[no-relnote] Add E2E for libnvidia-container

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

.common-ci.yml

@@ -22,7 +22,15 @@ variables:
   BUILD_MULTI_ARCH_IMAGES: "true"
 
 stages:
-  - pull
+  - trigger
+  - image
+  - lint
+  - go-checks
+  - go-build
+  - unit-tests
+  - package-build
+  - image-build
+  - test
   - scan
   - release
   - sign
@@ -45,6 +53,108 @@ workflow:
     # We then add all the regular triggers
     - !reference [.pipeline-trigger-rules, rules]
 
+# The main or manual job is used to filter out distributions or architectures that are not required on
+# every build.
+.main-or-manual:
+  rules:
+    - !reference [.pipeline-trigger-rules, rules]
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+      when: manual
+
+# The trigger-pipeline job adds a manualy triggered job to the pipeline on merge requests.
+trigger-pipeline:
+  stage: trigger
+  script:
+    - echo "starting pipeline"
+  rules:
+    - !reference [.main-or-manual, rules]
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      when: manual
+      allow_failure: false
+    - when: always
+
+# Define the distribution targets
+.dist-centos7:
+  rules:
+    - !reference [.main-or-manual, rules]
+  variables:
+    DIST: centos7
+
+.dist-centos8:
+  variables:
+    DIST: centos8
+
+.dist-ubi8:
+  rules:
+    - !reference [.main-or-manual, rules]
+  variables:
+    DIST: ubi8
+
+.dist-ubuntu18.04:
+  variables:
+    DIST: ubuntu18.04
+
+.dist-ubuntu20.04:
+  variables:
+    DIST: ubuntu20.04
+
+.dist-packaging:
+  variables:
+    DIST: packaging
+
+# Define architecture targets
+.arch-aarch64:
+  variables:
+    ARCH: aarch64
+
+.arch-amd64:
+  variables:
+    ARCH: amd64
+
+.arch-arm64:
+  variables:
+    ARCH: arm64
+
+.arch-ppc64le:
+  rules:
+    - !reference [.main-or-manual, rules]
+  variables:
+    ARCH: ppc64le
+
+.arch-x86_64:
+  variables:
+    ARCH: x86_64
+
+# Define the platform targets
+.platform-amd64:
+  variables:
+    PLATFORM: linux/amd64
+
+.platform-arm64:
+  variables:
+    PLATFORM: linux/arm64
+
+# Define test helpers
+.integration:
+  stage: test
+  variables:
+    IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
+    VERSION: "${CI_COMMIT_SHORT_SHA}"
+  before_script:
+    - apk add --no-cache make bash jq
+    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
+    - docker pull "${IMAGE_NAME}:${VERSION}-${DIST}"
+  script:
+    - make -f deployments/container/Makefile test-${DIST}
+
+# Define the test targets
+test-packaging:
+  extends:
+    - .integration
+    - .dist-packaging
+  needs:
+    - image-packaging
+
 # Download the regctl binary for use in the release steps
 .regctl-setup:
   before_script:
@@ -54,3 +164,84 @@ workflow:
     - curl -sSLo bin/regctl https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64
     - chmod a+x bin/regctl
     - export PATH=$(pwd)/bin:${PATH}
+
+# .release forms the base of the deployment jobs which push images to the CI registry.
+# This is extended with the version to be deployed (e.g. the SHA or TAG) and the
+# target os.
+.release:
+  stage: release
+  variables:
+    # Define the source image for the release
+    IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
+    VERSION: "${CI_COMMIT_SHORT_SHA}"
+    # OUT_IMAGE_VERSION is overridden for external releases
+    OUT_IMAGE_VERSION: "${CI_COMMIT_SHORT_SHA}"
+  before_script:
+    - !reference [.regctl-setup, before_script]
+    # We ensure that the components of the output image are set:
+    - 'echo Image Name: ${OUT_IMAGE_NAME} ; [[ -n "${OUT_IMAGE_NAME}" ]] || exit 1'
+    - 'echo Version: ${OUT_IMAGE_VERSION} ; [[ -n "${OUT_IMAGE_VERSION}" ]] || exit 1'
+
+    - apk add --no-cache make bash
+  script:
+    # Log in to the "output" registry, tag the image and push the image
+    - 'echo "Logging in to CI registry ${CI_REGISTRY}"'
+    - regctl registry login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
+    - '[ ${CI_REGISTRY} = ${OUT_REGISTRY} ] || echo "Logging in to output registry ${OUT_REGISTRY}"'
+    - '[ ${CI_REGISTRY} = ${OUT_REGISTRY} ] || regctl registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}"'
+
+    # Since OUT_IMAGE_NAME and OUT_IMAGE_VERSION are set, this will push the CI image to the
+    # Target
+    - make -f deployments/container/Makefile push-${DIST}
+
+# Define a staging release step that pushes an image to an internal "staging" repository
+# This is triggered for all pipelines (i.e. not only tags) to test the pipeline steps
+# outside of the release process.
+.release:staging:
+  extends:
+    - .release
+  variables:
+    OUT_REGISTRY_USER: "${NGC_REGISTRY_USER}"
+    OUT_REGISTRY_TOKEN: "${NGC_REGISTRY_TOKEN}"
+    OUT_REGISTRY: "${NGC_REGISTRY}"
+    OUT_IMAGE_NAME: "${NGC_REGISTRY_STAGING_IMAGE_NAME}"
+
+# Define an external release step that pushes an image to an external repository.
+# This includes a devlopment image off main.
+.release:external:
+  extends:
+    - .release
+  variables:
+    FORCE_PUBLISH_IMAGES: "yes"
+  rules:
+    - if: $CI_COMMIT_TAG
+      variables:
+        OUT_IMAGE_VERSION: "${CI_COMMIT_TAG}"
+    - if: $CI_COMMIT_BRANCH == $RELEASE_DEVEL_BRANCH
+      variables:
+        OUT_IMAGE_VERSION: "${DEVEL_RELEASE_IMAGE_VERSION}"
+
+# Define the release jobs
+release:staging-ubi8:
+  extends:
+    - .release:staging
+    - .dist-ubi8
+  needs:
+    - image-ubi8
+
+release:staging-ubuntu20.04:
+  extends:
+    - .release:staging
+    - .dist-ubuntu20.04
+  needs:
+    - test-toolkit-ubuntu20.04
+    - test-containerd-ubuntu20.04
+    - test-crio-ubuntu20.04
+    - test-docker-ubuntu20.04
+
+release:staging-packaging:
+  extends:
+    - .release:staging
+    - .dist-packaging
+  needs:
+    - test-packaging

.github/workflows/e2e.yaml

@@ -72,7 +72,7 @@ jobs:
         env:
           E2E_INSTALL_CTK: "true"
           E2E_IMAGE_NAME: ghcr.io/nvidia/container-toolkit
-          E2E_IMAGE_TAG: ${{ inputs.version }}
+          E2E_IMAGE_TAG: ${{ inputs.version }}-ubuntu20.04
           E2E_SSH_USER: ${{ secrets.E2E_SSH_USER }}
           E2E_SSH_HOST: ${{ steps.holodeck_public_dns_name.outputs.result }}
         run: |

.github/workflows/image.yaml

@@ -79,9 +79,15 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        target:
-          - application
+        dist:
+          - ubuntu20.04
+          - ubi8
           - packaging
+        ispr:
+          - ${{ github.ref_name != 'main' && !startsWith( github.ref_name, 'release-' ) }}
+        exclude:
+          - ispr: true
+            dist: ubi8
     needs: packages
     steps:
       - uses: actions/checkout@v4
@@ -117,4 +123,4 @@ jobs:
           BUILD_MULTI_ARCH_IMAGES: ${{ inputs.build_multi_arch_images }}
         run: |
           echo "${VERSION}"
-          make -f deployments/container/Makefile build-${{ matrix.target }}
+          make -f deployments/container/Makefile build-${{ matrix.dist }}

