privileged),
+	}
+}

cmd/nvidia-container-toolkit/container_config_test.go

@@ -0,0 +1,989 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetNvidiaConfig(t *testing.T) {
+	var tests = []struct {
+		description    string
+		env            map[string]string
+		privileged     bool
+		hookConfig     *HookConfig
+		expectedConfig *nvidiaConfig
+		expectedPanic  bool
+	}{
+		{
+			description:    "No environment, unprivileged",
+			env:            map[string]string{},
+			privileged:     false,
+			expectedConfig: nil,
+		},
+		{
+			description:    "No environment, privileged",
+			env:            map[string]string{},
+			privileged:     true,
+			expectedConfig: nil,
+		},
+		{
+			description: "Legacy image, no devices, no capabilities, no requirements",
+			env: map[string]string{
+				envCUDAVersion: "9.0",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				DriverCapabilities: allDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices 'all', no capabilities, no requirements",
+			env: map[string]string{
+				envCUDAVersion:      "9.0",
+				envNVVisibleDevices: "all",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				DriverCapabilities: allDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices 'empty', no capabilities, no requirements",
+			env: map[string]string{
+				envCUDAVersion:      "9.0",
+				envNVVisibleDevices: "",
+			},
+			privileged:     false,
+			expectedConfig: nil,
+		},
+		{
+			description: "Legacy image, devices 'void', no capabilities, no requirements",
+			env: map[string]string{
+				envCUDAVersion:      "9.0",
+				envNVVisibleDevices: "",
+			},
+			privileged:     false,
+			expectedConfig: nil,
+		},
+		{
+			description: "Legacy image, devices 'none', no capabilities, no requirements",
+			env: map[string]string{
+				envCUDAVersion:      "9.0",
+				envNVVisibleDevices: "none",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "",
+				DriverCapabilities: allDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices set, no capabilities, no requirements",
+			env: map[string]string{
+				envCUDAVersion:      "9.0",
+				envNVVisibleDevices: "gpu0,gpu1",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: allDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices set, capabilities 'empty', no requirements",
+			env: map[string]string{
+				envCUDAVersion:          "9.0",
+				envNVVisibleDevices:     "gpu0,gpu1",
+				envNVDriverCapabilities: "",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices set, capabilities 'all', no requirements",
+			env: map[string]string{
+				envCUDAVersion:          "9.0",
+				envNVVisibleDevices:     "gpu0,gpu1",
+				envNVDriverCapabilities: "all",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: allDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices set, capabilities set, no requirements",
+			env: map[string]string{
+				envCUDAVersion:          "9.0",
+				envNVVisibleDevices:     "gpu0,gpu1",
+				envNVDriverCapabilities: "video,display",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: "video,display",
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices set, capabilities set, requirements set",
+			env: map[string]string{
+				envCUDAVersion:              "9.0",
+				envNVVisibleDevices:         "gpu0,gpu1",
+				envNVDriverCapabilities:     "video,display",
+				envNVRequirePrefix + "REQ0": "req0=true",
+				envNVRequirePrefix + "REQ1": "req1=false",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: "video,display",
+				Requirements:       []string{"cuda>=9.0", "req0=true", "req1=false"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Legacy image, devices set, capabilities set, requirements set, disable requirements",
+			env: map[string]string{
+				envCUDAVersion:              "9.0",
+				envNVVisibleDevices:         "gpu0,gpu1",
+				envNVDriverCapabilities:     "video,display",
+				envNVRequirePrefix + "REQ0": "req0=true",
+				envNVRequirePrefix + "REQ1": "req1=false",
+				envNVDisableRequire:         "true",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: "video,display",
+				Requirements:       []string{"cuda>=9.0", "req0=true", "req1=false"},
+				DisableRequire:     true,
+			},
+		},
+		{
+			description: "Modern image, no devices, no capabilities, no requirements, no envCUDAVersion",
+			env: map[string]string{
+				envNVRequireCUDA: "cuda>=9.0",
+			},
+			privileged:     false,
+			expectedConfig: nil,
+		},
+		{
+			description: "Modern image, no devices, no capabilities, no requirement, envCUDAVersion set",
+			env: map[string]string{
+				envCUDAVersion:   "9.0",
+				envNVRequireCUDA: "cuda>=9.0",
+			},
+			privileged:     false,
+			expectedConfig: nil,
+		},
+		{
+			description: "Modern image, devices 'all', no capabilities, no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:    "cuda>=9.0",
+				envNVVisibleDevices: "all",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices 'empty', no capabilities, no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:    "cuda>=9.0",
+				envNVVisibleDevices: "",
+			},
+			privileged:     false,
+			expectedConfig: nil,
+		},
+		{
+			description: "Modern image, devices 'void', no capabilities, no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:    "cuda>=9.0",
+				envNVVisibleDevices: "",
+			},
+			privileged:     false,
+			expectedConfig: nil,
+		},
+		{
+			description: "Modern image, devices 'none', no capabilities, no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:    "cuda>=9.0",
+				envNVVisibleDevices: "none",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices set, no capabilities, no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:    "cuda>=9.0",
+				envNVVisibleDevices: "gpu0,gpu1",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices set, capabilities 'empty', no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:        "cuda>=9.0",
+				envNVVisibleDevices:     "gpu0,gpu1",
+				envNVDriverCapabilities: "",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices set, capabilities 'all', no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:        "cuda>=9.0",
+				envNVVisibleDevices:     "gpu0,gpu1",
+				envNVDriverCapabilities: "all",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: allDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices set, capabilities set, no requirements",
+			env: map[string]string{
+				envNVRequireCUDA:        "cuda>=9.0",
+				envNVVisibleDevices:     "gpu0,gpu1",
+				envNVDriverCapabilities: "video,display",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: "video,display",
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices set, capabilities set, requirements set",
+			env: map[string]string{
+				envNVRequireCUDA:            "cuda>=9.0",
+				envNVVisibleDevices:         "gpu0,gpu1",
+				envNVDriverCapabilities:     "video,display",
+				envNVRequirePrefix + "REQ0": "req0=true",
+				envNVRequirePrefix + "REQ1": "req1=false",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: "video,display",
+				Requirements:       []string{"cuda>=9.0", "req0=true", "req1=false"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices set, capabilities set, requirements set, disable requirements",
+			env: map[string]string{
+				envNVRequireCUDA:            "cuda>=9.0",
+				envNVVisibleDevices:         "gpu0,gpu1",
+				envNVDriverCapabilities:     "video,display",
+				envNVRequirePrefix + "REQ0": "req0=true",
+				envNVRequirePrefix + "REQ1": "req1=false",
+				envNVDisableRequire:         "true",
+			},
+			privileged: false,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "gpu0,gpu1",
+				DriverCapabilities: "video,display",
+				Requirements:       []string{"cuda>=9.0", "req0=true", "req1=false"},
+				DisableRequire:     true,
+			},
+		},
+		{
+			description: "No cuda envs, devices 'all'",
+			env: map[string]string{
+				envNVVisibleDevices: "all",
+			},
+			privileged: false,
+
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices 'all', migConfig set, privileged",
+			env: map[string]string{
+				envNVRequireCUDA:      "cuda>=9.0",
+				envNVVisibleDevices:   "all",
+				envNVMigConfigDevices: "mig0,mig1",
+			},
+			privileged: true,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				MigConfigDevices:   "mig0,mig1",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices 'all', migConfig set, unprivileged",
+			env: map[string]string{
+				envNVRequireCUDA:      "cuda>=9.0",
+				envNVVisibleDevices:   "all",
+				envNVMigConfigDevices: "mig0,mig1",
+			},
+			privileged:    false,
+			expectedPanic: true,
+		},
+		{
+			description: "Modern image, devices 'all', migMonitor set, privileged",
+			env: map[string]string{
+				envNVRequireCUDA:       "cuda>=9.0",
+				envNVVisibleDevices:    "all",
+				envNVMigMonitorDevices: "mig0,mig1",
+			},
+			privileged: true,
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				MigMonitorDevices:  "mig0,mig1",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+				Requirements:       []string{"cuda>=9.0"},
+				DisableRequire:     false,
+			},
+		},
+		{
+			description: "Modern image, devices 'all', migMonitor set, unprivileged",
+			env: map[string]string{
+				envNVRequireCUDA:       "cuda>=9.0",
+				envNVVisibleDevices:    "all",
+				envNVMigMonitorDevices: "mig0,mig1",
+			},
+			privileged:    false,
+			expectedPanic: true,
+		},
+		{
+			description: "Hook config set as driver-capabilities-all",
+			env: map[string]string{
+				envNVVisibleDevices:     "all",
+				envNVDriverCapabilities: "all",
+			},
+			privileged: true,
+			hookConfig: &HookConfig{
+				SupportedDriverCapabilities: "video,display",
+			},
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				DriverCapabilities: "video,display",
+			},
+		},
+		{
+			description: "Hook config set, envvar sets driver-capabilities",
+			env: map[string]string{
+				envNVVisibleDevices:     "all",
+				envNVDriverCapabilities: "video,display",
+			},
+			privileged: true,
+			hookConfig: &HookConfig{
+				SupportedDriverCapabilities: "video,display,compute,utility",
+			},
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				DriverCapabilities: "video,display",
+			},
+		},
+		{
+			description: "Hook config set, envvar unset sets default driver-capabilities",
+			env: map[string]string{
+				envNVVisibleDevices: "all",
+			},
+			privileged: true,
+			hookConfig: &HookConfig{
+				SupportedDriverCapabilities: "video,display,utility,compute",
+			},
+			expectedConfig: &nvidiaConfig{
+				Devices:            "all",
+				DriverCapabilities: defaultDriverCapabilities.String(),
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			// Wrap the call to getNvidiaConfig() in a closure.
+			var config *nvidiaConfig
+			getConfig := func() {
+				hookConfig := tc.hookConfig
+				if hookConfig == nil {
+					defaultConfig := getDefaultHookConfig()
+					hookConfig = &defaultConfig
+				}
+				config = getNvidiaConfig(hookConfig, tc.env, nil, tc.privileged)
+			}
+
+			// For any tests that are expected to panic, make sure they do.
+			if tc.expectedPanic {
+				require.Panics(t, getConfig)
+				return
+			}
+
+			// For all other tests, just grab the config
+			getConfig()
+
+			// And start comparing the test results to the expected results.
+			if tc.expectedConfig == nil {
+				require.Nil(t, config, tc.description)
+				return
+			}
+
+			require.NotNil(t, config, tc.description)
+
+			require.Equal(t, tc.expectedConfig.Devices, config.Devices)
+			require.Equal(t, tc.expectedConfig.MigConfigDevices, config.MigConfigDevices)
+			require.Equal(t, tc.expectedConfig.MigMonitorDevices, config.MigMonitorDevices)
+			require.Equal(t, tc.expectedConfig.DriverCapabilities, config.DriverCapabilities)
+
+			require.ElementsMatch(t, tc.expectedConfig.Requirements, config.Requirements)
+			require.Equal(t, tc.expectedConfig.DisableRequire, config.DisableRequire)
+		})
+	}
+}
+
+func TestGetDevicesFromMounts(t *testing.T) {
+	var tests = []struct {
+		description     string
+		mounts          []Mount
+		expectedDevices *string
+	}{
+		{
+			description:     "No mounts",
+			mounts:          nil,
+			expectedDevices: nil,
+		},
+		{
+			description: "Host path is not /dev/null",
+			mounts: []Mount{
+				{
+					Source:      "/not/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU0"),
+				},
+			},
+			expectedDevices: nil,
+		},
+		{
+			description: "Container path is not prefixed by 'root'",
+			mounts: []Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join("/other/prefix", "GPU0"),
+				},
+			},
+			expectedDevices: nil,
+		},
+		{
+			description: "Container path is only 'root'",
+			mounts: []Mount{
+				{
+					Source:      "/dev/null",
+					Destination: deviceListAsVolumeMountsRoot,
+				},
+			},
+			expectedDevices: nil,
+		},
+		{
+			description: "Discover 2 devices",
+			mounts: []Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU0"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU1"),
+				},
+			},
+			expectedDevices: &[]string{"GPU0,GPU1"}[0],
+		},
+		{
+			description: "Discover 2 devices with slashes in the name",
+			mounts: []Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU0-MIG0/0/1"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU1-MIG0/0/1"),
+				},
+			},
+			expectedDevices: &[]string{"GPU0-MIG0/0/1,GPU1-MIG0/0/1"}[0],
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			devices := getDevicesFromMounts(tc.mounts)
+			require.Equal(t, tc.expectedDevices, devices)
+		})
+	}
+}
+
+func TestDeviceListSourcePriority(t *testing.T) {
+	var tests = []struct {
+		description        string
+		mountDevices       []Mount
+		envvarDevices      string
+		privileged         bool
+		acceptUnprivileged bool
+		acceptMounts       bool
+		expectedDevices    *string
+	}{
+		{
+			description: "Mount devices, unprivileged, no accept unprivileged",
+			mountDevices: []Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU0"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU1"),
+				},
+			},
+			envvarDevices:      "GPU2,GPU3",
+			privileged:         false,
+			acceptUnprivileged: false,
+			acceptMounts:       true,
+			expectedDevices:    &[]string{"GPU0,GPU1"}[0],
+		},
+		{
+			description:        "No mount devices, unprivileged, no accept unprivileged",
+			mountDevices:       nil,
+			envvarDevices:      "GPU0,GPU1",
+			privileged:         false,
+			acceptUnprivileged: false,
+			acceptMounts:       true,
+			expectedDevices:    nil,
+		},
+		{
+			description:        "No mount devices, privileged, no accept unprivileged",
+			mountDevices:       nil,
+			envvarDevices:      "GPU0,GPU1",
+			privileged:         true,
+			acceptUnprivileged: false,
+			acceptMounts:       true,
+			expectedDevices:    &[]string{"GPU0,GPU1"}[0],
+		},
+		{
+			description:        "No mount devices, unprivileged, accept unprivileged",
+			mountDevices:       nil,
+			envvarDevices:      "GPU0,GPU1",
+			privileged:         false,
+			acceptUnprivileged: true,
+			acceptMounts:       true,
+			expectedDevices:    &[]string{"GPU0,GPU1"}[0],
+		},
+		{
+			description: "Mount devices, unprivileged, accept unprivileged, no accept mounts",
+			mountDevices: []Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU0"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU1"),
+				},
+			},
+			envvarDevices:      "GPU2,GPU3",
+			privileged:         false,
+			acceptUnprivileged: true,
+			acceptMounts:       false,
+			expectedDevices:    &[]string{"GPU2,GPU3"}[0],
+		},
+		{
+			description: "Mount devices, unprivileged, no accept unprivileged, no accept mounts",
+			mountDevices: []Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU0"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(deviceListAsVolumeMountsRoot, "GPU1"),
+				},
+			},
+			envvarDevices:      "GPU2,GPU3",
+			privileged:         false,
+			acceptUnprivileged: false,
+			acceptMounts:       false,
+			expectedDevices:    nil,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			// Wrap the call to getDevices() in a closure.
+			var devices *string
+			getDevices := func() {
+				env := map[string]string{
+					envNVVisibleDevices: tc.envvarDevices,
+				}
+				hookConfig := getDefaultHookConfig()
+				hookConfig.AcceptEnvvarUnprivileged = tc.acceptUnprivileged
+				hookConfig.AcceptDeviceListAsVolumeMounts = tc.acceptMounts
+				devices = getDevices(&hookConfig, env, tc.mountDevices, tc.privileged, false)
+			}
+
+			// For all other tests, just grab the devices and check the results
+			getDevices()
+
+			require.Equal(t, tc.expectedDevices, devices)
+		})
+	}
+}
+
+func TestGetDevicesFromEnvvar(t *testing.T) {
+	all := "all"
+	empty := ""
+	envDockerResourceGPUs := "DOCKER_RESOURCE_GPUS"
+	gpuID := "GPU-12345"
+	anotherGPUID := "GPU-67890"
+
+	var tests = []struct {
+		description     string
+		envSwarmGPU     *string
+		env             map[string]string
+		legacyImage     bool
+		expectedDevices *string
+	}{
+		{
+			description: "empty env returns nil for non-legacy image",
+		},
+		{
+			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices: "",
+			},
+		},
+		{
+			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices: "void",
+			},
+		},
+		{
+			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices: "none",
+			},
+			expectedDevices: &empty,
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices: gpuID,
+			},
+			expectedDevices: &gpuID,
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
+			env: map[string]string{
+				envNVVisibleDevices: gpuID,
+			},
+			legacyImage:     true,
+			expectedDevices: &gpuID,
+		},
+		{
+			description:     "empty env returns all for legacy image",
+			legacyImage:     true,
+			expectedDevices: &all,
+		},
+		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is ignored when
+		// not enabled
+		{
+			description: "missing NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				envDockerResourceGPUs: anotherGPUID,
+			},
+		},
+		{
+			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices:   "",
+				envDockerResourceGPUs: anotherGPUID,
+			},
+		},
+		{
+			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices:   "void",
+				envDockerResourceGPUs: anotherGPUID,
+			},
+		},
+		{
+			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices:   "none",
+				envDockerResourceGPUs: anotherGPUID,
+			},
+			expectedDevices: &empty,
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
+			env: map[string]string{
+				envNVVisibleDevices:   gpuID,
+				envDockerResourceGPUs: anotherGPUID,
+			},
+			expectedDevices: &gpuID,
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
+			env: map[string]string{
+				envNVVisibleDevices:   gpuID,
+				envDockerResourceGPUs: anotherGPUID,
+			},
+			legacyImage:     true,
+			expectedDevices: &gpuID,
+		},
+		{
+			description: "empty env returns all for legacy image",
+			env: map[string]string{
+				envDockerResourceGPUs: anotherGPUID,
+			},
+			legacyImage:     true,
+			expectedDevices: &all,
+		},
+		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is selected when
+		// enabled
+		{
+			description: "empty env returns nil for non-legacy image",
+			envSwarmGPU: &envDockerResourceGPUs,
+		},
+		{
+			description: "blank DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
+			envSwarmGPU: &envDockerResourceGPUs,
+			env: map[string]string{
+				envDockerResourceGPUs: "",
+			},
+		},
+		{
+			description: "'void' DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
+			envSwarmGPU: &envDockerResourceGPUs,
+			env: map[string]string{
+				envDockerResourceGPUs: "void",
+			},
+		},
+		{
+			description: "'none' DOCKER_RESOURCE_GPUS returns empty for non-legacy image",
+			envSwarmGPU: &envDockerResourceGPUs,
+			env: map[string]string{
+				envDockerResourceGPUs: "none",
+			},
+			expectedDevices: &empty,
+		},
+		{
+			description: "DOCKER_RESOURCE_GPUS set returns value for non-legacy image",
+			envSwarmGPU: &envDockerResourceGPUs,
+			env: map[string]string{
+				envDockerResourceGPUs: gpuID,
+			},
+			expectedDevices: &gpuID,
+		},
+		{
+			description: "DOCKER_RESOURCE_GPUS set returns value for legacy image",
+			envSwarmGPU: &envDockerResourceGPUs,
+			env: map[string]string{
+				envDockerResourceGPUs: gpuID,
+			},
+			legacyImage:     true,
+			expectedDevices: &gpuID,
+		},
+		{
+			description: "DOCKER_RESOURCE_GPUS is selected if present",
+			envSwarmGPU: &envDockerResourceGPUs,
+			env: map[string]string{
+				envDockerResourceGPUs: anotherGPUID,
+			},
+			expectedDevices: &anotherGPUID,
+		},
+		{
+			description: "DOCKER_RESOURCE_GPUS overrides NVIDIA_VISIBLE_DEVICES if present",
+			envSwarmGPU: &envDockerResourceGPUs,
+			env: map[string]string{
+				envNVVisibleDevices:   gpuID,
+				envDockerResourceGPUs: anotherGPUID,
+			},
+			expectedDevices: &anotherGPUID,
+		},
+	}
+
+	for i, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			envSwarmGPU = tc.envSwarmGPU
+			devices := getDevicesFromEnvvar(tc.env, tc.legacyImage)
+			if tc.expectedDevices == nil {
+				require.Nil(t, devices, "%d: %v", i, tc)
+				return
+			}
+
+			require.NotNil(t, devices, "%d: %v", i, tc)
+			require.Equal(t, *tc.expectedDevices, *devices, "%d: %v", i, tc)
+		})
+	}
+}
+
+func TestGetDriverCapabilities(t *testing.T) {
+
+	supportedCapabilities := "compute,utility,display,video"
+
+	testCases := []struct {
+		description           string
+		env                   map[string]string
+		legacyImage           bool
+		supportedCapabilities string
+		expectedPanic         bool
+		expectedCapabilities  string
+	}{
+		{
+			description: "Env is set for legacy image",
+			env: map[string]string{
+				envNVDriverCapabilities: "display,video",
+			},
+			legacyImage:           true,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  "display,video",
+		},
+		{
+			description: "Env is all for legacy image",
+			env: map[string]string{
+				envNVDriverCapabilities: "all",
+			},
+			legacyImage:           true,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  supportedCapabilities,
+		},
+		{
+			description: "Env is empty for legacy image",
+			env: map[string]string{
+				envNVDriverCapabilities: "",
+			},
+			legacyImage:           true,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  defaultDriverCapabilities.String(),
+		},
+		{
+			description:           "Env unset for legacy image is 'all'",
+			env:                   map[string]string{},
+			legacyImage:           true,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  supportedCapabilities,
+		},
+		{
+			description: "Env is set for modern image",
+			env: map[string]string{
+				envNVDriverCapabilities: "display,video",
+			},
+			legacyImage:           false,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  "display,video",
+		},
+		{
+			description:           "Env unset for modern image is default",
+			env:                   map[string]string{},
+			legacyImage:           false,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  defaultDriverCapabilities.String(),
+		},
+		{
+			description: "Env is all for modern image",
+			env: map[string]string{
+				envNVDriverCapabilities: "all",
+			},
+			legacyImage:           false,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  supportedCapabilities,
+		},
+		{
+			description: "Env is empty for modern image",
+			env: map[string]string{
+				envNVDriverCapabilities: "",
+			},
+			legacyImage:           false,
+			supportedCapabilities: supportedCapabilities,
+			expectedCapabilities:  defaultDriverCapabilities.String(),
+		},
+		{
+			description: "Invalid capabilities panic",
+			env: map[string]string{
+				envNVDriverCapabilities: "compute,utility",
+			},
+			supportedCapabilities: "not-compute,not-utility",
+			expectedPanic:         true,
+		},
+		{
+			description:           "Default is restricted for modern image",
+			legacyImage:           false,
+			supportedCapabilities: "compute",
+			expectedCapabilities:  "compute",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.description, func(t *testing.T) {
+			var capabilites DriverCapabilities
+
+			getDriverCapabilities := func() {
+				supportedCapabilities := DriverCapabilities(tc.supportedCapabilities)
+				capabilites = getDriverCapabilities(tc.env, supportedCapabilities, tc.legacyImage)
+			}
+
+			if tc.expectedPanic {
+				require.Panics(t, getDriverCapabilities)
+				return
+			}
+
+			getDriverCapabilities()
+			require.EqualValues(t, tc.expectedCapabilities, capabilites)
+		})
+	}
+}