.gitlab-ci.yml

@@ -0,0 +1,228 @@
+# Copyright (c) 2019-2022, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include:
+  - .common-ci.yml
+
+# Define the package build helpers
+.multi-arch-build:
+  before_script:
+    - apk add --no-cache coreutils build-base sed git bash make
+    - '[[ -n "${SKIP_QEMU_SETUP}" ]] || docker run --rm --privileged multiarch/qemu-user-static --reset -p yes -c yes'
+
+.package-artifacts:
+  variables:
+    ARTIFACTS_NAME: "toolkit-container-${CI_PIPELINE_ID}"
+    ARTIFACTS_ROOT: "toolkit-container-${CI_PIPELINE_ID}"
+    DIST_DIR: ${CI_PROJECT_DIR}/${ARTIFACTS_ROOT}
+
+.package-build:
+  extends:
+    - .multi-arch-build
+    - .package-artifacts
+  stage: package-build
+  timeout: 3h
+  script:
+    - ./scripts/build-packages.sh ${DIST}-${ARCH}
+
+  artifacts:
+    name: ${ARTIFACTS_NAME}
+    paths:
+      - ${ARTIFACTS_ROOT}
+  needs:
+    - job: package-meta-packages
+      artifacts: true
+
+# Define the package build targets
+package-meta-packages:
+  extends:
+    - .package-artifacts
+  stage: package-build
+  variables:
+    SKIP_LIBNVIDIA_CONTAINER: "yes"
+    SKIP_NVIDIA_CONTAINER_TOOLKIT: "yes"
+  parallel:
+    matrix:
+      - PACKAGING: [deb, rpm]
+  before_script:
+    - apk add --no-cache coreutils build-base sed git bash make
+  script:
+    - ./scripts/build-packages.sh ${PACKAGING}
+  artifacts:
+    name: ${ARTIFACTS_NAME}
+    paths:
+      - ${ARTIFACTS_ROOT}
+
+package-centos7-aarch64:
+  extends:
+    - .package-build
+    - .dist-centos7
+    - .arch-aarch64
+
+package-centos7-x86_64:
+  extends:
+    - .package-build
+    - .dist-centos7
+    - .arch-x86_64
+
+package-centos8-ppc64le:
+  extends:
+    - .package-build
+    - .dist-centos8
+    - .arch-ppc64le
+
+package-ubuntu18.04-amd64:
+  extends:
+    - .package-build
+    - .dist-ubuntu18.04
+    - .arch-amd64
+
+package-ubuntu18.04-arm64:
+  extends:
+    - .package-build
+    - .dist-ubuntu18.04
+    - .arch-arm64
+
+package-ubuntu18.04-ppc64le:
+  extends:
+    - .package-build
+    - .dist-ubuntu18.04
+    - .arch-ppc64le
+
+.buildx-setup:
+  before_script:
+    -  export BUILDX_VERSION=v0.6.3
+    -  apk add --no-cache curl
+    -  mkdir -p ~/.docker/cli-plugins
+    -  curl -sSLo ~/.docker/cli-plugins/docker-buildx "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-amd64"
+    -  chmod a+x ~/.docker/cli-plugins/docker-buildx
+
+    -  docker buildx create --use --platform=linux/amd64,linux/arm64
+
+    -  '[[ -n "${SKIP_QEMU_SETUP}" ]] || docker run --rm --privileged multiarch/qemu-user-static --reset -p yes'
+
+# Define the image build targets
+.image-build:
+  stage: image-build
+  variables:
+    IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
+    VERSION: "${CI_COMMIT_SHORT_SHA}"
+    PUSH_ON_BUILD: "true"
+  before_script:
+    - !reference [.buildx-setup, before_script]
+
+    - apk add --no-cache bash make git
+    - 'echo "Logging in to CI registry ${CI_REGISTRY}"'
+    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
+  script:
+    - make -f deployments/container/Makefile build-${DIST}
+
+image-ubi8:
+  extends:
+    - .image-build
+    - .package-artifacts
+    - .dist-ubi8
+  needs:
+    # Note: The ubi8 image uses the centos7 packages
+    - package-centos7-aarch64
+    - package-centos7-x86_64
+
+image-ubuntu20.04:
+  extends:
+    - .image-build
+    - .package-artifacts
+    - .dist-ubuntu20.04
+  needs:
+    - package-ubuntu18.04-amd64
+    - package-ubuntu18.04-arm64
+    - job: package-ubuntu18.04-ppc64le
+      optional: true
+
+# The DIST=packaging target creates an image containing all built packages
+image-packaging:
+  extends:
+    - .image-build
+    - .package-artifacts
+    - .dist-packaging
+  needs:
+    - job: package-ubuntu18.04-amd64
+    - job: package-ubuntu18.04-arm64
+    - job: package-amazonlinux2-aarch64
+      optional: true
+    - job: package-amazonlinux2-x86_64
+      optional: true
+    - job: package-centos7-aarch64
+      optional: true
+    - job: package-centos7-x86_64
+      optional: true
+    - job: package-centos8-ppc64le
+      optional: true
+    - job: package-debian10-amd64
+      optional: true
+    - job: package-opensuse-leap15.1-x86_64
+      optional: true
+    - job: package-ubuntu18.04-ppc64le
+      optional: true
+
+# Define publish test helpers
+.test:docker:
+  extends:
+    - .integration
+  variables:
+    TEST_CASES: "docker"
+
+.test:containerd:
+  # TODO: The containerd tests fail due to issues with SIGHUP.
+  # Until this is resolved with retry up to twice and allow failure here.
+  retry: 2
+  allow_failure: true
+  extends:
+    - .integration
+  variables:
+    TEST_CASES: "containerd"
+
+.test:crio:
+  extends:
+    - .integration
+  variables:
+    TEST_CASES: "crio"
+
+# Define the test targets
+test-toolkit-ubuntu20.04:
+  extends:
+    - .test:toolkit
+    - .dist-ubuntu20.04
+  needs:
+    - image-ubuntu20.04
+
+test-containerd-ubuntu20.04:
+  extends:
+    - .test:containerd
+    - .dist-ubuntu20.04
+  needs:
+    - image-ubuntu20.04
+
+test-crio-ubuntu20.04:
+  extends:
+    - .test:crio
+    - .dist-ubuntu20.04
+  needs:
+    - image-ubuntu20.04
+
+test-docker-ubuntu20.04:
+  extends:
+    - .test:docker
+    - .dist-ubuntu20.04
+  needs:
+    - image-ubuntu20.04

.nvidia-ci.yml

@@ -39,62 +39,19 @@ variables:
   KITMAKER_RELEASE_FOLDER: "kitmaker"
   PACKAGE_ARCHIVE_RELEASE_FOLDER: "releases"
 
-# .copy-images copies the required application and packaging images from the
-# IN_IMAGE="${IN_IMAGE_NAME}:${IN_IMAGE_TAG}${TAG_SUFFIX}"
-# to
-# OUT_IMAGE="${OUT_IMAGE_NAME}:${OUT_IMAGE_TAG}${TAG_SUFFIX}"
-# The script also logs into IN_REGISTRY and OUT_REGISTRY using the supplied
-# username and tokens.
-.copy-images:
-  parallel:
-    matrix:
-      - TAG_SUFFIX: ["", "-packaging"]
-  before_script:
-    - !reference [.regctl-setup, before_script]
-    - apk add --no-cache make bash
-  variables:
-    REGCTL: regctl
-  script:
-    - |
-      if [ -n ${IN_REGISTRY} ] && [ -n ${IN_REGISTRY_USER} ]; then
-        echo "Logging in to ${IN_REGISTRY}"
-        ${REGCTL} registry login "${IN_REGISTRY}" -u "${IN_REGISTRY_USER}" -p "${IN_REGISTRY_TOKEN}" || exit 1
-      fi
-
-      if [ -n ${OUT_REGISTRY} ] && [ -n ${OUT_REGISTRY_USER} ] && [ "${IN_REGISTRY}" != "${OUT_REGISTRY}" ]; then
-        echo "Logging in to ${OUT_REGISTRY}"
-        ${REGCTL} registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}" || exit 1
-      fi
-
-      export IN_IMAGE="${IN_IMAGE_NAME}:${IN_IMAGE_TAG}${TAG_SUFFIX}"
-      export OUT_IMAGE="${OUT_IMAGE_NAME}:${OUT_IMAGE_TAG}${TAG_SUFFIX}"
-
-      echo "Copying ${IN_IMAGE} to ${OUT_IMAGE}"
-      ${REGCTL} image copy ${IN_IMAGE} ${OUT_IMAGE}
-
-# pull-images pulls images from the public CI registry to the internal CI registry.
-pull-images:
-  extends:
-    - .copy-images
-  stage: pull
+.image-pull:
+  stage: image-build
   variables:
     IN_REGISTRY: "${STAGING_REGISTRY}"
-    IN_IMAGE_NAME: ${STAGING_REGISTRY}/container-toolkit
-    IN_IMAGE_TAG: "${STAGING_VERSION}"
-
-    OUT_REGISTRY: "${CI_REGISTRY}"
+    IN_IMAGE_NAME: container-toolkit
+    IN_VERSION: "${STAGING_VERSION}"
     OUT_REGISTRY_USER: "${CI_REGISTRY_USER}"
     OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
+    OUT_REGISTRY: "${CI_REGISTRY}"
     OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
-    OUT_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
+    PUSH_MULTIPLE_TAGS: "false"
   # We delay the job start to allow the public pipeline to generate the required images.
   rules:
-    # If the pipeline is triggered from a tag or the WEB UI we don't delay the
-    # start of the pipeline.
-    - if: $CI_COMMIT_TAG || $CI_PIPELINE_SOURCE == "web"
-    # If the pipeline is triggered through other means (i.e. a branch or MR)
-    # we add a 30 minute delay to ensure that the images are available in the
-    # public CI registry.
     - when: delayed
       start_in: 30 minutes
   timeout: 30 minutes
@@ -103,6 +60,30 @@ pull-images:
     when:
       - job_execution_timeout
       - stuck_or_timeout_failure
+  before_script:
+    - !reference [.regctl-setup, before_script]
+    - apk add --no-cache make bash
+    - >
+      regctl manifest get ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} --list > /dev/null && echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST}" || ( echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} does not exist" && sleep infinity )
+  script:
+    - regctl registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}"
+    - make -f deployments/container/Makefile IMAGE=${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} OUT_IMAGE=${OUT_IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}-${DIST} push-${DIST}
+
+image-ubi8:
+  extends:
+    - .dist-ubi8
+    - .image-pull
+
+image-ubuntu20.04:
+  extends:
+    - .dist-ubuntu20.04
+    - .image-pull
+
+# The DIST=packaging target creates an image containing all built packages
+image-packaging:
+  extends:
+    - .dist-packaging
+    - .image-pull
 
 # We skip the integration tests for the internal CI:
 .integration:
@@ -114,37 +95,27 @@ pull-images:
 
 # The .scan step forms the base of the image scan operation performed before releasing
 # images.
-scan-images:
+.scan:
   stage: scan
-  needs:
-  - pull-images
   image: "${PULSE_IMAGE}"
-  parallel:
-    matrix:
-      - TAG_SUFFIX: [""]
-        PLATFORM: ["linux/amd64", "linux/arm64"]
-      - TAG_SUFFIX: "-packaging"
-        PLATFORM: "linux/amd64"
   variables:
-    IMAGE: "${CI_REGISTRY_IMAGE}/container-toolkit:${CI_COMMIT_SHORT_SHA}"
-    IMAGE_ARCHIVE: "container-toolkit-${CI_JOB_ID}.tar"
+    IMAGE: "${CI_REGISTRY_IMAGE}/container-toolkit:${CI_COMMIT_SHORT_SHA}-${DIST}"
+    IMAGE_ARCHIVE: "container-toolkit-${DIST}-${ARCH}-${CI_JOB_ID}.tar"
   rules:
-    - if: $IGNORE_SCANS == "yes"
-      allow_failure: true
-    - when: on_success
-  script:
-    - |
-      docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
-      export SCAN_IMAGE=${IMAGE}${TAG_SUFFIX}
-      echo "Scanning image ${SCAN_IMAGE} for ${PLATFORM}"
-      docker pull --platform="${PLATFORM}" "${SCAN_IMAGE}"
-      docker save "${SCAN_IMAGE}" -o "${IMAGE_ARCHIVE}"
-      AuthHeader=$(echo -n $SSA_CLIENT_ID:$SSA_CLIENT_SECRET | base64 -w0)
+    - if: $SKIP_SCANS != "yes"
+    - when: manual
+  before_script:
+    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
+    # TODO: We should specify the architecture here and scan all architectures
+    - docker pull --platform="${PLATFORM}" "${IMAGE}"
+    - docker save "${IMAGE}" -o "${IMAGE_ARCHIVE}"
+    - AuthHeader=$(echo -n $SSA_CLIENT_ID:$SSA_CLIENT_SECRET | base64 -w0)
+    - >
       export SSA_TOKEN=$(curl --request POST --header "Authorization: Basic $AuthHeader" --header "Content-Type: application/x-www-form-urlencoded" ${SSA_ISSUER_URL} | jq ".access_token" |  tr -d '"')
-      if [ -z "$SSA_TOKEN" ]; then exit 1; else echo "SSA_TOKEN set!"; fi
-
-      pulse-cli -n $NSPECT_ID --ssa $SSA_TOKEN scan -i $IMAGE_ARCHIVE -p $CONTAINER_POLICY -o
-      rm -f "${IMAGE_ARCHIVE}"
+    - if [ -z "$SSA_TOKEN" ]; then exit 1; else echo "SSA_TOKEN set!"; fi
+  script:
+    - pulse-cli -n $NSPECT_ID --ssa $SSA_TOKEN scan -i $IMAGE_ARCHIVE -p $CONTAINER_POLICY -o
+    - rm -f "${IMAGE_ARCHIVE}"
   artifacts:
     when: always
     expire_in: 1 week
@@ -155,10 +126,62 @@ scan-images:
       - vulns.json
       - policy_evaluation.json
 