cmd/nvidia-container-toolkit/hook_config.go

@@ -0,0 +1,115 @@
+package main
+
+import (
+	"log"
+	"os"
+	"path"
+	"reflect"
+
+	"github.com/BurntSushi/toml"
+)
+
+const (
+	configPath = "/etc/nvidia-container-runtime/config.toml"
+	driverPath = "/run/nvidia/driver"
+)
+
+var defaultPaths = [...]string{
+	path.Join(driverPath, configPath),
+	configPath,
+}
+
+// CLIConfig : options for nvidia-container-cli.
+type CLIConfig struct {
+	Root        *string  `toml:"root"`
+	Path        *string  `toml:"path"`
+	Environment []string `toml:"environment"`
+	Debug       *string  `toml:"debug"`
+	Ldcache     *string  `toml:"ldcache"`
+	LoadKmods   bool     `toml:"load-kmods"`
+	NoPivot     bool     `toml:"no-pivot"`
+	NoCgroups   bool     `toml:"no-cgroups"`
+	User        *string  `toml:"user"`
+	Ldconfig    *string  `toml:"ldconfig"`
+}
+
+// HookConfig : options for the nvidia-container-toolkit.
+type HookConfig struct {
+	DisableRequire                 bool               `toml:"disable-require"`
+	SwarmResource                  *string            `toml:"swarm-resource"`
+	AcceptEnvvarUnprivileged       bool               `toml:"accept-nvidia-visible-devices-envvar-when-unprivileged"`
+	AcceptDeviceListAsVolumeMounts bool               `toml:"accept-nvidia-visible-devices-as-volume-mounts"`
+	SupportedDriverCapabilities    DriverCapabilities `toml:"supported-driver-capabilities"`
+
+	NvidiaContainerCLI CLIConfig `toml:"nvidia-container-cli"`
+}
+
+func getDefaultHookConfig() (config HookConfig) {
+	return HookConfig{
+		DisableRequire:                 false,
+		SwarmResource:                  nil,
+		AcceptEnvvarUnprivileged:       true,
+		AcceptDeviceListAsVolumeMounts: false,
+		SupportedDriverCapabilities:    allDriverCapabilities,
+		NvidiaContainerCLI: CLIConfig{
+			Root:        nil,
+			Path:        nil,
+			Environment: []string{},
+			Debug:       nil,
+			Ldcache:     nil,
+			LoadKmods:   true,
+			NoPivot:     false,
+			NoCgroups:   false,
+			User:        nil,
+			Ldconfig:    nil,
+		},
+	}
+}
+
+func getHookConfig() (config HookConfig) {
+	var err error
+
+	if len(*configflag) > 0 {
+		config = getDefaultHookConfig()
+		_, err = toml.DecodeFile(*configflag, &config)
+		if err != nil {
+			log.Panicln("couldn't open configuration file:", err)
+		}
+	} else {
+		for _, p := range defaultPaths {
+			config = getDefaultHookConfig()
+			_, err = toml.DecodeFile(p, &config)
+			if err == nil {
+				break
+			} else if !os.IsNotExist(err) {
+				log.Panicln("couldn't open default configuration file:", err)
+			}
+		}
+	}
+
+	if config.SupportedDriverCapabilities == all {
+		config.SupportedDriverCapabilities = allDriverCapabilities
+	}
+	// We ensure that the supported-driver-capabilites option is a subset of allDriverCapabilities
+	if intersection := allDriverCapabilities.Intersection(config.SupportedDriverCapabilities); intersection != config.SupportedDriverCapabilities {
+		configName := config.getConfigOption("SupportedDriverCapabilities")
+		log.Panicf("Invalid value for config option '%v'; %v (supported: %v)\n", configName, config.SupportedDriverCapabilities, allDriverCapabilities)
+	}
+
+	return config
+}
+
+// getConfigOption returns the toml config option associated with the
+// specified struct field.
+func (c HookConfig) getConfigOption(fieldName string) string {
+	t := reflect.TypeOf(c)
+	f, ok := t.FieldByName(fieldName)
+	if !ok {
+		return fieldName
+	}
+	v, ok := f.Tag.Lookup("toml")
+	if !ok {
+		return fieldName
+	}
+	return v
+}

cmd/nvidia-container-toolkit/hook_config_test.go

@@ -22,25 +22,22 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config/image"
 )
 
 func TestGetHookConfig(t *testing.T) {
 	testCases := []struct {
 		lines                      []string
 		expectedPanic              bool
-		expectedDriverCapabilities string
+		expectedDriverCapabilities DriverCapabilities
 	}{
 		{
-			expectedDriverCapabilities: image.SupportedDriverCapabilities.String(),
+			expectedDriverCapabilities: allDriverCapabilities,
 		},
 		{
 			lines: []string{
 				"supported-driver-capabilities = \"all\"",
 			},
-			expectedDriverCapabilities: image.SupportedDriverCapabilities.String(),
+			expectedDriverCapabilities: allDriverCapabilities,
 		},
 		{
 			lines: []string{
@@ -50,19 +47,19 @@ func TestGetHookConfig(t *testing.T) {
 		},
 		{
 			lines:                      []string{},
-			expectedDriverCapabilities: image.SupportedDriverCapabilities.String(),
+			expectedDriverCapabilities: allDriverCapabilities,
 		},
 		{
 			lines: []string{
 				"supported-driver-capabilities = \"\"",
 			},
-			expectedDriverCapabilities: "",
+			expectedDriverCapabilities: none,
 		},
 		{
 			lines: []string{
-				"supported-driver-capabilities = \"compute,utility\"",
+				"supported-driver-capabilities = \"utility,compute\"",
 			},
-			expectedDriverCapabilities: "compute,utility",
+			expectedDriverCapabilities: DriverCapabilities("utility,compute"),
 		},
 	}
 
@@ -90,10 +87,9 @@ func TestGetHookConfig(t *testing.T) {
 				}
 			}
 
-			var cfg hookConfig
+			var config HookConfig
 			getHookConfig := func() {
-				c, _ := getHookConfig()
-				cfg = *c
+				config = getHookConfig()
 			}
 
 			if tc.expectedPanic {
@@ -103,56 +99,7 @@ func TestGetHookConfig(t *testing.T) {
 
 			getHookConfig()
 
-			require.EqualValues(t, tc.expectedDriverCapabilities, cfg.SupportedDriverCapabilities)
-		})
-	}
-}
-
-func TestGetSwarmResourceEnvvars(t *testing.T) {
-	testCases := []struct {
-		value    string
-		expected []string
-	}{
-		{
-			value:    "",
-			expected: nil,
-		},
-		{
-			value:    " ",
-			expected: nil,
-		},
-		{
-			value:    "single",
-			expected: []string{"single"},
-		},
-		{
-			value:    "single ",
-			expected: []string{"single"},
-		},
-		{
-			value:    "one,two",
-			expected: []string{"one", "two"},
-		},
-		{
-			value:    "one ,two",
-			expected: []string{"one", "two"},
-		},
-		{
-			value:    "one, two",
-			expected: []string{"one", "two"},
-		},
-	}
-
-	for i, tc := range testCases {
-		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
-			c := &hookConfig{
-				Config: &config.Config{
-					SwarmResource: tc.value,
-				},
-			}
-
-			envvars := c.getSwarmResourceEnvvars()
-			require.EqualValues(t, tc.expected, envvars)
+			require.EqualValues(t, tc.expectedDriverCapabilities, config.SupportedDriverCapabilities)
 		})
 	}
 }

cmd/nvidia-container-toolkit/hook_test.go

@@ -7,6 +7,51 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestParseCudaVersionValid(t *testing.T) {
+	var tests = []struct {
+		version  string
+		expected [3]uint32
+	}{
+		{"0", [3]uint32{0, 0, 0}},
+		{"8", [3]uint32{8, 0, 0}},
+		{"7.5", [3]uint32{7, 5, 0}},
+		{"9.0.116", [3]uint32{9, 0, 116}},
+		{"4294967295.4294967295.4294967295", [3]uint32{4294967295, 4294967295, 4294967295}},
+	}
+	for i, c := range tests {
+		vmaj, vmin, vpatch := parseCudaVersion(c.version)
+
+		version := [3]uint32{vmaj, vmin, vpatch}
+
+		require.Equal(t, c.expected, version, "%d: %v", i, c)
+	}
+}
+
+func TestParseCudaVersionInvalid(t *testing.T) {
+	var tests = []string{
+		"foo",
+		"foo.5.10",
+		"9.0.116.50",
+		"9.0.116foo",
+		"7.foo",
+		"9.0.bar",
+		"9.4294967296",
+		"9.0.116.",
+		"9..0",
+		"9.",
+		".5.10",
+		"-9",
+		"+9",
+		"-9.1.116",
+		"-9.-1.-116",
+	}
+	for _, c := range tests {
+		require.Panics(t, func() {
+			parseCudaVersion(c)
+		}, "parseCudaVersion(%v)", c)
+	}
+}
+
 func TestIsPrivileged(t *testing.T) {
 	var tests = []struct {
 		spec     string

cmd/nvidia-container-toolkit/main.go

@@ -0,0 +1,188 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"runtime"
+	"runtime/debug"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+var (
+	debugflag  = flag.Bool("debug", false, "enable debug output")
+	configflag = flag.String("config", "", "configuration file")
+
+	defaultPATH = []string{"/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"}
+)
+
+func exit() {
+	if err := recover(); err != nil {
+		if _, ok := err.(runtime.Error); ok {
+			log.Println(err)
+		}
+		if *debugflag {
+			log.Printf("%s", debug.Stack())
+		}
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
+func getPATH(config CLIConfig) string {
+	dirs := filepath.SplitList(os.Getenv("PATH"))
+	// directories from the hook environment have higher precedence
+	dirs = append(dirs, defaultPATH...)
+
+	if config.Root != nil {
+		rootDirs := []string{}
+		for _, dir := range dirs {
+			rootDirs = append(rootDirs, path.Join(*config.Root, dir))
+		}
+		// directories with the root prefix have higher precedence
+		dirs = append(rootDirs, dirs...)
+	}
+	return strings.Join(dirs, ":")
+}
+
+func getCLIPath(config CLIConfig) string {
+	if config.Path != nil {
+		return *config.Path
+	}
+
+	if err := os.Setenv("PATH", getPATH(config)); err != nil {
+		log.Panicln("couldn't set PATH variable:", err)
+	}
+
+	path, err := exec.LookPath("nvidia-container-cli")
+	if err != nil {
+		log.Panicln("couldn't find binary nvidia-container-cli in", os.Getenv("PATH"), ":", err)
+	}
+	return path
+}
+
+// getRootfsPath returns an absolute path. We don't need to resolve symlinks for now.
+func getRootfsPath(config containerConfig) string {
+	rootfs, err := filepath.Abs(config.Rootfs)
+	if err != nil {
+		log.Panicln(err)
+	}
+	return rootfs
+}
+
+func doPrestart() {
+	var err error
+
+	defer exit()
+	log.SetFlags(0)
+
+	hook := getHookConfig()
+	cli := hook.NvidiaContainerCLI
+
+	container := getContainerConfig(hook)
+	nvidia := container.Nvidia
+	if nvidia == nil {
+		// Not a GPU container, nothing to do.
+		return
+	}
+
+	rootfs := getRootfsPath(container)
+
+	args := []string{getCLIPath(cli)}
+	if cli.Root != nil {
+		args = append(args, fmt.Sprintf("--root=%s", *cli.Root))
+	}
+	if cli.LoadKmods {
+		args = append(args, "--load-kmods")
+	}
+	if cli.NoPivot {
+		args = append(args, "--no-pivot")
+	}
+	if *debugflag {
+		args = append(args, "--debug=/dev/stderr")
+	} else if cli.Debug != nil {
+		args = append(args, fmt.Sprintf("--debug=%s", *cli.Debug))
+	}
+	if cli.Ldcache != nil {
+		args = append(args, fmt.Sprintf("--ldcache=%s", *cli.Ldcache))
+	}
+	if cli.User != nil {
+		args = append(args, fmt.Sprintf("--user=%s", *cli.User))
+	}
+	args = append(args, "configure")
+
+	if cli.Ldconfig != nil {
+		args = append(args, fmt.Sprintf("--ldconfig=%s", *cli.Ldconfig))
+	}
+	if cli.NoCgroups {
+		args = append(args, "--no-cgroups")
+	}
+	if len(nvidia.Devices) > 0 {
+		args = append(args, fmt.Sprintf("--device=%s", nvidia.Devices))
+	}
+	if len(nvidia.MigConfigDevices) > 0 {
+		args = append(args, fmt.Sprintf("--mig-config=%s", nvidia.MigConfigDevices))
+	}
+	if len(nvidia.MigMonitorDevices) > 0 {
+		args = append(args, fmt.Sprintf("--mig-monitor=%s", nvidia.MigMonitorDevices))
+	}
+
+	for _, cap := range strings.Split(nvidia.DriverCapabilities, ",") {
+		if len(cap) == 0 {
+			break
+		}
+		args = append(args, capabilityToCLI(cap))
+	}
+
+	if !hook.DisableRequire && !nvidia.DisableRequire {
+		for _, req := range nvidia.Requirements {
+			args = append(args, fmt.Sprintf("--require=%s", req))
+		}
+	}
+
+	args = append(args, fmt.Sprintf("--pid=%s", strconv.FormatUint(uint64(container.Pid), 10)))
+	args = append(args, rootfs)
+
+	env := append(os.Environ(), cli.Environment...)
+	err = syscall.Exec(args[0], args, env)
+	log.Panicln("exec failed:", err)
+}
+
+func usage() {
+	fmt.Fprintf(os.Stderr, "Usage of %s:\n", os.Args[0])
+	flag.PrintDefaults()
+	fmt.Fprintf(os.Stderr, "\nCommands:\n")
+	fmt.Fprintf(os.Stderr, "  prestart\n        run the prestart hook\n")
+	fmt.Fprintf(os.Stderr, "  poststart\n        no-op\n")
+	fmt.Fprintf(os.Stderr, "  poststop\n        no-op\n")
+}
+
+func main() {
+	flag.Usage = usage
+	flag.Parse()
+
+	args := flag.Args()
+	if len(args) == 0 {
+		flag.Usage()
+		os.Exit(2)
+	}
+
+	switch args[0] {
+	case "prestart":
+		doPrestart()
+		os.Exit(0)
+	case "poststart":
+		fallthrough
+	case "poststop":
+		os.Exit(0)
+	default:
+		flag.Usage()
+		os.Exit(2)
+	}
+}

cmd/nvidia-ctk/README.md

@@ -1,73 +0,0 @@
-# NVIDIA Container Toolkit CLI
-
-The NVIDIA Container Toolkit CLI `nvidia-ctk` provides a number of utilities that are useful for working with the NVIDIA Container Toolkit.
-
-## Functionality
-
-### Configure runtimes
-
-The `runtime` command of the `nvidia-ctk` CLI provides a set of utilities to related to the configuration
-and management of supported container engines.
-
-For example, running the following command:
-```bash
-nvidia-ctk runtime configure --set-as-default
-```
-will ensure that the NVIDIA Container Runtime is added as the default runtime to the default container
-engine.
-
-## Configure the NVIDIA Container Toolkit
-
-The `config` command of the `nvidia-ctk` CLI allows a user to display and manipulate the NVIDIA Container Toolkit
-configuration.
-
-For example, running the following command:
-```bash
-nvidia-ctk config default
-```
-will display the default config for the detected platform.
-
-Whereas
-```bash
-nvidia-ctk config
-```
-will display the effective NVIDIA Container Toolkit config using the configured config file, and running:
-
-Individual config options can be set by specifying these are key-value pairs to the `--set` argument:
-
-```bash
-nvidia-ctk config --set nvidia-container-cli.no-cgroups=true
-```
-
-By default, all commands output to `STDOUT`, but specifying the `--output` flag writes the config to the specified file.
-
-### Generate CDI specifications
-
-The [Container Device Interface (CDI)](https://tags.cncf.io/container-device-interface) provides
-a vendor-agnostic mechanism to make arbitrary devices accessible in containerized environments. To allow NVIDIA devices to be
-used in these environments, the NVIDIA Container Toolkit CLI includes functionality to generate a CDI specification for the
-available NVIDIA GPUs in a system.
-
-In order to generate the CDI specification for the available devices, run the following command:\
-```bash
-nvidia-ctk cdi generate
-```
-
-The default is to print the specification to STDOUT and a filename can be specified using the `--output` flag.
-
-The specification will contain a device entries as follows (where applicable):
-* An `nvidia.com/gpu=gpu{INDEX}` device for each non-MIG-enabled full GPU in the system
-* An `nvidia.com/gpu=mig{GPU_INDEX}:{MIG_INDEX}` device for each MIG-device in the system
-* A special device called `nvidia.com/gpu=all` which represents all available devices.
-
-For example, to generate the CDI specification in the default location where CDI-enabled tools such as `podman`, `containerd`, `cri-o`, or the NVIDIA Container Runtime can be configured to load it, the following command can be run:
-
-```bash
-sudo nvidia-ctk cdi generate --output=/etc/cdi/nvidia.yaml
-```
-(Note that `sudo` is used to ensure the correct permissions to write to the `/etc/cdi` folder)
-
-With the specification generated, a GPU can be requested by specifying the fully-qualified CDI device name. With `podman` as an exmaple:
-```bash
-podman run --rm -ti --device=nvidia.com/gpu=gpu0 ubuntu nvidia-smi -L
-```

cmd/nvidia-ctk/cdi/cdi.go

@@ -1,55 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package cdi
-
-import (
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi/generate"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi/list"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi/transform"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs an info command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build
-func (m command) build() *cli.Command {
-	// Create the 'hook' command
-	hook := cli.Command{
-		Name:  "cdi",
-		Usage: "Provide tools for interacting with Container Device Interface specifications",
-	}
-
-	hook.Subcommands = []*cli.Command{
-		generate.NewCommand(m.logger),
-		transform.NewCommand(m.logger),
-		list.NewCommand(m.logger),
-	}
-
-	return &hook
-}