-upload-kitmaker-packages:
+# Define the scan targets
+scan-ubuntu20.04-amd64:
+  extends:
+    - .dist-ubuntu20.04
+    - .platform-amd64
+    - .scan
+  needs:
+    - image-ubuntu20.04
+
+scan-ubuntu20.04-arm64:
+  extends:
+    - .dist-ubuntu20.04
+    - .platform-arm64
+    - .scan
+  needs:
+    - image-ubuntu20.04
+    - scan-ubuntu20.04-amd64
+
+scan-ubi8-amd64:
+  extends:
+    - .dist-ubi8
+    - .platform-amd64
+    - .scan
+  needs:
+    - image-ubi8
+
+scan-ubi8-arm64:
+  extends:
+    - .dist-ubi8
+    - .platform-arm64
+    - .scan
+  needs:
+    - image-ubi8
+    - scan-ubi8-amd64
+
+scan-packaging:
+  extends:
+    - .dist-packaging
+    - .scan
+  needs:
+    - image-packaging
+
+# Define external release helpers
+.release:ngc:
+  extends:
+    - .release:external
+  variables:
+    OUT_REGISTRY_USER: "${NGC_REGISTRY_USER}"
+    OUT_REGISTRY_TOKEN: "${NGC_REGISTRY_TOKEN}"
+    OUT_REGISTRY: "${NGC_REGISTRY}"
+    OUT_IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"
+
+.release:packages:
   stage: release
   needs:
-    - pull-images
+    - image-packaging
   variables:
     VERSION: "${CI_COMMIT_SHORT_SHA}"
     PACKAGE_REGISTRY: "${CI_REGISTRY}"
@@ -176,81 +199,34 @@ upload-kitmaker-packages:
     - ./scripts/release-kitmaker-artifactory.sh "${KITMAKER_ARTIFACTORY_REPO}"
     - rm -rf ${ARTIFACTS_DIR}
 
-push-images-to-staging:
+# Define the package release targets
+release:packages:kitmaker:
   extends:
-    - .copy-images
-  stage: release
+    - .release:packages
+
+release:staging-ubuntu20.04:
+  extends:
+    - .release:staging
+    - .dist-ubuntu20.04
   needs:
-    - scan-images
-  variables:
-    IN_REGISTRY: "${CI_REGISTRY}"
-    IN_REGISTRY_USER: "${CI_REGISTRY_USER}"
-    IN_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
-    IN_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
-    IN_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
+    - image-ubuntu20.04
 
-    OUT_REGISTRY: "${NGC_REGISTRY}"
-    OUT_REGISTRY_USER: "${NGC_REGISTRY_USER}"
-    OUT_REGISTRY_TOKEN: "${NGC_REGISTRY_TOKEN}"
-    OUT_IMAGE_NAME: "${NGC_STAGING_REGISTRY}/container-toolkit"
-    OUT_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
-
-.release-images:
+# Define the external release targets
+# Release to NGC
+release:ngc-ubuntu20.04:
   extends:
-    - .copy-images
-  stage: release
-  needs:
-    - scan-images
-    - push-images-to-staging
-  variables:
-    IN_REGISTRY: "${CI_REGISTRY}"
-    IN_REGISTRY_USER: "${CI_REGISTRY_USER}"
-    IN_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
-    IN_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
-    IN_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
+    - .dist-ubuntu20.04
+    - .release:ngc
 
-    OUT_REGISTRY: "${NGC_REGISTRY}"
-    OUT_REGISTRY_USER: "${NGC_REGISTRY_USER}"
-    OUT_REGISTRY_TOKEN: "${NGC_REGISTRY_TOKEN}"
-    OUT_IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"
-    OUT_IMAGE_TAG: "${CI_COMMIT_TAG}"
-
-release-images-to-ngc:
+release:ngc-ubi8:
   extends:
-    - .release-images
-  rules:
-    - if: $CI_COMMIT_TAG
+    - .dist-ubi8
+    - .release:ngc
 
-release-images-dummy:
+release:ngc-packaging:
   extends:
-    - .release-images
-  variables:
-    REGCTL: "echo [DUMMY] regctl"
-  rules:
-    - if: $CI_COMMIT_TAG == null || $CI_COMMIT_TAG == ""
-
-# .sign-images forms the base of the jobs which sign images in the NGC registry.
-.sign-images:
-  stage: sign
-  image: ubuntu:latest
-  parallel:
-    matrix:
-      - TAG_SUFFIX: ["", "-packaging"]
-  variables:
-    IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"
-    IMAGE_TAG: "${CI_COMMIT_TAG}"
-    NGC_CLI: "ngc-cli/ngc"
-  before_script:
-    - !reference [.ngccli-setup, before_script]
-  script:
-    - |
-      # We ensure that the IMAGE_NAME and IMAGE_TAG is set
-      echo Image Name: ${IMAGE_NAME} && [[ -n "${IMAGE_NAME}" ]] || exit 1
-      echo Image Tag: ${IMAGE_TAG} && [[ -n "${IMAGE_TAG}" ]] || exit 1
-
-      export IMAGE=${IMAGE_NAME}:${IMAGE_TAG}${TAG_SUFFIX}
-      echo "Signing the image ${IMAGE}"
-      ${NGC_CLI} registry image publish --source ${IMAGE} ${IMAGE} --public --discoverable --allow-guest --sign --org nvidia
+    - .dist-packaging
+    - .release:ngc
 
 # Define the external image signing steps for NGC
 # Download the ngc cli binary for use in the sign steps
@@ -268,24 +244,45 @@ release-images-dummy:
     - unzip ngccli_linux.zip
     - chmod u+x ngc-cli/ngc
 
-sign-ngc-images:
-  extends:
-    - .sign-images
-  needs:
-    - release-images-to-ngc
+# .sign forms the base of the deployment jobs which signs images in the CI registry.
+# This is extended with the image name and version to be deployed.
+.sign:ngc:
+  image: ubuntu:latest
+  stage: sign
   rules:
     - if: $CI_COMMIT_TAG
   variables:
     NGC_CLI_API_KEY: "${NGC_REGISTRY_TOKEN}"
+    IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"
+    IMAGE_TAG: "${CI_COMMIT_TAG}-${DIST}"
   retry:
     max: 2
+  before_script:
+    - !reference [.ngccli-setup, before_script]
+    # We ensure that the IMAGE_NAME and IMAGE_TAG is set
+    - 'echo Image Name: ${IMAGE_NAME} && [[ -n "${IMAGE_NAME}" ]] || exit 1'
+    - 'echo Image Tag: ${IMAGE_TAG} && [[ -n "${IMAGE_TAG}" ]] || exit 1'
+  script:
+    - 'echo "Signing the image ${IMAGE_NAME}:${IMAGE_TAG}"'
+    - ngc-cli/ngc registry image publish --source ${IMAGE_NAME}:${IMAGE_TAG} ${IMAGE_NAME}:${IMAGE_TAG} --public --discoverable --allow-guest --sign --org nvidia
 
-sign-images-dummy:
+sign:ngc-ubuntu20.04:
   extends:
-    - .sign-images
+    - .dist-ubuntu20.04
+    - .sign:ngc
   needs:
-    - release-images-dummy
-  variables:
-    NGC_CLI: "echo [DUMMY] ngc-cli/ngc"
-  rules:
-    - if: $CI_COMMIT_TAG == null || $CI_COMMIT_TAG == ""
+    - release:ngc-ubuntu20.04
+
+sign:ngc-ubi8:
+  extends:
+    - .dist-ubi8
+    - .sign:ngc
+  needs:
+    - release:ngc-ubi8
+
+sign:ngc-packaging:
+  extends:
+    - .dist-packaging
+    - .sign:ngc
+  needs:
+    - release:ngc-packaging

CHANGELOG.md

@@ -1,139 +1,34 @@
 # NVIDIA Container Toolkit Changelog
 
-## v1.18.0-rc.1
-
-- Add create-soname-symlinks hook
-- Require matching version of libnvidia-container-tools
-- Add envvar for libcuda.so parent dir to CDI spec
-- Add EnvVar to Discover interface
-- Resolve to legacy by default in nvidia-container-runtime-hook
-- Default to jit-cdi mode in the nvidia runtime
-- Use functional options to construct runtime mode resolver
-- Add NVIDIA_CTK_CONFIG_FILE_PATH envvar
-- Switch to cuda ubi9 base image
-- Use single version tag for image
-- BUGFIX: modifier: respect GPU volume-mount device requests
-- Ensure consistent sorting of annotation devices
-- Extract deb and rpm packages to single image
-- Remove docker-run as default runtime candidate
-- Return annotation devices from VisibleDevices
-- Make CDI device requests consistent with other methods
-- Construct container info once
-- Add logic to extract annotation device requests to image type
-- Add IsPrivileged function to CUDA container type
-- Add device IDs to nvcdi.GetSpec API
-- Refactor extracting requested devices from the container image
-- Add EnvVars option for all nvidia-ctk cdi commands
-- Add nvidia-cdi-refresh service
-- Add discovery of arch-specific vulkan ICD
-- Add disabled-device-node-modification hook to CDI spec
-- Add a hook to disable device node creation in a container
-- Remove redundant deduplication of search paths for WSL
-- Added ability to disable specific (or all) CDI hooks
-- Consolidate HookName functionality on internal/discover pkg
-- Add envvar to control debug logging in CDI hooks
-- Add FeatureFlags to the nvcdi API
-- Reenable nvsandboxutils for driver discovery
-- Edit discover.mounts to have a deterministic output
-- Refactor the way we create CDI Hooks
-- Issue warning on unsupported CDI hook
-- Run update-ldcache in isolated namespaces
-- Add cuda-compat-mode config option
-- Fix mode detection on Thor-based systems
-- Add rprivate to CDI mount options
-- Skip nil discoverers in merge
-- bump runc go dep to v1.3.0
-- Fix resolution of libs in LDCache on ARM
-- Updated .release:staging to stage images in nvstaging
-- Refactor toolkit installer
-- Allow container runtime executable path to be specified
-- Add support for building ubuntu22.04 on arm64
-- Fix race condition in mounts cache
-- Add support for building ubuntu22.04 on amd64
-- Fix update-ldcache arguments
-- Remove positional arguments from nvidia-ctk-installer
-- Remove deprecated --runtime-args from nvidia-ctk-installer
-- Add version info to nvidia-ctk-installer
-- Update nvidia-ctk-installer app name to match binary name
-- Allow nvidia-ctk config --set to accept comma-separated lists
-- Disable enable-cuda-compat hook for management containers
-- Allow enable-cuda-compat hook to be disabled in CDI spec generation
-- Add disable-cuda-compat-lib-hook feature flag
-- Add basic integration tests for forward compat
-- Ensure that mode hook is executed last
-- Add enable-cuda-compat hook to CDI spec generation
-- Add ldconfig hook in legacy mode
-- Add enable-cuda-compat hook if required
-- Add enable-cuda-compat hook to allow compat libs to be discovered
-- Use libcontainer execseal to run ldconfig
-- Add ignore-imex-channel-requests feature flag
-- Disable nvsandboxutils in nvcdi API
-- Allow cdi mode to work with --gpus flag
-- Add E2E GitHub Action for Container Toolkit
-- Add remote-test option for E2E
-- Enable CDI in runtime if CDI_ENABLED is set
-- Fix overwriting docker feature flags
-- Add option in toolkit container to enable CDI in runtime
-- Remove Set from engine config API
-- Add EnableCDI() method to engine.Interface
-- Add IMEX binaries to CDI discovery
-- Rename test folder to tests
+## v1.17.4
+- Disable mounting of compat libs from container by default
 - Add allow-cuda-compat-libs-from-container feature flag
-- Disable mounting of compat libs from container
 - Skip graphics modifier in CSV mode
-- Move nvidia-toolkit to nvidia-ctk-installer
-- Automated regression testing for the NVIDIA Container Toolkit
-- Add support for containerd version 3 config
-- Remove watch option from create-dev-char-symlinks
-- Add string TOML source
-- Improve the implementation for UseLegacyConfig
 - Properly pass configSearchPaths to a Driver constructor
-- Fix create-device-node test when devices exist
-- Add imex mode to CDI spec generation
-- Only allow host-relative LDConfig paths
-- Fix NVIDIA_IMEX_CHANNELS handling on legacy images
-- Fix bug in default config file path
-- Fix fsnotify.Remove logic function.
-- Force symlink creation in create-symlink hook
-
-### Changes in the Toolkit Container
-
-- Create /work/nvidia-toolkit symlink
-- Use Apache license for images
-- Switch to golang distroless image
-- Switch to cuda ubi9 base image
-- Use single version tag for image
-- Extract deb and rpm packages to single image
-- Bump nvidia/cuda in /deployments/container
-- Bump nvidia/cuda in /deployments/container
-- Add E2E GitHub Action for Container Toolkit
-- Bump nvidia/cuda in /deployments/container
-- Move nvidia-toolkit to nvidia-ctk-installer
 - Add support for containerd version 3 config
-- Improve the implementation for UseLegacyConfig
-- Bump nvidia/cuda in /deployments/container
-- Add imex mode to CDI spec generation
-- Only allow host-relative LDConfig paths
-- Fallback to file for runtime config
+- Add string TOML source
 
 ### Changes in libnvidia-container
-
-- Fix pointer accessing local variable out of scope
-- Require version match between libnvidia-container-tools and libnvidia-container1
-- Add libnvidia-gpucomp.so to the list of compute libs
-- Use VERSION_ prefix for version parts in makefiles
-- Add additional logging
-- Do not discard container flags when --cuda-compat-mode is not specified
-- Remove unneeded --no-cntlibs argument from list command
-- Add cuda-compat-mode flag to configure command
-- Skip files when user has insufficient permissions
-- Fix building with Go 1.24
 - Add no-cntlibs CLI option to nvidia-container-cli
-- Fix always using fallback
-- Add fallback for systems without memfd_create()
-- Create virtual copy of host ldconfig binary before calling fexecve()
-- Fix some typos in text.
 
+### Changes in the Toolkit Container
+- Bump CUDA base image version to 12.6.3
+
+## v1.17.3
+- Only allow host-relative LDConfig paths by default.
+### Changes in libnvidia-container
+- Create virtual copy of host ldconfig binary before calling fexecve()
+
+## v1.17.2
+- Fixed a bug where legacy images would set imex channels as `all`.
+
+## v1.17.1
+- Fixed a bug where specific symlinks existing in a container image could cause a container to fail to start.
+- Fixed a bug on Tegra-based systems where a container would fail to start.
+- Fixed a bug where the default container runtime config path was not properly set.
+
+### Changes in the Toolkit Container
+- Fallback to using a config file if the current runtime config can not be determined from the command line.
 
 ## v1.17.0
 - Promote v1.17.0-rc.2 to v1.17.0

cmd/nvidia-cdi-hook/chmod/chmod.go

@@ -17,7 +17,6 @@
 package chmod
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -26,7 +25,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
@@ -37,7 +36,7 @@ type command struct {
 }
 
 type config struct {
-	paths         []string
+	paths         cli.StringSlice
 	modeStr       string
 	mode          fs.FileMode
 	containerSpec string
@@ -59,11 +58,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "chmod",
 		Usage: "Set the permissions of folders in the container by running chmod. The container root is prefixed to the specified paths.",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, validateFlags(cmd, &cfg)
+		Before: func(c *cli.Context) error {
+			return validateFlags(c, &cfg)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &cfg)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &cfg)
 		},
 	}
 
@@ -88,7 +87,7 @@ func (m command) build() *cli.Command {
 	return &c
 }
 
-func validateFlags(c *cli.Command, cfg *config) error {
+func validateFlags(c *cli.Context, cfg *config) error {
 	if strings.TrimSpace(cfg.modeStr) == "" {
 		return fmt.Errorf("a non-empty mode must be specified")
 	}
@@ -99,7 +98,7 @@ func validateFlags(c *cli.Command, cfg *config) error {
 	}
 	cfg.mode = fs.FileMode(modeInt)
 
-	for _, p := range cfg.paths {
+	for _, p := range cfg.paths.Value() {
 		if strings.TrimSpace(p) == "" {
 			return fmt.Errorf("paths must not be empty")
 		}
@@ -108,7 +107,7 @@ func validateFlags(c *cli.Command, cfg *config) error {
 	return nil
 }
 
-func (m command) run(c *cli.Command, cfg *config) error {
+func (m command) run(c *cli.Context, cfg *config) error {
 	s, err := oci.LoadContainerState(cfg.containerSpec)
 	if err != nil {
 		return fmt.Errorf("failed to load container state: %v", err)
@@ -122,7 +121,7 @@ func (m command) run(c *cli.Command, cfg *config) error {
 		return fmt.Errorf("empty container root detected")
 	}
 
-	paths := m.getPaths(containerRoot, cfg.paths, cfg.mode)
+	paths := m.getPaths(containerRoot, cfg.paths.Value(), cfg.mode)
 	if len(paths) == 0 {
 		m.logger.Debugf("No paths specified; exiting")
 		return nil

cmd/nvidia-cdi-hook/commands/commands.go

@@ -17,13 +17,11 @@
 package commands
 
 import (
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/chmod"
-	createsonamesymlinks "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/create-soname-symlinks"
 	symlinks "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/create-symlinks"
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/cudacompat"
-	disabledevicenodemodification "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/disable-device-node-modification"
 	ldcache "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/update-ldcache"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 )
@@ -36,8 +34,6 @@ func New(logger logger.Interface) []*cli.Command {
 		symlinks.NewCommand(logger),
 		chmod.NewCommand(logger),
 		cudacompat.NewCommand(logger),
-		createsonamesymlinks.NewCommand(logger),
-		disabledevicenodemodification.NewCommand(logger),
 	}
 }
 
@@ -45,7 +41,7 @@ func New(logger logger.Interface) []*cli.Command {
 // hook has been specified.
 // This happens if a subcommand is provided that does not match one of the
 // subcommands that has been explicitly specified.
-func IssueUnsupportedHookWarning(logger logger.Interface, c *cli.Command) {
+func IssueUnsupportedHookWarning(logger logger.Interface, c *cli.Context) {
 	args := c.Args().Slice()
 	if len(args) == 0 {
 		logger.Warningf("No CDI hook specified")

cmd/nvidia-cdi-hook/create-soname-symlinks/soname-symlinks.go

@@ -1,167 +0,0 @@
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package create_soname_symlinks
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log"
-	"os"
-
-	"github.com/moby/sys/reexec"
-	"github.com/urfave/cli/v3"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/ldconfig"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
-)
-
-const (
-	reexecUpdateLdCacheCommandName = "reexec-create-soname-symlinks"
-)
-
-type command struct {
-	logger logger.Interface
-}
-
-type options struct {
-	folders       []string
-	ldconfigPath  string
-	containerSpec string
-}
-
-func init() {
-	reexec.Register(reexecUpdateLdCacheCommandName, createSonameSymlinksHandler)
-	if reexec.Init() {
-		os.Exit(0)
-	}
-}
-
-// NewCommand constructs an create-soname-symlinks command with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	c := command{
-		logger: logger,
-	}
-	return c.build()
-}
-
-// build the create-soname-symlinks command
-func (m command) build() *cli.Command {
-	cfg := options{}
-
-	// Create the 'create-soname-symlinks' command
-	c := cli.Command{
-		Name:  "create-soname-symlinks",
-		Usage: "Create soname symlinks libraries in specified directories",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &cfg)
-		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringSliceFlag{
-			Name:        "folder",
-			Usage:       "Specify a directory to generate soname symlinks in. Can be specified multiple times",
-			Destination: &cfg.folders,
-		},
-		&cli.StringFlag{
-			Name:        "ldconfig-path",
-			Usage:       "Specify the path to ldconfig on the host",
-			Destination: &cfg.ldconfigPath,
-			Value:       "/sbin/ldconfig",
-		},
-		&cli.StringFlag{
-			Name:        "container-spec",
-			Usage:       "Specify the path to the OCI container spec. If empty or '-' the spec will be read from STDIN",
-			Destination: &cfg.containerSpec,
-		},
-	}
-
-	return &c
-}
-
-func (m command) validateFlags(c *cli.Command, cfg *options) error {
-	if cfg.ldconfigPath == "" {
-		return errors.New("ldconfig-path must be specified")
-	}
-	return nil
-}
-
-func (m command) run(c *cli.Command, cfg *options) error {
-	s, err := oci.LoadContainerState(cfg.containerSpec)
-	if err != nil {
-		return fmt.Errorf("failed to load container state: %v", err)
-	}
-
-	containerRootDir, err := s.GetContainerRoot()
-	if err != nil || containerRootDir == "" || containerRootDir == "/" {
-		return fmt.Errorf("failed to determined container root: %v", err)
-	}
-
-	cmd, err := ldconfig.NewRunner(
-		reexecUpdateLdCacheCommandName,
-		cfg.ldconfigPath,
-		containerRootDir,
-		cfg.folders...,
-	)
-	if err != nil {
-		return err
-	}
-
-	return cmd.Run()
-}
-
-// createSonameSymlinksHandler wraps createSonameSymlinks with error handling.
-func createSonameSymlinksHandler() {
-	if err := createSonameSymlinks(os.Args); err != nil {
-		log.Printf("Error updating ldcache: %v", err)
-		os.Exit(1)
-	}
-}
-
-// createSonameSymlinks ensures that soname symlinks are created in the
-// specified directories.
-// It is invoked from a reexec'd handler and provides namespace isolation for
-// the operations performed by this hook. At the point where this is invoked,
-// we are in a new mount namespace that is cloned from the parent.
-//
-// args[0] is the reexec initializer function name
-// args[1] is the path of the ldconfig binary on the host
-// args[2] is the container root directory
-// The remaining args are directories where soname symlinks need to be created.
-func createSonameSymlinks(args []string) error {
-	if len(args) < 3 {
-		return fmt.Errorf("incorrect arguments: %v", args)
-	}
-	hostLdconfigPath := args[1]
-	containerRootDirPath := args[2]
-
-	ldconfig, err := ldconfig.New(
-		hostLdconfigPath,
-		containerRootDirPath,
-	)
-	if err != nil {
-		return fmt.Errorf("failed to construct ldconfig runner: %w", err)
-	}
-
-	return ldconfig.CreateSonameSymlinks(args[3:]...)
-}