cmd/nvidia-ctk/cdi/generate/generate.go

@@ -1,303 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package generate
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/urfave/cli/v2"
-	cdi "tags.cncf.io/container-device-interface/pkg/parser"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/platform-support/tegra/csv"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/nvcdi"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/nvcdi/spec"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/nvcdi/transform"
-)
-
-const (
-	allDeviceName = "all"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type options struct {
-	output               string
-	format               string
-	deviceNameStrategies cli.StringSlice
-	driverRoot           string
-	devRoot              string
-	nvidiaCDIHookPath    string
-	ldconfigPath         string
-	mode                 string
-	vendor               string
-	class                string
-
-	configSearchPaths  cli.StringSlice
-	librarySearchPaths cli.StringSlice
-
-	csv struct {
-		files          cli.StringSlice
-		ignorePatterns cli.StringSlice
-	}
-}
-
-// NewCommand constructs a generate-cdi command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build creates the CLI command
-func (m command) build() *cli.Command {
-	opts := options{}
-
-	// Create the 'generate-cdi' command
-	c := cli.Command{
-		Name:  "generate",
-		Usage: "Generate CDI specifications for use with CDI-enabled runtimes",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &opts)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &opts)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringSliceFlag{
-			Name:        "config-search-path",
-			Usage:       "Specify the path to search for config files when discovering the entities that should be included in the CDI specification.",
-			Destination: &opts.configSearchPaths,
-		},
-		&cli.StringFlag{
-			Name:        "output",
-			Usage:       "Specify the file to output the generated CDI specification to. If this is '' the specification is output to STDOUT",
-			Destination: &opts.output,
-		},
-		&cli.StringFlag{
-			Name:        "format",
-			Usage:       "The output format for the generated spec [json | yaml]. This overrides the format defined by the output file extension (if specified).",
-			Value:       spec.FormatYAML,
-			Destination: &opts.format,
-		},
-		&cli.StringFlag{
-			Name:        "mode",
-			Aliases:     []string{"discovery-mode"},
-			Usage:       "The mode to use when discovering the available entities. One of [auto | nvml | wsl]. If mode is set to 'auto' the mode will be determined based on the system configuration.",
-			Value:       nvcdi.ModeAuto,
-			Destination: &opts.mode,
-		},
-		&cli.StringFlag{
-			Name:        "dev-root",
-			Usage:       "Specify the root where `/dev` is located. If this is not specified, the driver-root is assumed.",
-			Destination: &opts.devRoot,
-		},
-		&cli.StringSliceFlag{
-			Name:        "device-name-strategy",
-			Usage:       "Specify the strategy for generating device names. If this is specified multiple times, the devices will be duplicated for each strategy. One of [index | uuid | type-index]",
-			Value:       cli.NewStringSlice(nvcdi.DeviceNameStrategyIndex, nvcdi.DeviceNameStrategyUUID),
-			Destination: &opts.deviceNameStrategies,
-		},
-		&cli.StringFlag{
-			Name:        "driver-root",
-			Usage:       "Specify the NVIDIA GPU driver root to use when discovering the entities that should be included in the CDI specification.",
-			Destination: &opts.driverRoot,
-		},
-		&cli.StringSliceFlag{
-			Name:        "library-search-path",
-			Usage:       "Specify the path to search for libraries when discovering the entities that should be included in the CDI specification.\n\tNote: This option only applies to CSV mode.",
-			Destination: &opts.librarySearchPaths,
-		},
-		&cli.StringFlag{
-			Name:    "nvidia-cdi-hook-path",
-			Aliases: []string{"nvidia-ctk-path"},
-			Usage: "Specify the path to use for the nvidia-cdi-hook in the generated CDI specification. " +
-				"If not specified, the PATH will be searched for `nvidia-cdi-hook`. " +
-				"NOTE: That if this is specified as `nvidia-ctk`, the PATH will be searched for `nvidia-ctk` instead.",
-			Destination: &opts.nvidiaCDIHookPath,
-		},
-		&cli.StringFlag{
-			Name:        "ldconfig-path",
-			Usage:       "Specify the path to use for ldconfig in the generated CDI specification",
-			Destination: &opts.ldconfigPath,
-		},
-		&cli.StringFlag{
-			Name:        "vendor",
-			Aliases:     []string{"cdi-vendor"},
-			Usage:       "the vendor string to use for the generated CDI specification.",
-			Value:       "nvidia.com",
-			Destination: &opts.vendor,
-		},
-		&cli.StringFlag{
-			Name:        "class",
-			Aliases:     []string{"cdi-class"},
-			Usage:       "the class string to use for the generated CDI specification.",
-			Value:       "gpu",
-			Destination: &opts.class,
-		},
-		&cli.StringSliceFlag{
-			Name:        "csv.file",
-			Usage:       "The path to the list of CSV files to use when generating the CDI specification in CSV mode.",
-			Value:       cli.NewStringSlice(csv.DefaultFileList()...),
-			Destination: &opts.csv.files,
-		},
-		&cli.StringSliceFlag{
-			Name:        "csv.ignore-pattern",
-			Usage:       "Specify a pattern the CSV mount specifications.",
-			Destination: &opts.csv.ignorePatterns,
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(c *cli.Context, opts *options) error {
-	opts.format = strings.ToLower(opts.format)
-	switch opts.format {
-	case spec.FormatJSON:
-	case spec.FormatYAML:
-	default:
-		return fmt.Errorf("invalid output format: %v", opts.format)
-	}
-
-	opts.mode = strings.ToLower(opts.mode)
-	switch opts.mode {
-	case nvcdi.ModeAuto:
-	case nvcdi.ModeCSV:
-	case nvcdi.ModeNvml:
-	case nvcdi.ModeWsl:
-	case nvcdi.ModeManagement:
-	default:
-		return fmt.Errorf("invalid discovery mode: %v", opts.mode)
-	}
-
-	for _, strategy := range opts.deviceNameStrategies.Value() {
-		_, err := nvcdi.NewDeviceNamer(strategy)
-		if err != nil {
-			return err
-		}
-	}
-
-	opts.nvidiaCDIHookPath = config.ResolveNVIDIACDIHookPath(m.logger, opts.nvidiaCDIHookPath)
-
-	if outputFileFormat := formatFromFilename(opts.output); outputFileFormat != "" {
-		m.logger.Debugf("Inferred output format as %q from output file name", outputFileFormat)
-		if !c.IsSet("format") {
-			opts.format = outputFileFormat
-		} else if outputFileFormat != opts.format {
-			m.logger.Warningf("Requested output format %q does not match format implied by output file name: %q", opts.format, outputFileFormat)
-		}
-	}
-
-	if err := cdi.ValidateVendorName(opts.vendor); err != nil {
-		return fmt.Errorf("invalid CDI vendor name: %v", err)
-	}
-	if err := cdi.ValidateClassName(opts.class); err != nil {
-		return fmt.Errorf("invalid CDI class name: %v", err)
-	}
-	return nil
-}
-
-func (m command) run(c *cli.Context, opts *options) error {
-	spec, err := m.generateSpec(opts)
-	if err != nil {
-		return fmt.Errorf("failed to generate CDI spec: %v", err)
-	}
-	m.logger.Infof("Generated CDI spec with version %v", spec.Raw().Version)
-
-	if opts.output == "" {
-		_, err := spec.WriteTo(os.Stdout)
-		if err != nil {
-			return fmt.Errorf("failed to write CDI spec to STDOUT: %v", err)
-		}
-		return nil
-	}
-
-	return spec.Save(opts.output)
-}
-
-func formatFromFilename(filename string) string {
-	ext := filepath.Ext(filename)
-	switch strings.ToLower(ext) {
-	case ".json":
-		return spec.FormatJSON
-	case ".yaml", ".yml":
-		return spec.FormatYAML
-	}
-
-	return ""
-}
-
-func (m command) generateSpec(opts *options) (spec.Interface, error) {
-	var deviceNamers []nvcdi.DeviceNamer
-	for _, strategy := range opts.deviceNameStrategies.Value() {
-		deviceNamer, err := nvcdi.NewDeviceNamer(strategy)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create device namer: %v", err)
-		}
-		deviceNamers = append(deviceNamers, deviceNamer)
-	}
-
-	cdilib, err := nvcdi.New(
-		nvcdi.WithLogger(m.logger),
-		nvcdi.WithDriverRoot(opts.driverRoot),
-		nvcdi.WithDevRoot(opts.devRoot),
-		nvcdi.WithNVIDIACDIHookPath(opts.nvidiaCDIHookPath),
-		nvcdi.WithLdconfigPath(opts.ldconfigPath),
-		nvcdi.WithDeviceNamers(deviceNamers...),
-		nvcdi.WithMode(opts.mode),
-		nvcdi.WithConfigSearchPaths(opts.configSearchPaths.Value()),
-		nvcdi.WithLibrarySearchPaths(opts.librarySearchPaths.Value()),
-		nvcdi.WithCSVFiles(opts.csv.files.Value()),
-		nvcdi.WithCSVIgnorePatterns(opts.csv.ignorePatterns.Value()),
-	)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create CDI library: %v", err)
-	}
-
-	deviceSpecs, err := cdilib.GetAllDeviceSpecs()
-	if err != nil {
-		return nil, fmt.Errorf("failed to create device CDI specs: %v", err)
-	}
-
-	commonEdits, err := cdilib.GetCommonEdits()
-	if err != nil {
-		return nil, fmt.Errorf("failed to create edits common for entities: %v", err)
-	}
-
-	return spec.New(
-		spec.WithVendor(opts.vendor),
-		spec.WithClass(opts.class),
-		spec.WithDeviceSpecs(deviceSpecs),
-		spec.WithEdits(*commonEdits.ContainerEdits),
-		spec.WithFormat(opts.format),
-		spec.WithMergedDeviceOptions(
-			transform.WithName(allDeviceName),
-			transform.WithSkipIfExists(true),
-		),
-		spec.WithPermissions(0644),
-	)
-}

cmd/nvidia-ctk/cdi/list/list.go

@@ -1,104 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package list
-
-import (
-	"errors"
-	"fmt"
-
-	"github.com/urfave/cli/v2"
-	"tags.cncf.io/container-device-interface/pkg/cdi"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type config struct {
-	cdiSpecDirs cli.StringSlice
-}
-
-// NewCommand constructs a cdi list command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build creates the CLI command
-func (m command) build() *cli.Command {
-	cfg := config{}
-
-	// Create the command
-	c := cli.Command{
-		Name:  "list",
-		Usage: "List the available CDI devices",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &cfg)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringSliceFlag{
-			Name:        "spec-dir",
-			Usage:       "specify the directories to scan for CDI specifications",
-			Value:       cli.NewStringSlice(cdi.DefaultSpecDirs...),
-			Destination: &cfg.cdiSpecDirs,
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(c *cli.Context, cfg *config) error {
-	if len(cfg.cdiSpecDirs.Value()) == 0 {
-		return errors.New("at least one CDI specification directory must be specified")
-	}
-	return nil
-}
-
-func (m command) run(c *cli.Context, cfg *config) error {
-	registry, err := cdi.NewCache(
-		cdi.WithAutoRefresh(false),
-		cdi.WithSpecDirs(cfg.cdiSpecDirs.Value()...),
-	)
-	if err != nil {
-		return fmt.Errorf("failed to create CDI cache: %v", err)
-	}
-
-	_ = registry.Refresh()
-	if errors := registry.GetErrors(); len(errors) > 0 {
-		m.logger.Warningf("The following registry errors were reported:")
-		for k, err := range errors {
-			m.logger.Warningf("%v: %v", k, err)
-		}
-	}
-
-	devices := registry.ListDevices()
-	m.logger.Infof("Found %d CDI devices", len(devices))
-	for _, device := range devices {
-		fmt.Printf("%s\n", device)
-	}
-
-	return nil
-}

cmd/nvidia-ctk/cdi/transform/root/root.go

@@ -1,169 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package root
-
-import (
-	"fmt"
-	"io"
-	"os"
-
-	"github.com/urfave/cli/v2"
-	"tags.cncf.io/container-device-interface/pkg/cdi"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/nvcdi/spec"
-	transformroot "github.com/NVIDIA/nvidia-container-toolkit/pkg/nvcdi/transform/root"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type transformOptions struct {
-	input  string
-	output string
-}
-
-type options struct {
-	transformOptions
-	from       string
-	to         string
-	relativeTo string
-}
-
-// NewCommand constructs a generate-cdi command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build creates the CLI command
-func (m command) build() *cli.Command {
-	opts := options{}
-
-	c := cli.Command{
-		Name:  "root",
-		Usage: "Apply a root transform to a CDI specification",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &opts)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &opts)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:        "from",
-			Usage:       "specify the root to be transformed",
-			Destination: &opts.from,
-		},
-		&cli.StringFlag{
-			Name:        "input",
-			Usage:       "Specify the file to read the CDI specification from. If this is '-' the specification is read from STDIN",
-			Value:       "-",
-			Destination: &opts.input,
-		},
-		&cli.StringFlag{
-			Name:        "output",
-			Usage:       "Specify the file to output the generated CDI specification to. If this is '' the specification is output to STDOUT",
-			Destination: &opts.output,
-		},
-		&cli.StringFlag{
-			Name:        "relative-to",
-			Usage:       "specify whether the transform is relative to the host or to the container. One of [ host | container ]",
-			Value:       "host",
-			Destination: &opts.relativeTo,
-		},
-		&cli.StringFlag{
-			Name:        "to",
-			Usage:       "specify the replacement root. If this is the same as the from root, the transform is a no-op.",
-			Value:       "",
-			Destination: &opts.to,
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(c *cli.Context, opts *options) error {
-	switch opts.relativeTo {
-	case "host":
-	case "container":
-	default:
-		return fmt.Errorf("invalid --relative-to value: %v", opts.relativeTo)
-	}
-	return nil
-}
-
-func (m command) run(c *cli.Context, opts *options) error {
-	spec, err := opts.Load()
-	if err != nil {
-		return fmt.Errorf("failed to load CDI specification: %w", err)
-	}
-
-	err = transformroot.New(
-		transformroot.WithRoot(opts.from),
-		transformroot.WithTargetRoot(opts.to),
-		transformroot.WithRelativeTo(opts.relativeTo),
-	).Transform(spec.Raw())
-	if err != nil {
-		return fmt.Errorf("failed to transform CDI specification: %w", err)
-	}
-
-	return opts.Save(spec)
-}
-
-// Load lodas the input CDI specification
-func (o transformOptions) Load() (spec.Interface, error) {
-	contents, err := o.getContents()
-	if err != nil {
-		return nil, fmt.Errorf("failed to read spec contents: %v", err)
-	}
-
-	raw, err := cdi.ParseSpec(contents)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse CDI spec: %v", err)
-	}
-
-	return spec.New(
-		spec.WithRawSpec(raw),
-	)
-}
-
-func (o transformOptions) getContents() ([]byte, error) {
-	if o.input == "-" {
-		return io.ReadAll(os.Stdin)
-	}
-
-	return os.ReadFile(o.input)
-}
-
-// Save saves the CDI specification to the output file
-func (o transformOptions) Save(s spec.Interface) error {
-	if o.output == "" {
-		_, err := s.WriteTo(os.Stdout)
-		if err != nil {
-			return fmt.Errorf("failed to write CDI spec to STDOUT: %v", err)
-		}
-		return nil
-	}
-
-	return s.Save(o.output)
-}

cmd/nvidia-ctk/cdi/transform/transform.go

@@ -1,52 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package transform
-
-import (
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi/transform/root"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs a command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build creates the CLI command
-func (m command) build() *cli.Command {
-	c := cli.Command{
-		Name:  "transform",
-		Usage: "Apply a transform to a CDI specification",
-	}
-
-	c.Flags = []cli.Flag{}
-
-	c.Subcommands = []*cli.Command{
-		root.NewCommand(m.logger),
-	}
-
-	return &c
-}