cmd/nvidia-cdi-hook/create-symlinks/create-symlinks.go

@@ -17,7 +17,6 @@
 package symlinks
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -25,7 +24,7 @@ import (
 	"strings"
 
 	"github.com/moby/sys/symlink"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup/symlinks"
@@ -37,7 +36,7 @@ type command struct {
 }
 
 type config struct {
-	links         []string
+	links         cli.StringSlice
 	containerSpec string
 }
 
@@ -56,8 +55,8 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "create-symlinks",
 		Usage: "A hook to create symlinks in the container.",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(ctx, cmd, &cfg)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &cfg)
 		},
 	}
 
@@ -79,7 +78,7 @@ func (m command) build() *cli.Command {
 	return &c
 }
 
-func (m command) run(ctx context.Context, cmd *cli.Command, cfg *config) error {
+func (m command) run(c *cli.Context, cfg *config) error {
 	s, err := oci.LoadContainerState(cfg.containerSpec)
 	if err != nil {
 		return fmt.Errorf("failed to load container state: %v", err)
@@ -91,7 +90,7 @@ func (m command) run(ctx context.Context, cmd *cli.Command, cfg *config) error {
 	}
 
 	created := make(map[string]bool)
-	for _, l := range cfg.links {
+	for _, l := range cfg.links.Value() {
 		if created[l] {
 			m.logger.Debugf("Link %v already processed", l)
 			continue

cmd/nvidia-cdi-hook/cudacompat/cudacompat.go

@@ -17,14 +17,13 @@
 package cudacompat
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
@@ -64,11 +63,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "enable-cuda-compat",
 		Usage: "This hook ensures that the folder containing the CUDA compat libraries is added to the ldconfig search path if required.",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &cfg)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &cfg)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(ctx, cmd, &cfg)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &cfg)
 		},
 	}
 
@@ -90,11 +89,11 @@ func (m command) build() *cli.Command {
 	return &c
 }
 
-func (m command) validateFlags(cmd *cli.Command, cfg *options) error {
+func (m command) validateFlags(_ *cli.Context, cfg *options) error {
 	return nil
 }
 
-func (m command) run(ctx context.Context, cmd *cli.Command, cfg *options) error {
+func (m command) run(_ *cli.Context, cfg *options) error {
 	if cfg.hostDriverVersion == "" {
 		return nil
 	}

cmd/nvidia-cdi-hook/disable-device-node-modification/disable-device-node-modification.go

@@ -1,145 +0,0 @@
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package disabledevicenodemodification
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"github.com/urfave/cli/v3"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
-)
-
-const (
-	nvidiaDriverParamsPath = "/proc/driver/nvidia/params"
-)
-
-type options struct {
-	containerSpec string
-}
-
-// NewCommand constructs an disable-device-node-modification subcommand with the specified logger
-func NewCommand(logger logger.Interface) *cli.Command {
-	cfg := options{}
-
-	c := cli.Command{
-		Name:  "disable-device-node-modification",
-		Usage: "Ensure that the /proc/driver/nvidia/params file present in the container does not allow device node modifications.",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, validateFlags(cmd, &cfg)
-		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return run(ctx, cmd, &cfg)
-		},
-	}
-
-	c.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:        "container-spec",
-			Hidden:      true,
-			Usage:       "Specify the path to the OCI container spec. If empty or '-' the spec will be read from STDIN",
-			Destination: &cfg.containerSpec,
-		},
-	}
-
-	return &c
-}
-
-func validateFlags(c *cli.Command, cfg *options) error {
-	return nil
-}
-
-func run(ctx context.Context, cmd *cli.Command, cfg *options) error {
-	modifiedParamsFileContents, err := getModifiedNVIDIAParamsContents()
-	if err != nil {
-		return fmt.Errorf("failed to get modified params file contents: %w", err)
-	}
-	if len(modifiedParamsFileContents) == 0 {
-		return nil
-	}
-
-	s, err := oci.LoadContainerState(cfg.containerSpec)
-	if err != nil {
-		return fmt.Errorf("failed to load container state: %w", err)
-	}
-
-	containerRootDirPath, err := s.GetContainerRoot()
-	if err != nil {
-		return fmt.Errorf("failed to determined container root: %w", err)
-	}
-
-	return createParamsFileInContainer(containerRootDirPath, modifiedParamsFileContents)
-}
-
-func getModifiedNVIDIAParamsContents() ([]byte, error) {
-	hostNvidiaParamsFile, err := os.Open(nvidiaDriverParamsPath)
-	if errors.Is(err, os.ErrNotExist) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, fmt.Errorf("failed to load params file: %w", err)
-	}
-	defer hostNvidiaParamsFile.Close()
-
-	modifiedContents, err := getModifiedParamsFileContentsFromReader(hostNvidiaParamsFile)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get modfied params file contents: %w", err)
-	}
-
-	return modifiedContents, nil
-}
-
-// getModifiedParamsFileContentsFromReader returns the contents of a modified params file from the specified reader.
-func getModifiedParamsFileContentsFromReader(r io.Reader) ([]byte, error) {
-	var modified bytes.Buffer
-	scanner := bufio.NewScanner(r)
-
-	var requiresModification bool
-	for scanner.Scan() {
-		line := scanner.Text()
-		if strings.HasPrefix(line, "ModifyDeviceFiles: ") {
-			if line == "ModifyDeviceFiles: 0" {
-				return nil, nil
-			}
-			if line == "ModifyDeviceFiles: 1" {
-				line = "ModifyDeviceFiles: 0"
-				requiresModification = true
-			}
-		}
-		if _, err := modified.WriteString(line + "\n"); err != nil {
-			return nil, fmt.Errorf("failed to create output buffer: %w", err)
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("failed to read params file: %w", err)
-	}
-
-	if !requiresModification {
-		return nil, nil
-	}
-
-	return modified.Bytes(), nil
-}

cmd/nvidia-cdi-hook/disable-device-node-modification/disable-device-node-modification_test.go

@@ -1,91 +0,0 @@
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package disabledevicenodemodification
-
-import (
-	"bytes"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestGetModifiedParamsFileContentsFromReader(t *testing.T) {
-	testCases := map[string]struct {
-		contents         []byte
-		expectedError    error
-		expectedContents []byte
-	}{
-		"no contents": {
-			contents:         nil,
-			expectedError:    nil,
-			expectedContents: nil,
-		},
-		"other contents are ignored": {
-			contents: []byte(`# Some other content
-			that we don't care about
-			`),
-			expectedError:    nil,
-			expectedContents: nil,
-		},
-		"already zero requires no modification": {
-			contents:         []byte("ModifyDeviceFiles: 0"),
-			expectedError:    nil,
-			expectedContents: nil,
-		},
-		"leading spaces require no modification": {
-			contents: []byte("  ModifyDeviceFiles: 1"),
-		},
-		"Trailing spaces require no modification": {
-			contents: []byte("ModifyDeviceFiles: 1  "),
-		},
-		"Not 1 require no modification": {
-			contents: []byte("ModifyDeviceFiles: 11"),
-		},
-		"single line requires modification": {
-			contents:         []byte("ModifyDeviceFiles: 1"),
-			expectedError:    nil,
-			expectedContents: []byte("ModifyDeviceFiles: 0\n"),
-		},
-		"single line with trailing newline requires modification": {
-			contents:         []byte("ModifyDeviceFiles: 1\n"),
-			expectedError:    nil,
-			expectedContents: []byte("ModifyDeviceFiles: 0\n"),
-		},
-		"other content is maintained": {
-			contents: []byte(`ModifyDeviceFiles: 1
-			other content
-			that
-			is maintained`),
-			expectedError: nil,
-			expectedContents: []byte(`ModifyDeviceFiles: 0
-			other content
-			that
-			is maintained
-`),
-		},
-	}
-
-	for description, tc := range testCases {
-		t.Run(description, func(t *testing.T) {
-			contents, err := getModifiedParamsFileContentsFromReader(bytes.NewReader(tc.contents))
-			require.EqualValues(t, tc.expectedError, err)
-			require.EqualValues(t, string(tc.expectedContents), string(contents))
-		})
-	}
-
-}

cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go

@@ -1,63 +0,0 @@
-//go:build linux
-
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package disabledevicenodemodification
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/opencontainers/runc/libcontainer/utils"
-	"golang.org/x/sys/unix"
-)
-
-func createParamsFileInContainer(containerRootDirPath string, contents []byte) error {
-	tmpRoot, err := os.MkdirTemp("", "nvct-empty-dir*")
-	if err != nil {
-		return fmt.Errorf("failed to create temp root: %w", err)
-	}
-
-	if err := createTmpFs(tmpRoot, len(contents)); err != nil {
-		return fmt.Errorf("failed to create tmpfs mount for params file: %w", err)
-	}
-
-	modifiedParamsFile, err := os.OpenFile(filepath.Join(tmpRoot, "nvct-params"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0444)
-	if err != nil {
-		return fmt.Errorf("failed to open modified params file: %w", err)
-	}
-	defer modifiedParamsFile.Close()
-
-	if _, err := modifiedParamsFile.Write(contents); err != nil {
-		return fmt.Errorf("failed to write temporary params file: %w", err)
-	}
-
-	err = utils.WithProcfd(containerRootDirPath, nvidiaDriverParamsPath, func(nvidiaDriverParamsFdPath string) error {
-		return unix.Mount(modifiedParamsFile.Name(), nvidiaDriverParamsFdPath, "", unix.MS_BIND|unix.MS_RDONLY|unix.MS_NODEV|unix.MS_PRIVATE|unix.MS_NOSYMFOLLOW, "")
-	})
-	if err != nil {
-		return fmt.Errorf("failed to mount modified params file: %w", err)
-	}
-
-	return nil
-}
-
-func createTmpFs(target string, size int) error {
-	return unix.Mount("tmpfs", target, "tmpfs", 0, fmt.Sprintf("size=%d", size))
-}

cmd/nvidia-cdi-hook/disable-device-node-modification/params_other.go

@@ -1,27 +0,0 @@
-//go:build !linux
-// +build !linux
-
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package disabledevicenodemodification
-
-import "fmt"
-
-func createParamsFileInContainer(containerRootDirPath string, contents []byte) error {
-	return fmt.Errorf("not supported")
-}

cmd/nvidia-cdi-hook/main.go

@@ -17,14 +17,13 @@
 package main
 
 import (
-	"context"
 	"os"
 
 	"github.com/sirupsen/logrus"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/info"
 
-	cli "github.com/urfave/cli/v3"
+	cli "github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/commands"
 )
@@ -45,10 +44,10 @@ func main() {
 	opts := options{}
 
 	// Create the top-level CLI
-	c := cli.Command{}
+	c := cli.NewApp()
 	c.Name = "NVIDIA CDI Hook"
 	c.UseShortOptionHandling = true
-	c.EnableShellCompletion = true
+	c.EnableBashCompletion = true
 	c.Usage = "Command to structure files for usage inside a container, called as hooks from a container runtime, defined in a CDI yaml file"
 	c.Version = info.GetVersionString()
 
@@ -59,8 +58,8 @@ func main() {
 	// referring to a new hook that is not yet supported by an older NVIDIA
 	// Container Toolkit version or a hook that has been removed in newer
 	// version.
-	c.Action = func(ctx context.Context, cmd *cli.Command) error {
-		commands.IssueUnsupportedHookWarning(logger, cmd)
+	c.Action = func(ctx *cli.Context) error {
+		commands.IssueUnsupportedHookWarning(logger, ctx)
 		return nil
 	}
 
@@ -72,19 +71,19 @@ func main() {
 			Usage:       "Enable debug-level logging",
 			Destination: &opts.Debug,
 			// TODO: Support for NVIDIA_CDI_DEBUG is deprecated and NVIDIA_CTK_DEBUG should be used instead.
-			Sources: cli.EnvVars("NVIDIA_CTK_DEBUG", "NVIDIA_CDI_DEBUG"),
+			EnvVars: []string{"NVIDIA_CTK_DEBUG", "NVIDIA_CDI_DEBUG"},
 		},
 		&cli.BoolFlag{
 			Name:        "quiet",
 			Usage:       "Suppress all output except for errors; overrides --debug",
 			Destination: &opts.Quiet,
 			// TODO: Support for NVIDIA_CDI_QUIET is deprecated and NVIDIA_CTK_QUIET should be used instead.
-			Sources: cli.EnvVars("NVIDIA_CTK_QUIET", "NVIDIA_CDI_QUIET"),
+			EnvVars: []string{"NVDIA_CTK_QUIET", "NVIDIA_CDI_QUIET"},
 		},
 	}
 
 	// Set log-level for all subcommands
-	c.Before = func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
+	c.Before = func(c *cli.Context) error {
 		logLevel := logrus.InfoLevel
 		if opts.Debug {
 			logLevel = logrus.DebugLevel
@@ -93,14 +92,14 @@ func main() {
 			logLevel = logrus.ErrorLevel
 		}
 		logger.SetLevel(logLevel)
-		return ctx, nil
+		return nil
 	}
 
 	// Define the subcommands
 	c.Commands = commands.New(logger)
 
 	// Run the CLI
-	err := c.Run(context.Background(), os.Args)
+	err := c.Run(os.Args)
 	if err != nil {
 		logger.Errorf("%v", err)
 		os.Exit(1)

cmd/nvidia-cdi-hook/update-ldcache/container-root.go

@@ -0,0 +1,46 @@
+/**
+# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+**/
+
+package ldcache
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/moby/sys/symlink"
+)
+
+// A containerRoot represents the root filesystem of a container.
+type containerRoot string
+
+// hasPath checks whether the specified path exists in the root.
+func (r containerRoot) hasPath(path string) bool {
+	resolved, err := r.resolve(path)
+	if err != nil {
+		return false
+	}
+	if _, err := os.Stat(resolved); err != nil && os.IsNotExist(err) {
+		return false
+	}
+	return true
+}
+
+// resolve returns the absolute path including root path.
+// Symlinks are resolved, but are guaranteed to resolve in the root.
+func (r containerRoot) resolve(path string) (string, error) {
+	absolute := filepath.Clean(filepath.Join(string(r), path))
+	return symlink.FollowSymlinkInScope(absolute, string(r))
+}

cmd/nvidia-cdi-hook/update-ldcache/ldconfig_linux.go

@@ -17,7 +17,7 @@
 # limitations under the License.
 **/
 
-package ldconfig
+package ldcache
 
 import (
 	"errors"
@@ -29,8 +29,8 @@ import (
 	"syscall"
 
 	securejoin "github.com/cyphar/filepath-securejoin"
-	"github.com/moby/sys/reexec"
 
+	"github.com/moby/sys/reexec"
 	"github.com/opencontainers/runc/libcontainer/utils"
 	"golang.org/x/sys/unix"
 )
@@ -182,7 +182,7 @@ func createTmpFs(target string, size int) error {
 // createReexecCommand creates a command that can be used to trigger the reexec
 // initializer.
 // On linux this command runs in new namespaces.
-func createReexecCommand(args []string) (*exec.Cmd, error) {
+func createReexecCommand(args []string) *exec.Cmd {
 	cmd := reexec.Command(args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
@@ -196,5 +196,5 @@ func createReexecCommand(args []string) (*exec.Cmd, error) {
 			syscall.CLONE_NEWNET,
 	}
 
-	return cmd, nil
+	return cmd
 }

cmd/nvidia-cdi-hook/update-ldcache/ldconfig_other.go

@@ -17,11 +17,14 @@
 # limitations under the License.
 **/
 
-package ldconfig
+package ldcache
 
 import (
 	"fmt"
+	"os"
 	"os/exec"
+
+	"github.com/moby/sys/reexec"
 )
 
 func pivotRoot(newroot string) error {
@@ -36,6 +39,13 @@ func mountProc(newroot string) error {
 	return fmt.Errorf("not supported")
 }
 
-func createReexecCommand(args []string) (*exec.Cmd, error) {
-	return nil, fmt.Errorf("not supported")
+// createReexecCommand creates a command that can be used ot trigger the reexec
+// initializer.
+func createReexecCommand(args []string) *exec.Cmd {
+	cmd := reexec.Command(args...)
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	return cmd
 }

cmd/nvidia-cdi-hook/update-ldcache/safe-exec_linux.go

@@ -16,7 +16,7 @@
 # limitations under the License.
 **/
 
-package ldconfig
+package ldcache
 
 import (
 	"fmt"

cmd/nvidia-cdi-hook/update-ldcache/safe-exec_other.go

@@ -16,7 +16,7 @@
 # limitations under the License.
 **/
 
-package ldconfig
+package ldcache
 
 import "syscall"
 

cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go

@@ -17,21 +17,28 @@
 package ldcache
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"log"
 	"os"
+	"strings"
 
 	"github.com/moby/sys/reexec"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/ldconfig"
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/oci"
 )
 
 const (
+	// ldsoconfdFilenamePattern specifies the pattern for the filename
+	// in ld.so.conf.d that includes references to the specified directories.
+	// The 00-nvcr prefix is chosen to ensure that these libraries have a
+	// higher precedence than other libraries on the system, but lower than
+	// the 00-cuda-compat that is included in some containers.
+	ldsoconfdFilenamePattern = "00-nvcr-*.conf"
+
 	reexecUpdateLdCacheCommandName = "reexec-update-ldcache"
 )
 
@@ -40,7 +47,7 @@ type command struct {
 }
 
 type options struct {
-	folders       []string
+	folders       cli.StringSlice
 	ldconfigPath  string
 	containerSpec string
 }
@@ -68,11 +75,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "update-ldcache",
 		Usage: "Update ldcache in a container by running ldconfig",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &cfg)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &cfg)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(ctx, cmd, &cfg)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &cfg)
 		},
 	}
 
@@ -98,14 +105,14 @@ func (m command) build() *cli.Command {
 	return &c
 }
 
-func (m command) validateFlags(cmd *cli.Command, cfg *options) error {
+func (m command) validateFlags(c *cli.Context, cfg *options) error {
 	if cfg.ldconfigPath == "" {
 		return errors.New("ldconfig-path must be specified")
 	}
 	return nil
 }
 
-func (m command) run(ctx context.Context, cmd *cli.Command, cfg *options) error {
+func (m command) run(c *cli.Context, cfg *options) error {
 	s, err := oci.LoadContainerState(cfg.containerSpec)
 	if err != nil {
 		return fmt.Errorf("failed to load container state: %v", err)
@@ -116,16 +123,16 @@ func (m command) run(ctx context.Context, cmd *cli.Command, cfg *options) error
 		return fmt.Errorf("failed to determined container root: %v", err)
 	}
 
-	runner, err := ldconfig.NewRunner(
+	args := []string{
 		reexecUpdateLdCacheCommandName,
-		cfg.ldconfigPath,
+		strings.TrimPrefix(config.NormalizeLDConfigPath("@"+cfg.ldconfigPath), "@"),
 		containerRootDir,
-		cfg.folders...,
-	)
-	if err != nil {
-		return err
 	}
-	return runner.Run()
+	args = append(args, cfg.folders.Value()...)
+
+	cmd := createReexecCommand(args)
+
+	return cmd.Run()
 }
 
 // updateLdCacheHandler wraps updateLdCache with error handling.
@@ -136,16 +143,15 @@ func updateLdCacheHandler() {
 	}
 }
 