cmd/nvidia-ctk/config/config.go

@@ -1,244 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package config
-
-import (
-	"errors"
-	"fmt"
-	"reflect"
-	"strconv"
-	"strings"
-
-	"github.com/urfave/cli/v2"
-
-	createdefault "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/config/create-default"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/config/flags"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-// options stores the subcommand options
-type options struct {
-	flags.Options
-	setListSeparator string
-	sets             cli.StringSlice
-}
-
-// NewCommand constructs an config command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build
-func (m command) build() *cli.Command {
-	opts := options{}
-
-	// Create the 'config' command
-	c := cli.Command{
-		Name:  "config",
-		Usage: "Interact with the NVIDIA Container Toolkit configuration",
-		Before: func(ctx *cli.Context) error {
-			return validateFlags(ctx, &opts)
-		},
-		Action: func(ctx *cli.Context) error {
-			return run(ctx, &opts)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:        "config-file",
-			Aliases:     []string{"config", "c"},
-			Usage:       "Specify the config file to modify.",
-			Value:       config.GetConfigFilePath(),
-			Destination: &opts.Config,
-		},
-		&cli.StringSliceFlag{
-			Name: "set",
-			Usage: "Set a config value using the pattern 'key[=value]'. " +
-				"Specifying only 'key' is equivalent to 'key=true' for boolean settings. " +
-				"This flag can be specified multiple times, but only the last value for a specific " +
-				"config option is applied. " +
-				"If the setting represents a list, the elements are colon-separated.",
-			Destination: &opts.sets,
-		},
-		&cli.StringFlag{
-			Name:        "set-list-separator",
-			Usage:       "Specify a separator for lists applied using the set command.",
-			Hidden:      true,
-			Value:       ":",
-			Destination: &opts.setListSeparator,
-		},
-		&cli.BoolFlag{
-			Name:        "in-place",
-			Aliases:     []string{"i"},
-			Usage:       "Modify the config file in-place",
-			Destination: &opts.InPlace,
-		},
-		&cli.StringFlag{
-			Name:        "output",
-			Aliases:     []string{"o"},
-			Usage:       "Specify the output file to write to; If not specified, the output is written to stdout",
-			Destination: &opts.Output,
-		},
-	}
-
-	c.Subcommands = []*cli.Command{
-		createdefault.NewCommand(m.logger),
-	}
-
-	return &c
-}
-
-func validateFlags(c *cli.Context, opts *options) error {
-	if opts.setListSeparator == "" {
-		return fmt.Errorf("set-list-separator must be set")
-	}
-	return nil
-}
-
-func run(c *cli.Context, opts *options) error {
-	cfgToml, err := config.New(
-		config.WithConfigFile(opts.Config),
-	)
-	if err != nil {
-		return fmt.Errorf("unable to create config: %v", err)
-	}
-
-	for _, set := range opts.sets.Value() {
-		key, value, err := setFlagToKeyValue(set, opts.setListSeparator)
-		if err != nil {
-			return fmt.Errorf("invalid --set option %v: %w", set, err)
-		}
-		if value == nil {
-			_ = cfgToml.Delete(key)
-		} else {
-			cfgToml.Set(key, value)
-		}
-	}
-
-	if err := opts.EnsureOutputFolder(); err != nil {
-		return fmt.Errorf("failed to create output directory: %v", err)
-	}
-	output, err := opts.CreateOutput()
-	if err != nil {
-		return fmt.Errorf("failed to open output file: %v", err)
-	}
-	defer output.Close()
-
-	if _, err := cfgToml.Save(output); err != nil {
-		return fmt.Errorf("failed to save config: %v", err)
-	}
-
-	return nil
-}
-
-var errInvalidConfigOption = errors.New("invalid config option")
-var errUndefinedField = errors.New("undefined field")
-var errInvalidFormat = errors.New("invalid format")
-
-// setFlagToKeyValue converts a --set flag to a key-value pair.
-// The set flag is of the form key[=value], with the value being optional if key refers to a
-// boolean config option.
-func setFlagToKeyValue(setFlag string, setListSeparator string) (string, interface{}, error) {
-	setParts := strings.SplitN(setFlag, "=", 2)
-	key := setParts[0]
-
-	field, err := getField(key)
-	if err != nil {
-		return key, nil, fmt.Errorf("%w: %w", errInvalidConfigOption, err)
-	}
-
-	kind := field.Kind()
-	if len(setParts) != 2 {
-		if kind == reflect.Bool || (kind == reflect.Pointer && field.Elem().Kind() == reflect.Bool) {
-			return key, true, nil
-		}
-		return key, nil, fmt.Errorf("%w: expected key=value; got %v", errInvalidFormat, setFlag)
-	}
-
-	value := setParts[1]
-	if kind == reflect.Pointer && value != "nil" {
-		kind = field.Elem().Kind()
-	}
-	switch kind {
-	case reflect.Pointer:
-		return key, nil, nil
-	case reflect.Bool:
-		b, err := strconv.ParseBool(value)
-		if err != nil {
-			return key, value, fmt.Errorf("%w: %w", errInvalidFormat, err)
-		}
-		return key, b, nil
-	case reflect.String:
-		return key, value, nil
-	case reflect.Slice:
-		valueParts := strings.Split(value, setListSeparator)
-		switch field.Elem().Kind() {
-		case reflect.String:
-			return key, valueParts, nil
-		case reflect.Int:
-			var output []int64
-			for _, v := range valueParts {
-				vi, err := strconv.ParseInt(v, 10, 0)
-				if err != nil {
-					return key, nil, fmt.Errorf("%w: %w", errInvalidFormat, err)
-				}
-				output = append(output, vi)
-			}
-			return key, output, nil
-		}
-	}
-	return key, nil, fmt.Errorf("unsupported type for %v (%v)", setParts, kind)
-}
-
-func getField(key string) (reflect.Type, error) {
-	s, err := getStruct(reflect.TypeOf(config.Config{}), strings.Split(key, ".")...)
-	if err != nil {
-		return nil, err
-	}
-	return s.Type, err
-}
-
-func getStruct(current reflect.Type, paths ...string) (reflect.StructField, error) {
-	if len(paths) < 1 {
-		return reflect.StructField{}, fmt.Errorf("%w: no fields selected", errUndefinedField)
-	}
-	tomlField := paths[0]
-	for i := 0; i < current.NumField(); i++ {
-		f := current.Field(i)
-		v, ok := f.Tag.Lookup("toml")
-		if !ok {
-			continue
-		}
-		if strings.SplitN(v, ",", 2)[0] != tomlField {
-			continue
-		}
-		if len(paths) == 1 {
-			return f, nil
-		}
-		return getStruct(f.Type, paths[1:]...)
-	}
-	return reflect.StructField{}, fmt.Errorf("%w: %q", errUndefinedField, tomlField)
-}

cmd/nvidia-ctk/config/config_test.go

@@ -1,143 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package config
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestSetFlagToKeyValue(t *testing.T) {
-	// TODO: We need to enable this test again since switching to reflect.
-	testCases := []struct {
-		description      string
-		setFlag          string
-		setListSeparator string
-		expectedKey      string
-		expectedValue    interface{}
-		expectedError    error
-	}{
-		{
-			description:   "option not present returns an error",
-			setFlag:       "undefined=new-value",
-			expectedKey:   "undefined",
-			expectedError: errInvalidConfigOption,
-		},
-		{
-			description:   "undefined nexted option returns error",
-			setFlag:       "nvidia-container-cli.undefined",
-			expectedKey:   "nvidia-container-cli.undefined",
-			expectedError: errInvalidConfigOption,
-		},
-		{
-			description:   "boolean option assumes true",
-			setFlag:       "disable-require",
-			expectedKey:   "disable-require",
-			expectedValue: true,
-		},
-		{
-			description:   "boolean option returns true",
-			setFlag:       "disable-require=true",
-			expectedKey:   "disable-require",
-			expectedValue: true,
-		},
-		{
-			description:   "boolean option returns false",
-			setFlag:       "disable-require=false",
-			expectedKey:   "disable-require",
-			expectedValue: false,
-		},
-		{
-			description:   "invalid boolean option returns error",
-			setFlag:       "disable-require=something",
-			expectedKey:   "disable-require",
-			expectedValue: "something",
-			expectedError: errInvalidFormat,
-		},
-		{
-			description:   "string option requires value",
-			setFlag:       "swarm-resource",
-			expectedKey:   "swarm-resource",
-			expectedValue: nil,
-			expectedError: errInvalidFormat,
-		},
-		{
-			description:   "string option returns value",
-			setFlag:       "swarm-resource=string-value",
-			expectedKey:   "swarm-resource",
-			expectedValue: "string-value",
-		},
-		{
-			description:   "string option returns value with equals",
-			setFlag:       "swarm-resource=string-value=more",
-			expectedKey:   "swarm-resource",
-			expectedValue: "string-value=more",
-		},
-		{
-			description:   "string option treats bool value as string",
-			setFlag:       "swarm-resource=true",
-			expectedKey:   "swarm-resource",
-			expectedValue: "true",
-		},
-		{
-			description:   "string option treats int value as string",
-			setFlag:       "swarm-resource=5",
-			expectedKey:   "swarm-resource",
-			expectedValue: "5",
-		},
-		{
-			description:   "[]string option returns single value",
-			setFlag:       "nvidia-container-cli.environment=string-value",
-			expectedKey:   "nvidia-container-cli.environment",
-			expectedValue: []string{"string-value"},
-		},
-		{
-			description:      "[]string option returns multiple values",
-			setFlag:          "nvidia-container-cli.environment=first,second",
-			setListSeparator: ",",
-			expectedKey:      "nvidia-container-cli.environment",
-			expectedValue:    []string{"first", "second"},
-		},
-		{
-			description:      "[]string option returns values with equals",
-			setFlag:          "nvidia-container-cli.environment=first=1,second=2",
-			setListSeparator: ",",
-			expectedKey:      "nvidia-container-cli.environment",
-			expectedValue:    []string{"first=1", "second=2"},
-		},
-		{
-			description:      "[]string option returns multiple values semi-colon",
-			setFlag:          "nvidia-container-cli.environment=first;second",
-			setListSeparator: ";",
-			expectedKey:      "nvidia-container-cli.environment",
-			expectedValue:    []string{"first", "second"},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			if tc.setListSeparator == "" {
-				tc.setListSeparator = ","
-			}
-			k, v, err := setFlagToKeyValue(tc.setFlag, tc.setListSeparator)
-			require.ErrorIs(t, err, tc.expectedError)
-			require.EqualValues(t, tc.expectedKey, k)
-			require.EqualValues(t, tc.expectedValue, v)
-		})
-	}
-}

cmd/nvidia-ctk/config/create-default/create-default.go

@@ -1,94 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package defaultsubcommand
-
-import (
-	"fmt"
-
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/config/flags"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs a default command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build creates the CLI command
-func (m command) build() *cli.Command {
-	opts := flags.Options{}
-
-	// Create the 'default' command
-	c := cli.Command{
-		Name:    "default",
-		Aliases: []string{"create-default", "generate-default"},
-		Usage:   "Generate the default NVIDIA Container Toolkit configuration file",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &opts)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &opts)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:        "output",
-			Aliases:     []string{"o"},
-			Usage:       "Specify the output file to write to; If not specified, the output is written to stdout",
-			Destination: &opts.Output,
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(c *cli.Context, opts *flags.Options) error {
-	return opts.Validate()
-}
-
-func (m command) run(c *cli.Context, opts *flags.Options) error {
-	cfgToml, err := config.New()
-	if err != nil {
-		return fmt.Errorf("unable to load or create config: %v", err)
-	}
-
-	if err := opts.EnsureOutputFolder(); err != nil {
-		return fmt.Errorf("failed to create output directory: %v", err)
-	}
-	output, err := opts.CreateOutput()
-	if err != nil {
-		return fmt.Errorf("failed to open output file: %v", err)
-	}
-	defer output.Close()
-
-	if _, err = cfgToml.Save(output); err != nil {
-		return fmt.Errorf("failed to write output: %v", err)
-	}
-
-	return nil
-}

cmd/nvidia-ctk/config/flags/options.go

@@ -1,82 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package flags
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-)
-
-// Options stores options for the config commands
-type Options struct {
-	Config  string
-	Output  string
-	InPlace bool
-}
-
-// Validate checks whether the options are valid.
-func (o Options) Validate() error {
-	if o.InPlace && o.Output != "" {
-		return fmt.Errorf("cannot specify both --in-place and --output")
-	}
-
-	return nil
-}
-
-// GetOutput returns the effective output
-func (o Options) GetOutput() string {
-	if o.InPlace {
-		return o.Config
-	}
-
-	return o.Output
-}
-
-// EnsureOutputFolder creates the output folder if it does not exist.
-// If the output folder is not specified (i.e. output to STDOUT), it is ignored.
-func (o Options) EnsureOutputFolder() error {
-	output := o.GetOutput()
-	if output == "" {
-		return nil
-	}
-	if dir := filepath.Dir(output); dir != "" {
-		return os.MkdirAll(dir, 0755)
-	}
-	return nil
-}
-
-// CreateOutput creates the writer for the output.
-func (o Options) CreateOutput() (io.WriteCloser, error) {
-	output := o.GetOutput()
-	if output == "" {
-		return nullCloser{os.Stdout}, nil
-	}
-
-	return os.Create(output)
-}
-
-// nullCloser is a writer that does nothing on Close.
-type nullCloser struct {
-	io.Writer
-}
-
-// Close is a no-op for a nullCloser.
-func (d nullCloser) Close() error {
-	return nil
-}

cmd/nvidia-ctk/hook/hook.go

@@ -1,49 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package hook
-
-import (
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/commands"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-
-	"github.com/urfave/cli/v2"
-)
-
-type hookCommand struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs a hook command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := hookCommand{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build
-func (m hookCommand) build() *cli.Command {
-	// Create the 'hook' command
-	hook := cli.Command{
-		Name:  "hook",
-		Usage: "A collection of hooks that may be injected into an OCI spec",
-	}
-
-	hook.Subcommands = commands.New(m.logger)
-
-	return &hook
-}

cmd/nvidia-ctk/info/info.go

@@ -1,48 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package info
-
-import (
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs an info command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build
-func (m command) build() *cli.Command {
-	// Create the 'info' command
-	info := cli.Command{
-		Name:  "info",
-		Usage: "Provide information about the system",
-	}
-
-	info.Subcommands = []*cli.Command{}
-
-	return &info
-}