-// updateLdCache ensures that the ldcache in the container is updated to include
-// libraries that are mounted from the host.
-// It is invoked from a reexec'd handler and provides namespace isolation for
-// the operations performed by this hook. At the point where this is invoked,
-// we are in a new mount namespace that is cloned from the parent.
+// updateLdCache is invoked from a reexec'd handler and provides namespace
+// isolation for the operations performed by this hook.
+// At the point where this is invoked, we are in a new mount namespace that is
+// cloned from the parent.
 //
 // args[0] is the reexec initializer function name
 // args[1] is the path of the ldconfig binary on the host
 // args[2] is the container root directory
-// The remaining args are folders where soname symlinks need to be created.
+// The remaining args are folders that need to be added to the ldcache.
 func updateLdCache(args []string) error {
 	if len(args) < 3 {
 		return fmt.Errorf("incorrect arguments: %v", args)
@@ -153,13 +159,97 @@ func updateLdCache(args []string) error {
 	hostLdconfigPath := args[1]
 	containerRootDirPath := args[2]
 
-	ldconfig, err := ldconfig.New(
-		hostLdconfigPath,
-		containerRootDirPath,
-	)
-	if err != nil {
-		return fmt.Errorf("failed to construct ldconfig runner: %w", err)
+	// To prevent leaking the parent proc filesystem, we create a new proc mount
+	// in the container root.
+	if err := mountProc(containerRootDirPath); err != nil {
+		return fmt.Errorf("error mounting /proc: %w", err)
 	}
 
-	return ldconfig.UpdateLDCache(args[3:]...)
+	// We mount the host ldconfig before we pivot root since host paths are not
+	// visible after the pivot root operation.
+	ldconfigPath, err := mountLdConfig(hostLdconfigPath, containerRootDirPath)
+	if err != nil {
+		return fmt.Errorf("error mounting host ldconfig: %w", err)
+	}
+
+	// We pivot to the container root for the new process, this further limits
+	// access to the host.
+	if err := pivotRoot(containerRootDirPath); err != nil {
+		return fmt.Errorf("error running pivot_root: %w", err)
+	}
+
+	return runLdconfig(ldconfigPath, args[3:]...)
+}
+
+// runLdconfig runs the ldconfig binary and ensures that the specified directories
+// are processed for the ldcache.
+func runLdconfig(ldconfigPath string, directories ...string) error {
+	args := []string{
+		"ldconfig",
+		// Explicitly specify using /etc/ld.so.conf since the host's ldconfig may
+		// be configured to use a different config file by default.
+		// Note that since we apply the `-r {{ .containerRootDir }}` argument, /etc/ld.so.conf is
+		// in the container.
+		"-f", "/etc/ld.so.conf",
+	}
+
+	containerRoot := containerRoot("/")
+
+	if containerRoot.hasPath("/etc/ld.so.cache") {
+		args = append(args, "-C", "/etc/ld.so.cache")
+	} else {
+		args = append(args, "-N")
+	}
+
+	if containerRoot.hasPath("/etc/ld.so.conf.d") {
+		err := createLdsoconfdFile(ldsoconfdFilenamePattern, directories...)
+		if err != nil {
+			return fmt.Errorf("failed to update ld.so.conf.d: %w", err)
+		}
+	} else {
+		args = append(args, directories...)
+	}
+
+	return SafeExec(ldconfigPath, args, nil)
+}
+
+// createLdsoconfdFile creates a file at /etc/ld.so.conf.d/.
+// The file is created at /etc/ld.so.conf.d/{{ .pattern }} using `CreateTemp` and
+// contains the specified directories on each line.
+func createLdsoconfdFile(pattern string, dirs ...string) error {
+	if len(dirs) == 0 {
+		return nil
+	}
+
+	ldsoconfdDir := "/etc/ld.so.conf.d"
+	if err := os.MkdirAll(ldsoconfdDir, 0755); err != nil {
+		return fmt.Errorf("failed to create ld.so.conf.d: %w", err)
+	}
+
+	configFile, err := os.CreateTemp(ldsoconfdDir, pattern)
+	if err != nil {
+		return fmt.Errorf("failed to create config file: %w", err)
+	}
+	defer func() {
+		_ = configFile.Close()
+	}()
+
+	added := make(map[string]bool)
+	for _, dir := range dirs {
+		if added[dir] {
+			continue
+		}
+		_, err = fmt.Fprintf(configFile, "%s\n", dir)
+		if err != nil {
+			return fmt.Errorf("failed to update config file: %w", err)
+		}
+		added[dir] = true
+	}
+
+	// The created file needs to be world readable for the cases where the container is run as a non-root user.
+	if err := configFile.Chmod(0644); err != nil {
+		return fmt.Errorf("failed to chmod config file: %w", err)
+	}
+
+	return nil
 }

cmd/nvidia-container-runtime-hook/container_config.go

@@ -13,6 +13,10 @@ import (
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config/image"
 )
 
+const (
+	capSysAdmin = "CAP_SYS_ADMIN"
+)
+
 type nvidiaConfig struct {
 	Devices            []string
 	MigConfigDevices   string
@@ -99,9 +103,9 @@ func loadSpec(path string) (spec *Spec) {
 	return
 }
 
-func (s *Spec) GetCapabilities() []string {
-	if s == nil || s.Process == nil || s.Process.Capabilities == nil {
-		return nil
+func isPrivileged(s *Spec) bool {
+	if s.Process.Capabilities == nil {
+		return false
 	}
 
 	var caps []string
@@ -114,22 +118,67 @@ func (s *Spec) GetCapabilities() []string {
 		if err != nil {
 			log.Panicln("could not decode Process.Capabilities in OCI spec:", err)
 		}
-		return caps
+		for _, c := range caps {
+			if c == capSysAdmin {
+				return true
+			}
+		}
+		return false
 	}
 
 	// Otherwise, parse s.Process.Capabilities as:
 	// github.com/opencontainers/runtime-spec/blob/v1.0.0/specs-go/config.go#L30-L54
-	capabilities := specs.LinuxCapabilities{}
-	err := json.Unmarshal(*s.Process.Capabilities, &capabilities)
+	process := specs.Process{
+		Env: s.Process.Env,
+	}
+
+	err := json.Unmarshal(*s.Process.Capabilities, &process.Capabilities)
 	if err != nil {
 		log.Panicln("could not decode Process.Capabilities in OCI spec:", err)
 	}
 
-	return image.OCISpecCapabilities(capabilities).GetCapabilities()
+	fullSpec := specs.Spec{
+		Version: *s.Version,
+		Process: &process,
+	}
+
+	return image.IsPrivileged(&fullSpec)
 }
 
-func isPrivileged(s *Spec) bool {
-	return image.IsPrivileged(s)
+func getDevicesFromEnvvar(containerImage image.CUDA, swarmResourceEnvvars []string) []string {
+	// We check if the image has at least one of the Swarm resource envvars defined and use this
+	// if specified.
+	for _, envvar := range swarmResourceEnvvars {
+		if containerImage.HasEnvvar(envvar) {
+			return containerImage.DevicesFromEnvvars(swarmResourceEnvvars...).List()
+		}
+	}
+
+	return containerImage.VisibleDevicesFromEnvVar()
+}
+
+func (hookConfig *hookConfig) getDevices(image image.CUDA, privileged bool) []string {
+	// If enabled, try and get the device list from volume mounts first
+	if hookConfig.AcceptDeviceListAsVolumeMounts {
+		devices := image.VisibleDevicesFromMounts()
+		if len(devices) > 0 {
+			return devices
+		}
+	}
+
+	// Fallback to reading from the environment variable if privileges are correct
+	devices := getDevicesFromEnvvar(image, hookConfig.getSwarmResourceEnvvars())
+	if len(devices) == 0 {
+		return nil
+	}
+	if privileged || hookConfig.AcceptEnvvarUnprivileged {
+		return devices
+	}
+
+	configName := hookConfig.getConfigOption("AcceptEnvvarUnprivileged")
+	log.Printf("Ignoring devices specified in NVIDIA_VISIBLE_DEVICES (privileged=%v, %v=%v) ", privileged, configName, hookConfig.AcceptEnvvarUnprivileged)
+
+	return nil
 }
 
 func getMigConfigDevices(i image.CUDA) *string {
@@ -176,6 +225,7 @@ func (hookConfig *hookConfig) getDriverCapabilities(cudaImage image.CUDA, legacy
 	// We use the default driver capabilities by default. This is filtered to only include the
 	// supported capabilities
 	supportedDriverCapabilities := image.NewDriverCapabilities(hookConfig.SupportedDriverCapabilities)
+
 	capabilities := supportedDriverCapabilities.Intersection(image.DefaultDriverCapabilities)
 
 	capsEnvSpecified := cudaImage.HasEnvvar(image.EnvVarNvidiaDriverCapabilities)
@@ -201,7 +251,7 @@ func (hookConfig *hookConfig) getDriverCapabilities(cudaImage image.CUDA, legacy
 func (hookConfig *hookConfig) getNvidiaConfig(image image.CUDA, privileged bool) *nvidiaConfig {
 	legacyImage := image.IsLegacy()
 
-	devices := image.VisibleDevices()
+	devices := hookConfig.getDevices(image, privileged)
 	if len(devices) == 0 {
 		// empty devices means this is not a GPU container.
 		return nil
@@ -242,14 +292,7 @@ func (hookConfig *hookConfig) getNvidiaConfig(image image.CUDA, privileged bool)
 	}
 }
 
-func (hookConfig *hookConfig) getContainerConfig() (config *containerConfig) {
-	hookConfig.Lock()
-	defer hookConfig.Unlock()
-
-	if hookConfig.containerConfig != nil {
-		return hookConfig.containerConfig
-	}
-
+func (hookConfig *hookConfig) getContainerConfig() (config containerConfig) {
 	var h HookState
 	d := json.NewDecoder(os.Stdin)
 	if err := d.Decode(&h); err != nil {
@@ -263,28 +306,20 @@ func (hookConfig *hookConfig) getContainerConfig() (config *containerConfig) {
 
 	s := loadSpec(path.Join(b, "config.json"))
 
-	privileged := isPrivileged(s)
-
-	i, err := image.New(
+	image, err := image.New(
 		image.WithEnv(s.Process.Env),
 		image.WithMounts(s.Mounts),
-		image.WithPrivileged(privileged),
 		image.WithDisableRequire(hookConfig.DisableRequire),
-		image.WithAcceptDeviceListAsVolumeMounts(hookConfig.AcceptDeviceListAsVolumeMounts),
-		image.WithAcceptEnvvarUnprivileged(hookConfig.AcceptEnvvarUnprivileged),
-		image.WithPreferredVisibleDevicesEnvVars(hookConfig.getSwarmResourceEnvvars()...),
 	)
 	if err != nil {
 		log.Panicln(err)
 	}
 