cmd/nvidia-ctk/main.go

@@ -1,104 +0,0 @@
-/**
-# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package main
-
-import (
-	"os"
-
-	"github.com/sirupsen/logrus"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/config"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/hook"
-	infoCLI "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/info"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/runtime"
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/system"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/info"
-
-	cli "github.com/urfave/cli/v2"
-)
-
-// options defines the options that can be set for the CLI through config files,
-// environment variables, or command line flags
-type options struct {
-	// Debug indicates whether the CLI is started in "debug" mode
-	Debug bool
-	// Quiet indicates whether the CLI is started in "quiet" mode
-	Quiet bool
-}
-
-func main() {
-	logger := logrus.New()
-
-	// Create a options struct to hold the parsed environment variables or command line flags
-	opts := options{}
-
-	// Create the top-level CLI
-	c := cli.NewApp()
-	c.Name = "NVIDIA Container Toolkit CLI"
-	c.UseShortOptionHandling = true
-	c.EnableBashCompletion = true
-	c.Usage = "Tools to configure the NVIDIA Container Toolkit"
-	c.Version = info.GetVersionString()
-
-	// Setup the flags for this command
-	c.Flags = []cli.Flag{
-		&cli.BoolFlag{
-			Name:        "debug",
-			Aliases:     []string{"d"},
-			Usage:       "Enable debug-level logging",
-			Destination: &opts.Debug,
-			EnvVars:     []string{"NVIDIA_CTK_DEBUG"},
-		},
-		&cli.BoolFlag{
-			Name:        "quiet",
-			Usage:       "Suppress all output except for errors; overrides --debug",
-			Destination: &opts.Quiet,
-			EnvVars:     []string{"NVIDIA_CTK_QUIET"},
-		},
-	}
-
-	// Set log-level for all subcommands
-	c.Before = func(c *cli.Context) error {
-		logLevel := logrus.InfoLevel
-		if opts.Debug {
-			logLevel = logrus.DebugLevel
-		}
-		if opts.Quiet {
-			logLevel = logrus.ErrorLevel
-		}
-		logger.SetLevel(logLevel)
-		return nil
-	}
-
-	// Define the subcommands
-	c.Commands = []*cli.Command{
-		hook.NewCommand(logger),
-		runtime.NewCommand(logger),
-		infoCLI.NewCommand(logger),
-		cdi.NewCommand(logger),
-		system.NewCommand(logger),
-		config.NewCommand(logger),
-	}
-
-	// Run the CLI
-	err := c.Run(os.Args)
-	if err != nil {
-		logger.Errorf("%v", err)
-		os.Exit(1)
-	}
-}

cmd/nvidia-ctk/runtime/configure/configure.go

@@ -1,359 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package configure
-
-import (
-	"fmt"
-	"path/filepath"
-
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine/containerd"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine/crio"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine/docker"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/ocihook"
-	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/toml"
-)
-
-const (
-	defaultRuntime = "docker"
-
-	// defaultNVIDIARuntimeName is the default name to use in configs for the NVIDIA Container Runtime
-	defaultNVIDIARuntimeName = "nvidia"
-	// defaultNVIDIARuntimeExecutable is the default NVIDIA Container Runtime executable file name
-	defaultNVIDIARuntimeExecutable          = "nvidia-container-runtime"
-	defaultNVIDIARuntimeExpecutablePath     = "/usr/bin/nvidia-container-runtime"
-	defaultNVIDIARuntimeHookExpecutablePath = "/usr/bin/nvidia-container-runtime-hook"
-
-	defaultContainerdConfigFilePath = "/etc/containerd/config.toml"
-	defaultCrioConfigFilePath       = "/etc/crio/crio.conf"
-	defaultDockerConfigFilePath     = "/etc/docker/daemon.json"
-
-	defaultConfigSource = configSourceFile
-	configSourceCommand = "command"
-	configSourceFile    = "file"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs a configure command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// config defines the options that can be set for the CLI through config files,
-// environment variables, or command line config
-type config struct {
-	dryRun         bool
-	runtime        string
-	configFilePath string
-	executablePath string
-	configSource   string
-	mode           string
-	hookFilePath   string
-
-	nvidiaRuntime struct {
-		name         string
-		path         string
-		hookPath     string
-		setAsDefault bool
-	}
-
-	// cdi-specific options
-	cdi struct {
-		enabled bool
-	}
-}
-
-func (m command) build() *cli.Command {
-	// Create a config struct to hold the parsed environment variables or command line flags
-	config := config{}
-
-	// Create the 'configure' command
-	configure := cli.Command{
-		Name:  "configure",
-		Usage: "Add a runtime to the specified container engine",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &config)
-		},
-		Action: func(c *cli.Context) error {
-			return m.configureWrapper(c, &config)
-		},
-	}
-
-	configure.Flags = []cli.Flag{
-		&cli.BoolFlag{
-			Name:        "dry-run",
-			Usage:       "update the runtime configuration as required but don't write changes to disk",
-			Destination: &config.dryRun,
-		},
-		&cli.StringFlag{
-			Name:        "runtime",
-			Usage:       "the target runtime engine; one of [containerd, crio, docker]",
-			Value:       defaultRuntime,
-			Destination: &config.runtime,
-		},
-		&cli.StringFlag{
-			Name:        "config",
-			Usage:       "path to the config file for the target runtime",
-			Destination: &config.configFilePath,
-		},
-		&cli.StringFlag{
-			Name:        "executable-path",
-			Usage:       "The path to the runtime executable. This is used to extract the current config",
-			Destination: &config.executablePath,
-		},
-		&cli.StringFlag{
-			Name:        "config-mode",
-			Usage:       "the config mode for runtimes that support multiple configuration mechanisms",
-			Destination: &config.mode,
-		},
-		&cli.StringFlag{
-			Name:        "config-source",
-			Usage:       "the source to retrieve the container runtime configuration; one of [command, file]\"",
-			Destination: &config.configSource,
-			Value:       defaultConfigSource,
-		},
-		&cli.StringFlag{
-			Name:        "oci-hook-path",
-			Usage:       "the path to the OCI runtime hook to create if --config-mode=oci-hook is specified. If no path is specified, the generated hook is output to STDOUT.\n\tNote: The use of OCI hooks is deprecated.",
-			Destination: &config.hookFilePath,
-		},
-		&cli.StringFlag{
-			Name:        "nvidia-runtime-name",
-			Usage:       "specify the name of the NVIDIA runtime that will be added",
-			Value:       defaultNVIDIARuntimeName,
-			Destination: &config.nvidiaRuntime.name,
-		},
-		&cli.StringFlag{
-			Name:        "nvidia-runtime-path",
-			Aliases:     []string{"runtime-path"},
-			Usage:       "specify the path to the NVIDIA runtime executable",
-			Value:       defaultNVIDIARuntimeExecutable,
-			Destination: &config.nvidiaRuntime.path,
-		},
-		&cli.StringFlag{
-			Name:        "nvidia-runtime-hook-path",
-			Usage:       "specify the path to the NVIDIA Container Runtime hook executable",
-			Value:       defaultNVIDIARuntimeHookExpecutablePath,
-			Destination: &config.nvidiaRuntime.hookPath,
-		},
-		&cli.BoolFlag{
-			Name:        "nvidia-set-as-default",
-			Aliases:     []string{"set-as-default"},
-			Usage:       "set the NVIDIA runtime as the default runtime",
-			Destination: &config.nvidiaRuntime.setAsDefault,
-		},
-		&cli.BoolFlag{
-			Name:        "cdi.enabled",
-			Aliases:     []string{"cdi.enable", "enable-cdi"},
-			Usage:       "Enable CDI in the configured runtime",
-			Destination: &config.cdi.enabled,
-		},
-	}
-
-	return &configure
-}
-
-func (m command) validateFlags(c *cli.Context, config *config) error {
-	if config.mode == "oci-hook" {
-		if !filepath.IsAbs(config.nvidiaRuntime.hookPath) {
-			return fmt.Errorf("the NVIDIA runtime hook path %q is not an absolute path", config.nvidiaRuntime.hookPath)
-		}
-		return nil
-	}
-	if config.mode != "" && config.mode != "config-file" {
-		m.logger.Warningf("Ignoring unsupported config mode for %v: %q", config.runtime, config.mode)
-	}
-	config.mode = "config-file"
-
-	switch config.runtime {
-	case "containerd", "crio", "docker":
-		break
-	default:
-		return fmt.Errorf("unrecognized runtime '%v'", config.runtime)
-	}
-
-	switch config.runtime {
-	case "containerd", "crio":
-		if config.nvidiaRuntime.path == defaultNVIDIARuntimeExecutable {
-			config.nvidiaRuntime.path = defaultNVIDIARuntimeExpecutablePath
-		}
-		if !filepath.IsAbs(config.nvidiaRuntime.path) {
-			return fmt.Errorf("the NVIDIA runtime path %q is not an absolute path", config.nvidiaRuntime.path)
-		}
-	}
-
-	if config.runtime != "containerd" && config.runtime != "docker" {
-		if config.cdi.enabled {
-			m.logger.Warningf("Ignoring cdi.enabled flag for %v", config.runtime)
-		}
-		config.cdi.enabled = false
-	}
-
-	if config.executablePath != "" && config.runtime == "docker" {
-		m.logger.Warningf("Ignoring executable-path=%q flag for %v", config.executablePath, config.runtime)
-		config.executablePath = ""
-	}
-
-	switch config.configSource {
-	case configSourceCommand:
-		if config.runtime == "docker" {
-			m.logger.Warningf("A %v Config Source is not supported for %v; using %v", config.configSource, config.runtime, configSourceFile)
-			config.configSource = configSourceFile
-		}
-	case configSourceFile:
-		break
-	default:
-		return fmt.Errorf("unrecognized Config Source: %v", config.configSource)
-	}
-
-	if config.configFilePath == "" {
-		switch config.runtime {
-		case "containerd":
-			config.configFilePath = defaultContainerdConfigFilePath
-		case "crio":
-			config.configFilePath = defaultCrioConfigFilePath
-		case "docker":
-			config.configFilePath = defaultDockerConfigFilePath
-		}
-	}
-
-	return nil
-}
-
-// configureWrapper updates the specified container engine config to enable the NVIDIA runtime
-func (m command) configureWrapper(c *cli.Context, config *config) error {
-	switch config.mode {
-	case "oci-hook":
-		return m.configureOCIHook(c, config)
-	case "config-file":
-		return m.configureConfigFile(c, config)
-	}
-	return fmt.Errorf("unsupported config-mode: %v", config.mode)
-}
-
-// configureConfigFile updates the specified container engine config file to enable the NVIDIA runtime.
-func (m command) configureConfigFile(c *cli.Context, config *config) error {
-	configSource, err := config.resolveConfigSource()
-	if err != nil {
-		return err
-	}
-
-	var cfg engine.Interface
-	switch config.runtime {
-	case "containerd":
-		cfg, err = containerd.New(
-			containerd.WithLogger(m.logger),
-			containerd.WithPath(config.configFilePath),
-			containerd.WithConfigSource(configSource),
-		)
-	case "crio":
-		cfg, err = crio.New(
-			crio.WithLogger(m.logger),
-			crio.WithPath(config.configFilePath),
-			crio.WithConfigSource(configSource),
-		)
-	case "docker":
-		cfg, err = docker.New(
-			docker.WithLogger(m.logger),
-			docker.WithPath(config.configFilePath),
-		)
-	default:
-		err = fmt.Errorf("unrecognized runtime '%v'", config.runtime)
-	}
-	if err != nil || cfg == nil {
-		return fmt.Errorf("unable to load config for runtime %v: %v", config.runtime, err)
-	}
-
-	err = cfg.AddRuntime(
-		config.nvidiaRuntime.name,
-		config.nvidiaRuntime.path,
-		config.nvidiaRuntime.setAsDefault,
-	)
-	if err != nil {
-		return fmt.Errorf("unable to update config: %v", err)
-	}
-
-	if config.cdi.enabled {
-		cfg.EnableCDI()
-	}
-
-	outputPath := config.getOutputConfigPath()
-	n, err := cfg.Save(outputPath)
-	if err != nil {
-		return fmt.Errorf("unable to flush config: %v", err)
-	}
-
-	if outputPath != "" {
-		if n == 0 {
-			m.logger.Infof("Removed empty config from %v", outputPath)
-		} else {
-			m.logger.Infof("Wrote updated config to %v", outputPath)
-		}
-		m.logger.Infof("It is recommended that %v daemon be restarted.", config.runtime)
-	}
-
-	return nil
-}
-
-// resolveConfigSource returns the default config source or the user provided config source
-func (c *config) resolveConfigSource() (toml.Loader, error) {
-	switch c.configSource {
-	case configSourceCommand:
-		return c.getCommandConfigSource(), nil
-	case configSourceFile:
-		return toml.FromFile(c.configFilePath), nil
-	default:
-		return nil, fmt.Errorf("unrecognized config source: %s", c.configSource)
-	}
-}
-
-// getConfigSourceCommand returns the default cli command to fetch the current runtime config
-func (c *config) getCommandConfigSource() toml.Loader {
-	switch c.runtime {
-	case "containerd":
-		return containerd.CommandLineSource("", c.executablePath)
-	case "crio":
-		return crio.CommandLineSource("", c.executablePath)
-	}
-	return toml.Empty
-}
-
-// getOutputConfigPath returns the configured config path or "" if dry-run is enabled
-func (c *config) getOutputConfigPath() string {
-	if c.dryRun {
-		return ""
-	}
-	return c.configFilePath
-}
-
-// configureOCIHook creates and configures the OCI hook for the NVIDIA runtime
-func (m *command) configureOCIHook(c *cli.Context, config *config) error {
-	err := ocihook.CreateHook(config.hookFilePath, config.nvidiaRuntime.hookPath)
-	if err != nil {
-		return fmt.Errorf("error creating OCI hook: %v", err)
-	}
-	return nil
-}

cmd/nvidia-ctk/runtime/runtime.go

@@ -1,50 +0,0 @@
-/**
-# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package runtime
-
-import (
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/runtime/configure"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type runtimeCommand struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs a runtime command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := runtimeCommand{
-		logger: logger,
-	}
-	return c.build()
-}
-
-func (m runtimeCommand) build() *cli.Command {
-	// Create the 'runtime' command
-	runtime := cli.Command{
-		Name:  "runtime",
-		Usage: "A collection of runtime-related utilities for the NVIDIA Container Toolkit",
-	}
-
-	runtime.Subcommands = []*cli.Command{
-		configure.NewCommand(m.logger),
-	}
-
-	return &runtime
-}

cmd/nvidia-ctk/system/create-dev-char-symlinks/all.go

@@ -1,188 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package devchar
-
-import (
-	"fmt"
-	"path/filepath"
-
-	"github.com/NVIDIA/go-nvlib/pkg/nvpci"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/info/proc/devices"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/nvcaps"
-)
-
-type allPossible struct {
-	logger       logger.Interface
-	devRoot      string
-	deviceMajors devices.Devices
-	migCaps      nvcaps.MigCaps
-}
-
-// newAllPossible returns a new allPossible device node lister.
-// This lister lists all possible device nodes for NVIDIA GPUs, control devices, and capability devices.
-func newAllPossible(logger logger.Interface, devRoot string) (nodeLister, error) {
-	deviceMajors, err := devices.GetNVIDIADevices()
-	if err != nil {
-		return nil, fmt.Errorf("failed reading device majors: %v", err)
-	}
-
-	var requiredMajors []devices.Name
-	migCaps, err := nvcaps.NewMigCaps()
-	if err != nil {
-		return nil, fmt.Errorf("failed to read MIG caps: %v", err)
-	}
-	if migCaps == nil {
-		migCaps = make(nvcaps.MigCaps)
-	} else {
-		requiredMajors = append(requiredMajors, devices.NVIDIACaps)
-	}
-
-	requiredMajors = append(requiredMajors, devices.NVIDIAGPU, devices.NVIDIAUVM)
-	for _, name := range requiredMajors {
-		if !deviceMajors.Exists(name) {
-			return nil, fmt.Errorf("missing required device major %s", name)
-		}
-	}
-
-	l := allPossible{
-		logger:       logger,
-		devRoot:      devRoot,
-		deviceMajors: deviceMajors,
-		migCaps:      migCaps,
-	}
-
-	return l, nil
-}
-
-// DeviceNodes returns a list of all possible device nodes for NVIDIA GPUs, control devices, and capability devices.
-func (m allPossible) DeviceNodes() ([]deviceNode, error) {
-	gpus, err := nvpci.New(
-		nvpci.WithPCIDevicesRoot(filepath.Join(m.devRoot, nvpci.PCIDevicesRoot)),
-		nvpci.WithLogger(m.logger),
-	).GetGPUs()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get GPU information: %v", err)
-	}
-
-	count := len(gpus)
-	if count == 0 {
-		m.logger.Infof("No NVIDIA devices found in %s", m.devRoot)
-		return nil, nil
-	}
-
-	deviceNodes, err := m.getControlDeviceNodes()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get control device nodes: %v", err)
-	}
-
-	for gpu := 0; gpu < count; gpu++ {
-		deviceNodes = append(deviceNodes, m.getGPUDeviceNodes(gpu)...)
-		deviceNodes = append(deviceNodes, m.getNVCapDeviceNodes(gpu)...)
-	}
-
-	return deviceNodes, nil
-}
-
-// getControlDeviceNodes generates a list of control devices
-func (m allPossible) getControlDeviceNodes() ([]deviceNode, error) {
-	var deviceNodes []deviceNode
-
-	// Define the control devices for standard GPUs.
-	controlDevices := []deviceNode{
-		m.newDeviceNode(devices.NVIDIAGPU, "/dev/nvidia-modeset", devices.NVIDIAModesetMinor),
-		m.newDeviceNode(devices.NVIDIAGPU, "/dev/nvidiactl", devices.NVIDIACTLMinor),
-		m.newDeviceNode(devices.NVIDIAUVM, "/dev/nvidia-uvm", devices.NVIDIAUVMMinor),
-		m.newDeviceNode(devices.NVIDIAUVM, "/dev/nvidia-uvm-tools", devices.NVIDIAUVMToolsMinor),
-	}
-
-	deviceNodes = append(deviceNodes, controlDevices...)
-
-	for _, migControlDevice := range []nvcaps.MigCap{"config", "monitor"} {
-		migControlMinor, exist := m.migCaps[migControlDevice]
-		if !exist {
-			continue
-		}
-
-		d := m.newDeviceNode(
-			devices.NVIDIACaps,
-			migControlMinor.DevicePath(),
-			int(migControlMinor),
-		)
-
-		deviceNodes = append(deviceNodes, d)
-	}
-
-	return deviceNodes, nil
-}
-
-// getGPUDeviceNodes generates a list of device nodes for a given GPU.
-func (m allPossible) getGPUDeviceNodes(gpu int) []deviceNode {
-	d := m.newDeviceNode(
-		devices.NVIDIAGPU,
-		fmt.Sprintf("/dev/nvidia%d", gpu),
-		gpu,
-	)
-
-	return []deviceNode{d}
-}
-
-// getNVCapDeviceNodes generates a list of cap device nodes for a given GPU.
-func (m allPossible) getNVCapDeviceNodes(gpu int) []deviceNode {
-	var selectedCapMinors []nvcaps.MigMinor
-	for gi := 0; ; gi++ {
-		giCap := nvcaps.NewGPUInstanceCap(gpu, gi)
-		giMinor, exist := m.migCaps[giCap]
-		if !exist {
-			break
-		}
-		selectedCapMinors = append(selectedCapMinors, giMinor)
-		for ci := 0; ; ci++ {
-			ciCap := nvcaps.NewComputeInstanceCap(gpu, gi, ci)
-			ciMinor, exist := m.migCaps[ciCap]
-			if !exist {
-				break
-			}
-			selectedCapMinors = append(selectedCapMinors, ciMinor)
-		}
-	}
-
-	var deviceNodes []deviceNode
-	for _, capMinor := range selectedCapMinors {
-		d := m.newDeviceNode(
-			devices.NVIDIACaps,
-			capMinor.DevicePath(),
-			int(capMinor),
-		)
-		deviceNodes = append(deviceNodes, d)
-	}
-
-	return deviceNodes
-}
-
-// newDeviceNode creates a new device node with the specified path and major/minor numbers.
-// The path is adjusted for the specified driver root.
-func (m allPossible) newDeviceNode(deviceName devices.Name, path string, minor int) deviceNode {
-	major, _ := m.deviceMajors.Get(deviceName)
-
-	return deviceNode{
-		path:  filepath.Join(m.devRoot, path),
-		major: uint32(major),
-		minor: uint32(minor),
-	}
-}

cmd/nvidia-ctk/system/create-dev-char-symlinks/create-dev-char-symlinks.go

@@ -1,425 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package devchar
-
-import (
-	"fmt"
-	"os"
-	"os/signal"
-	"path/filepath"
-	"strings"
-	"syscall"
-
-	"github.com/fsnotify/fsnotify"
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/system/nvdevices"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/system/nvmodules"
-)
-
-const (
-	defaultDevCharPath = "/dev/char"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type config struct {
-	devCharPath       string
-	driverRoot        string
-	dryRun            bool
-	watch             bool
-	createAll         bool
-	createDeviceNodes bool
-	loadKernelModules bool
-}
-
-// NewCommand constructs a command sub-command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build
-func (m command) build() *cli.Command {
-	cfg := config{}
-
-	// Create the 'create-dev-char-symlinks' command
-	c := cli.Command{
-		Name:  "create-dev-char-symlinks",
-		Usage: "A utility to create symlinks to possible /dev/nv* devices in /dev/char",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &cfg)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:        "dev-char-path",
-			Usage:       "The path at which the symlinks will be created. Symlinks will be created as `DEV_CHAR`/MAJOR:MINOR where MAJOR and MINOR are the major and minor numbers of a corresponding device node.",
-			Value:       defaultDevCharPath,
-			Destination: &cfg.devCharPath,
-			EnvVars:     []string{"DEV_CHAR_PATH"},
-		},
-		&cli.StringFlag{
-			Name:        "driver-root",
-			Usage:       "The path to the driver root. `DRIVER_ROOT`/dev is searched for NVIDIA device nodes.",
-			Value:       "/",
-			Destination: &cfg.driverRoot,
-			EnvVars:     []string{"NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"},
-		},
-		&cli.BoolFlag{
-			Name:        "watch",
-			Usage:       "If set, the command will watch for changes to the driver root and recreate the symlinks when changes are detected.",
-			Value:       false,
-			Destination: &cfg.watch,
-			EnvVars:     []string{"WATCH"},
-		},
-		&cli.BoolFlag{
-			Name:        "create-all",
-			Usage:       "Create all possible /dev/char symlinks instead of limiting these to existing device nodes.",
-			Destination: &cfg.createAll,
-			EnvVars:     []string{"CREATE_ALL"},
-		},
-		&cli.BoolFlag{
-			Name:        "load-kernel-modules",
-			Usage:       "Load the NVIDIA kernel modules before creating symlinks. This is only applicable when --create-all is set.",
-			Destination: &cfg.loadKernelModules,
-			EnvVars:     []string{"LOAD_KERNEL_MODULES"},
-		},
-		&cli.BoolFlag{
-			Name:        "create-device-nodes",
-			Usage:       "Create the NVIDIA control device nodes in the driver root if they do not exist. This is only applicable when --create-all is set",
-			Destination: &cfg.createDeviceNodes,
-			EnvVars:     []string{"CREATE_DEVICE_NODES"},
-		},
-		&cli.BoolFlag{
-			Name:        "dry-run",
-			Usage:       "If set, the command will not create any symlinks.",
-			Value:       false,
-			Destination: &cfg.dryRun,
-			EnvVars:     []string{"DRY_RUN"},
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(r *cli.Context, cfg *config) error {
-	if cfg.createAll && cfg.watch {
-		return fmt.Errorf("create-all and watch are mutually exclusive")
-	}
-
-	if cfg.loadKernelModules && !cfg.createAll {
-		m.logger.Warning("load-kernel-modules is only applicable when create-all is set; ignoring")
-		cfg.loadKernelModules = false
-	}
-
-	if cfg.createDeviceNodes && !cfg.createAll {
-		m.logger.Warning("create-device-nodes is only applicable when create-all is set; ignoring")
-		cfg.createDeviceNodes = false
-	}
-
-	return nil
-}
-
-func (m command) run(c *cli.Context, cfg *config) error {
-	var watcher *fsnotify.Watcher
-	var sigs chan os.Signal
-
-	if cfg.watch {
-		watcher, err := newFSWatcher(filepath.Join(cfg.driverRoot, "dev"))
-		if err != nil {
-			return fmt.Errorf("failed to create FS watcher: %v", err)
-		}
-		defer watcher.Close()
-
-		sigs = newOSWatcher(syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
-	}
-
-	l, err := NewSymlinkCreator(
-		WithLogger(m.logger),
-		WithDevCharPath(cfg.devCharPath),
-		WithDriverRoot(cfg.driverRoot),
-		WithDryRun(cfg.dryRun),
-		WithCreateAll(cfg.createAll),
-		WithLoadKernelModules(cfg.loadKernelModules),
-		WithCreateDeviceNodes(cfg.createDeviceNodes),
-	)
-	if err != nil {
-		return fmt.Errorf("failed to create symlink creator: %v", err)
-	}
-
-create:
-	err = l.CreateLinks()
-	if err != nil {
-		return fmt.Errorf("failed to create links: %v", err)
-	}
-	if !cfg.watch {
-		return nil
-	}
-	for {
-		select {
-
-		case event := <-watcher.Events:
-			deviceNode := filepath.Base(event.Name)
-			if !strings.HasPrefix(deviceNode, "nvidia") {
-				continue
-			}
-			if event.Op&fsnotify.Create == fsnotify.Create {
-				m.logger.Infof("%s created, restarting.", event.Name)
-				goto create
-			}
-			if event.Op&fsnotify.Create == fsnotify.Remove {
-				m.logger.Infof("%s removed. Ignoring", event.Name)
-
-			}
-
-		// Watch for any other fs errors and log them.
-		case err := <-watcher.Errors:
-			m.logger.Errorf("inotify: %s", err)
-
-		// React to signals
-		case s := <-sigs:
-			switch s {
-			case syscall.SIGHUP:
-				m.logger.Infof("Received SIGHUP, recreating symlinks.")
-				goto create
-			default:
-				m.logger.Infof("Received signal %q, shutting down.", s)
-				return nil
-			}
-		}
-	}
-}
-
-type linkCreator struct {
-	logger            logger.Interface
-	lister            nodeLister
-	driverRoot        string
-	devRoot           string
-	devCharPath       string
-	dryRun            bool
-	createAll         bool
-	createDeviceNodes bool
-	loadKernelModules bool
-}
-
-// Creator is an interface for creating symlinks to /dev/nv* devices in /dev/char.
-type Creator interface {
-	CreateLinks() error
-}
-
-// Option is a functional option for configuring the linkCreator.
-type Option func(*linkCreator)
-
-// NewSymlinkCreator creates a new linkCreator.
-func NewSymlinkCreator(opts ...Option) (Creator, error) {
-	c := linkCreator{}
-	for _, opt := range opts {
-		opt(&c)
-	}
-	if c.logger == nil {
-		c.logger = logger.New()
-	}
-	if c.driverRoot == "" {
-		c.driverRoot = "/"
-	}
-	if c.devRoot == "" {
-		c.devRoot = "/"
-	}
-	if c.devCharPath == "" {
-		c.devCharPath = defaultDevCharPath
-	}
-
-	if err := c.setup(); err != nil {
-		return nil, err
-	}
-
-	if c.createAll {
-		lister, err := newAllPossible(c.logger, c.devRoot)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create all possible device lister: %v", err)
-		}
-		c.lister = lister
-	} else {
-		c.lister = existing{c.logger, c.devRoot}
-	}
-	return c, nil
-}
-
-func (m linkCreator) setup() error {
-	if !m.loadKernelModules && !m.createDeviceNodes {
-		return nil
-	}
-
-	if m.loadKernelModules {
-		modules := nvmodules.New(
-			nvmodules.WithLogger(m.logger),
-			nvmodules.WithDryRun(m.dryRun),
-			nvmodules.WithRoot(m.driverRoot),
-		)
-		if err := modules.LoadAll(); err != nil {
-			return fmt.Errorf("failed to load NVIDIA kernel modules: %v", err)
-		}
-	}
-
-	if m.createDeviceNodes {
-		devices, err := nvdevices.New(
-			nvdevices.WithLogger(m.logger),
-			nvdevices.WithDryRun(m.dryRun),
-			nvdevices.WithDevRoot(m.devRoot),
-		)
-		if err != nil {
-			return err
-		}
-		if err := devices.CreateNVIDIAControlDevices(); err != nil {
-			return fmt.Errorf("failed to create NVIDIA device nodes: %v", err)
-		}
-	}
-	return nil
-}
-
-// WithDriverRoot sets the driver root path.
-// This is the path in which kernel modules must be loaded.
-func WithDriverRoot(root string) Option {
-	return func(c *linkCreator) {
-		c.driverRoot = root
-	}
-}
-
-// WithDevRoot sets the root path for the /dev directory.
-func WithDevRoot(root string) Option {
-	return func(c *linkCreator) {
-		c.devRoot = root
-	}
-}
-
-// WithDevCharPath sets the path at which the symlinks will be created.
-func WithDevCharPath(path string) Option {
-	return func(c *linkCreator) {
-		c.devCharPath = path
-	}
-}
-
-// WithDryRun sets the dry run flag.
-func WithDryRun(dryRun bool) Option {
-	return func(c *linkCreator) {
-		c.dryRun = dryRun
-	}
-}
-
-// WithLogger sets the logger.
-func WithLogger(logger logger.Interface) Option {
-	return func(c *linkCreator) {
-		c.logger = logger
-	}
-}
-
-// WithCreateAll sets the createAll flag for the linkCreator.
-func WithCreateAll(createAll bool) Option {
-	return func(lc *linkCreator) {
-		lc.createAll = createAll
-	}
-}
-
-// WithLoadKernelModules sets the loadKernelModules flag for the linkCreator.
-func WithLoadKernelModules(loadKernelModules bool) Option {
-	return func(lc *linkCreator) {
-		lc.loadKernelModules = loadKernelModules
-	}
-}
-
-// WithCreateDeviceNodes sets the createDeviceNodes flag for the linkCreator.
-func WithCreateDeviceNodes(createDeviceNodes bool) Option {
-	return func(lc *linkCreator) {
-		lc.createDeviceNodes = createDeviceNodes
-	}
-}
-
-// CreateLinks creates symlinks for all NVIDIA device nodes found in the driver root.
-func (m linkCreator) CreateLinks() error {
-	deviceNodes, err := m.lister.DeviceNodes()
-	if err != nil {
-		return fmt.Errorf("failed to get device nodes: %v", err)
-	}
-
-	if len(deviceNodes) != 0 && !m.dryRun {
-		err := os.MkdirAll(m.devCharPath, 0755)
-		if err != nil {
-			return fmt.Errorf("failed to create directory %s: %v", m.devCharPath, err)
-		}
-	}
-
-	for _, deviceNode := range deviceNodes {
-		target := deviceNode.path
-		linkPath := filepath.Join(m.devCharPath, deviceNode.devCharName())
-
-		m.logger.Infof("Creating link %s => %s", linkPath, target)
-		if m.dryRun {
-			continue
-		}
-
-		err = os.Symlink(target, linkPath)
-		if err != nil {
-			m.logger.Warningf("Could not create symlink: %v", err)
-		}
-	}
-
-	return nil
-}
-
-type deviceNode struct {
-	path  string
-	major uint32
-	minor uint32
-}
-
-func (d deviceNode) devCharName() string {
-	return fmt.Sprintf("%d:%d", d.major, d.minor)
-}
-
-func newFSWatcher(files ...string) (*fsnotify.Watcher, error) {
-	watcher, err := fsnotify.NewWatcher()
-	if err != nil {
-		return nil, err
-	}
-
-	for _, f := range files {
-		err = watcher.Add(f)
-		if err != nil {
-			watcher.Close()
-			return nil, err
-		}
-	}
-
-	return watcher, nil
-}
-
-func newOSWatcher(sigs ...os.Signal) chan os.Signal {
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, sigs...)
-
-	return sigChan
-}

cmd/nvidia-ctk/system/create-dev-char-symlinks/existing.go

@@ -1,89 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package devchar
-
-import (
-	"path/filepath"
-	"strings"
-
-	"golang.org/x/sys/unix"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup"
-)
-
-type nodeLister interface {
-	DeviceNodes() ([]deviceNode, error)
-}
-
-type existing struct {
-	logger  logger.Interface
-	devRoot string
-}
-
-// DeviceNodes returns a list of NVIDIA device nodes in the specified root.
-// The nvidia-nvswitch* and nvidia-nvlink devices are excluded.
-func (m existing) DeviceNodes() ([]deviceNode, error) {
-	locator := lookup.NewCharDeviceLocator(
-		lookup.WithLogger(m.logger),
-		lookup.WithRoot(m.devRoot),
-		lookup.WithOptional(true),
-	)
-
-	devices, err := locator.Locate("/dev/nvidia*")
-	if err != nil {
-		m.logger.Warningf("Error while locating device: %v", err)
-	}
-
-	capDevices, err := locator.Locate("/dev/nvidia-caps/nvidia-*")
-	if err != nil {
-		m.logger.Warningf("Error while locating caps device: %v", err)
-	}
-
-	if len(devices) == 0 && len(capDevices) == 0 {
-		m.logger.Infof("No NVIDIA devices found in %s", m.devRoot)
-		return nil, nil
-	}
-
-	var deviceNodes []deviceNode
-	for _, d := range append(devices, capDevices...) {
-		if m.nodeIsBlocked(d) {
-			continue
-		}
-		var stat unix.Stat_t
-		err := unix.Stat(d, &stat)
-		if err != nil {
-			m.logger.Warningf("Could not stat device: %v", err)
-			continue
-		}
-		deviceNodes = append(deviceNodes, newDeviceNode(d, stat))
-	}
-
-	return deviceNodes, nil
-}
-
-// nodeIsBlocked returns true if the specified device node should be ignored.
-func (m existing) nodeIsBlocked(path string) bool {
-	blockedPrefixes := []string{"nvidia-fs", "nvidia-nvswitch", "nvidia-nvlink"}
-	nodeName := filepath.Base(path)
-	for _, prefix := range blockedPrefixes {
-		if strings.HasPrefix(nodeName, prefix) {
-			return true
-		}
-	}
-	return false
-}

cmd/nvidia-ctk/system/create-dev-char-symlinks/existing_linux.go

@@ -1,28 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package devchar
-
-import "golang.org/x/sys/unix"
-
-func newDeviceNode(d string, stat unix.Stat_t) deviceNode {
-	deviceNode := deviceNode{
-		path:  d,
-		major: unix.Major(stat.Rdev),
-		minor: unix.Minor(stat.Rdev),
-	}
-	return deviceNode
-}

cmd/nvidia-ctk/system/create-device-nodes/create-device-nodes.go

@@ -1,142 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package createdevicenodes
-
-import (
-	"fmt"
-
-	"github.com/urfave/cli/v2"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/system/nvdevices"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/system/nvmodules"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type options struct {
-	root    string
-	devRoot string
-
-	dryRun bool
-
-	control bool
-
-	loadKernelModules bool
-}
-
-// NewCommand constructs a command sub-command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build
-func (m command) build() *cli.Command {
-	opts := options{}
-
-	c := cli.Command{
-		Name:  "create-device-nodes",
-		Usage: "A utility to create NVIDIA device nodes",
-		Before: func(c *cli.Context) error {
-			return m.validateFlags(c, &opts)
-		},
-		Action: func(c *cli.Context) error {
-			return m.run(c, &opts)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name: "root",
-			// TODO: Remove this alias
-			Aliases: []string{"driver-root"},
-			Usage: "the path to to the root to use to load the kernel modules. This root must be a chrootable path. " +
-				"If device nodes to be created these will be created at `ROOT`/dev unless an alternative path is specified",
-			Value:       "/",
-			Destination: &opts.root,
-			// TODO: Remove the NVIDIA_DRIVER_ROOT and DRIVER_ROOT envvars.
-			EnvVars: []string{"ROOT", "NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"},
-		},
-		&cli.StringFlag{
-			Name:        "dev-root",
-			Usage:       "specify the root where `/dev` is located. If this is not specified, the root is assumed.",
-			Destination: &opts.devRoot,
-			EnvVars:     []string{"NVIDIA_DEV_ROOT", "DEV_ROOT"},
-		},
-		&cli.BoolFlag{
-			Name:        "control-devices",
-			Usage:       "create all control device nodes: nvidiactl, nvidia-modeset, nvidia-uvm, nvidia-uvm-tools",
-			Destination: &opts.control,
-		},
-		&cli.BoolFlag{
-			Name:        "load-kernel-modules",
-			Usage:       "load the NVIDIA Kernel Modules before creating devices nodes",
-			Destination: &opts.loadKernelModules,
-		},
-		&cli.BoolFlag{
-			Name:        "dry-run",
-			Usage:       "if set, the command will not perform any operations",
-			Value:       false,
-			Destination: &opts.dryRun,
-			EnvVars:     []string{"DRY_RUN"},
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(r *cli.Context, opts *options) error {
-	if opts.devRoot == "" && opts.root != "" {
-		m.logger.Infof("Using dev-root %q", opts.root)
-		opts.devRoot = opts.root
-	}
-	return nil
-}
-
-func (m command) run(c *cli.Context, opts *options) error {
-	if opts.loadKernelModules {
-		modules := nvmodules.New(
-			nvmodules.WithLogger(m.logger),
-			nvmodules.WithDryRun(opts.dryRun),
-			nvmodules.WithRoot(opts.root),
-		)
-		if err := modules.LoadAll(); err != nil {
-			return fmt.Errorf("failed to load NVIDIA kernel modules: %v", err)
-		}
-	}
-
-	if opts.control {
-		devices, err := nvdevices.New(
-			nvdevices.WithLogger(m.logger),
-			nvdevices.WithDryRun(opts.dryRun),
-			nvdevices.WithDevRoot(opts.devRoot),
-		)
-		if err != nil {
-			return err
-		}
-		m.logger.Infof("Creating control device nodes at %s", opts.devRoot)
-		if err := devices.CreateNVIDIAControlDevices(); err != nil {
-			return fmt.Errorf("failed to create NVIDIA control device nodes: %v", err)
-		}
-	}
-	return nil
-}

cmd/nvidia-ctk/system/system.go

@@ -1,52 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package system
-
-import (
-	"github.com/urfave/cli/v2"
-
-	devchar "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/system/create-dev-char-symlinks"
-	devicenodes "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/system/create-device-nodes"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-// NewCommand constructs a runtime command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-func (m command) build() *cli.Command {
-	// Create the 'system' command
-	system := cli.Command{
-		Name:  "system",
-		Usage: "A collection of system-related utilities for the NVIDIA Container Toolkit",
-	}
-
-	system.Subcommands = []*cli.Command{
-		devchar.NewCommand(m.logger),
-		devicenodes.NewCommand(m.logger),
-	}
-
-	return &system
-}

config/config.toml.amazonlinux

@@ -0,0 +1,18 @@
+disable-require = false
+#swarm-resource = "DOCKER_RESOURCE_GPU"
+#accept-nvidia-visible-devices-envvar-when-unprivileged = true
+#accept-nvidia-visible-devices-as-volume-mounts = false
+
+[nvidia-container-cli]
+#root = "/run/nvidia/driver"
+#path = "/usr/bin/nvidia-container-cli"
+environment = []
+#debug = "/var/log/nvidia-container-toolkit.log"
+#ldcache = "/etc/ld.so.cache"
+load-kmods = true
+#no-cgroups = false
+#user = "root:video"
+ldconfig = "@/sbin/ldconfig"
+
+[nvidia-container-runtime]
+#debug = "/var/log/nvidia-container-runtime.log"

config/config.toml.centos

@@ -0,0 +1,18 @@
+disable-require = false
+#swarm-resource = "DOCKER_RESOURCE_GPU"
+#accept-nvidia-visible-devices-envvar-when-unprivileged = true
+#accept-nvidia-visible-devices-as-volume-mounts = false
+
+[nvidia-container-cli]
+#root = "/run/nvidia/driver"
+#path = "/usr/bin/nvidia-container-cli"
+environment = []
+#debug = "/var/log/nvidia-container-toolkit.log"
+#ldcache = "/etc/ld.so.cache"
+load-kmods = true
+#no-cgroups = false
+#user = "root:video"
+ldconfig = "@/sbin/ldconfig"
+
+[nvidia-container-runtime]
+#debug = "/var/log/nvidia-container-runtime.log"

config/config.toml.debian

@@ -0,0 +1,18 @@
+disable-require = false
+#swarm-resource = "DOCKER_RESOURCE_GPU"
+#accept-nvidia-visible-devices-envvar-when-unprivileged = true
+#accept-nvidia-visible-devices-as-volume-mounts = false
+
+[nvidia-container-cli]
+#root = "/run/nvidia/driver"
+#path = "/usr/bin/nvidia-container-cli"
+environment = []
+#debug = "/var/log/nvidia-container-toolkit.log"
+#ldcache = "/etc/ld.so.cache"
+load-kmods = true
+#no-cgroups = false
+#user = "root:video"
+ldconfig = "@/sbin/ldconfig"
+
+[nvidia-container-runtime]
+#debug = "/var/log/nvidia-container-runtime.log"

config/config.toml.opensuse-leap

@@ -0,0 +1,18 @@
+disable-require = false
+#swarm-resource = "DOCKER_RESOURCE_GPU"
+#accept-nvidia-visible-devices-envvar-when-unprivileged = true
+#accept-nvidia-visible-devices-as-volume-mounts = false
+
+[nvidia-container-cli]
+#root = "/run/nvidia/driver"
+#path = "/usr/bin/nvidia-container-cli"
+environment = []
+#debug = "/var/log/nvidia-container-toolkit.log"
+#ldcache = "/etc/ld.so.cache"
+load-kmods = true
+#no-cgroups = false
+user = "root:video"
+ldconfig = "@/sbin/ldconfig"
+
+[nvidia-container-runtime]
+#debug = "/var/log/nvidia-container-runtime.log"

config/config.toml.ubuntu

@@ -0,0 +1,18 @@
+disable-require = false
+#swarm-resource = "DOCKER_RESOURCE_GPU"
+#accept-nvidia-visible-devices-envvar-when-unprivileged = true
+#accept-nvidia-visible-devices-as-volume-mounts = false
+
+[nvidia-container-cli]
+#root = "/run/nvidia/driver"
+#path = "/usr/bin/nvidia-container-cli"
+environment = []
+#debug = "/var/log/nvidia-container-toolkit.log"
+#ldcache = "/etc/ld.so.cache"
+load-kmods = true
+#no-cgroups = false
+#user = "root:video"
+ldconfig = "@/sbin/ldconfig.real"
+
+[nvidia-container-runtime]
+#debug = "/var/log/nvidia-container-runtime.log"