-	cc := containerConfig{
+	privileged := isPrivileged(s)
+	return containerConfig{
 		Pid:    h.Pid,
 		Rootfs: s.Root.Path,
-		Image:  i,
-		Nvidia: hookConfig.getNvidiaConfig(i, privileged),
+		Image:  image,
+		Nvidia: hookConfig.getNvidiaConfig(image, privileged),
 	}
-	hookConfig.containerConfig = &cc
-
-	return hookConfig.containerConfig
 }

cmd/nvidia-container-runtime-hook/container_config_test.go

@@ -1,8 +1,10 @@
 package main
 
 import (
+	"path/filepath"
 	"testing"
 
+	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/stretchr/testify/require"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
@@ -477,17 +479,14 @@ func TestGetNvidiaConfig(t *testing.T) {
 		t.Run(tc.description, func(t *testing.T) {
 			image, _ := image.New(
 				image.WithEnvMap(tc.env),
-				image.WithPrivileged(tc.privileged),
-				image.WithPreferredVisibleDevicesEnvVars(tc.hookConfig.getSwarmResourceEnvvars()...),
 			)
-
 			// Wrap the call to getNvidiaConfig() in a closure.
 			var cfg *nvidiaConfig
 			getConfig := func() {
 				hookCfg := tc.hookConfig
 				if hookCfg == nil {
 					defaultConfig, _ := config.GetDefault()
-					hookCfg = &hookConfig{Config: defaultConfig}
+					hookCfg = &hookConfig{defaultConfig}
 				}
 				cfg = hookCfg.getNvidiaConfig(image, tc.privileged)
 			}
@@ -519,6 +518,340 @@ func TestGetNvidiaConfig(t *testing.T) {
 	}
 }
 
+func TestDeviceListSourcePriority(t *testing.T) {
+	var tests = []struct {
+		description        string
+		mountDevices       []specs.Mount
+		envvarDevices      string
+		privileged         bool
+		acceptUnprivileged bool
+		acceptMounts       bool
+		expectedDevices    []string
+	}{
+		{
+			description: "Mount devices, unprivileged, no accept unprivileged",
+			mountDevices: []specs.Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU0"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU1"),
+				},
+			},
+			envvarDevices:      "GPU2,GPU3",
+			privileged:         false,
+			acceptUnprivileged: false,
+			acceptMounts:       true,
+			expectedDevices:    []string{"GPU0", "GPU1"},
+		},
+		{
+			description:        "No mount devices, unprivileged, no accept unprivileged",
+			mountDevices:       nil,
+			envvarDevices:      "GPU0,GPU1",
+			privileged:         false,
+			acceptUnprivileged: false,
+			acceptMounts:       true,
+			expectedDevices:    nil,
+		},
+		{
+			description:        "No mount devices, privileged, no accept unprivileged",
+			mountDevices:       nil,
+			envvarDevices:      "GPU0,GPU1",
+			privileged:         true,
+			acceptUnprivileged: false,
+			acceptMounts:       true,
+			expectedDevices:    []string{"GPU0", "GPU1"},
+		},
+		{
+			description:        "No mount devices, unprivileged, accept unprivileged",
+			mountDevices:       nil,
+			envvarDevices:      "GPU0,GPU1",
+			privileged:         false,
+			acceptUnprivileged: true,
+			acceptMounts:       true,
+			expectedDevices:    []string{"GPU0", "GPU1"},
+		},
+		{
+			description: "Mount devices, unprivileged, accept unprivileged, no accept mounts",
+			mountDevices: []specs.Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU0"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU1"),
+				},
+			},
+			envvarDevices:      "GPU2,GPU3",
+			privileged:         false,
+			acceptUnprivileged: true,
+			acceptMounts:       false,
+			expectedDevices:    []string{"GPU2", "GPU3"},
+		},
+		{
+			description: "Mount devices, unprivileged, no accept unprivileged, no accept mounts",
+			mountDevices: []specs.Mount{
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU0"),
+				},
+				{
+					Source:      "/dev/null",
+					Destination: filepath.Join(image.DeviceListAsVolumeMountsRoot, "GPU1"),
+				},
+			},
+			envvarDevices:      "GPU2,GPU3",
+			privileged:         false,
+			acceptUnprivileged: false,
+			acceptMounts:       false,
+			expectedDevices:    nil,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			// Wrap the call to getDevices() in a closure.
+			var devices []string
+			getDevices := func() {
+				image, _ := image.New(
+					image.WithEnvMap(
+						map[string]string{
+							image.EnvVarNvidiaVisibleDevices: tc.envvarDevices,
+						},
+					),
+					image.WithMounts(tc.mountDevices),
+				)
+				defaultConfig, _ := config.GetDefault()
+				cfg := &hookConfig{defaultConfig}
+				cfg.AcceptEnvvarUnprivileged = tc.acceptUnprivileged
+				cfg.AcceptDeviceListAsVolumeMounts = tc.acceptMounts
+				devices = cfg.getDevices(image, tc.privileged)
+			}
+
+			// For all other tests, just grab the devices and check the results
+			getDevices()
+
+			require.Equal(t, tc.expectedDevices, devices)
+		})
+	}
+}
+
+func TestGetDevicesFromEnvvar(t *testing.T) {
+	envDockerResourceGPUs := "DOCKER_RESOURCE_GPUS"
+	gpuID := "GPU-12345"
+	anotherGPUID := "GPU-67890"
+	thirdGPUID := "MIG-12345"
+
+	var tests = []struct {
+		description          string
+		swarmResourceEnvvars []string
+		env                  map[string]string
+		expectedDevices      []string
+	}{
+		{
+			description: "empty env returns nil for non-legacy image",
+		},
+		{
+			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: "",
+			},
+		},
+		{
+			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: "void",
+			},
+		},
+		{
+			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: "none",
+			},
+			expectedDevices: []string{""},
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: gpuID,
+			},
+			expectedDevices: []string{gpuID},
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: gpuID,
+				image.EnvVarCudaVersion:          "legacy",
+			},
+			expectedDevices: []string{gpuID},
+		},
+		{
+			description: "empty env returns all for legacy image",
+			env: map[string]string{
+				image.EnvVarCudaVersion: "legacy",
+			},
+			expectedDevices: []string{"all"},
+		},
+		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is ignored when
+		// not enabled
+		{
+			description: "missing NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				envDockerResourceGPUs: anotherGPUID,
+			},
+		},
+		{
+			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: "",
+				envDockerResourceGPUs:            anotherGPUID,
+			},
+		},
+		{
+			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: "void",
+				envDockerResourceGPUs:            anotherGPUID,
+			},
+		},
+		{
+			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: "none",
+				envDockerResourceGPUs:            anotherGPUID,
+			},
+			expectedDevices: []string{""},
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: gpuID,
+				envDockerResourceGPUs:            anotherGPUID,
+			},
+			expectedDevices: []string{gpuID},
+		},
+		{
+			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: gpuID,
+				envDockerResourceGPUs:            anotherGPUID,
+				image.EnvVarCudaVersion:          "legacy",
+			},
+			expectedDevices: []string{gpuID},
+		},
+		{
+			description: "empty env returns all for legacy image",
+			env: map[string]string{
+				envDockerResourceGPUs:   anotherGPUID,
+				image.EnvVarCudaVersion: "legacy",
+			},
+			expectedDevices: []string{"all"},
+		},
+		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is selected when
+		// enabled
+		{
+			description:          "empty env returns nil for non-legacy image",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+		},
+		{
+			description:          "blank DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+			env: map[string]string{
+				envDockerResourceGPUs: "",
+			},
+		},
+		{
+			description:          "'void' DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+			env: map[string]string{
+				envDockerResourceGPUs: "void",
+			},
+		},
+		{
+			description:          "'none' DOCKER_RESOURCE_GPUS returns empty for non-legacy image",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+			env: map[string]string{
+				envDockerResourceGPUs: "none",
+			},
+			expectedDevices: []string{""},
+		},
+		{
+			description:          "DOCKER_RESOURCE_GPUS set returns value for non-legacy image",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+			env: map[string]string{
+				envDockerResourceGPUs: gpuID,
+			},
+			expectedDevices: []string{gpuID},
+		},
+		{
+			description:          "DOCKER_RESOURCE_GPUS set returns value for legacy image",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+			env: map[string]string{
+				envDockerResourceGPUs:   gpuID,
+				image.EnvVarCudaVersion: "legacy",
+			},
+			expectedDevices: []string{gpuID},
+		},
+		{
+			description:          "DOCKER_RESOURCE_GPUS is selected if present",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+			env: map[string]string{
+				envDockerResourceGPUs: anotherGPUID,
+			},
+			expectedDevices: []string{anotherGPUID},
+		},
+		{
+			description:          "DOCKER_RESOURCE_GPUS overrides NVIDIA_VISIBLE_DEVICES if present",
+			swarmResourceEnvvars: []string{envDockerResourceGPUs},
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices: gpuID,
+				envDockerResourceGPUs:            anotherGPUID,
+			},
+			expectedDevices: []string{anotherGPUID},
+		},
+		{
+			description:          "DOCKER_RESOURCE_GPUS_ADDITIONAL overrides NVIDIA_VISIBLE_DEVICES if present",
+			swarmResourceEnvvars: []string{"DOCKER_RESOURCE_GPUS_ADDITIONAL"},
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices:  gpuID,
+				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
+			},
+			expectedDevices: []string{anotherGPUID},
+		},
+		{
+			description:          "All available swarm resource envvars are selected and override NVIDIA_VISIBLE_DEVICES if present",
+			swarmResourceEnvvars: []string{"DOCKER_RESOURCE_GPUS", "DOCKER_RESOURCE_GPUS_ADDITIONAL"},
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices:  gpuID,
+				"DOCKER_RESOURCE_GPUS":            thirdGPUID,
+				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
+			},
+			expectedDevices: []string{thirdGPUID, anotherGPUID},
+		},
+		{
+			description:          "DOCKER_RESOURCE_GPUS_ADDITIONAL or DOCKER_RESOURCE_GPUS override NVIDIA_VISIBLE_DEVICES if present",
+			swarmResourceEnvvars: []string{"DOCKER_RESOURCE_GPUS", "DOCKER_RESOURCE_GPUS_ADDITIONAL"},
+			env: map[string]string{
+				image.EnvVarNvidiaVisibleDevices:  gpuID,
+				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
+			},
+			expectedDevices: []string{anotherGPUID},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			image, _ := image.New(
+				image.WithEnvMap(tc.env),
+			)
+			devices := getDevicesFromEnvvar(image, tc.swarmResourceEnvvars)
+			require.EqualValues(t, tc.expectedDevices, devices)
+		})
+	}
+}
+
 func TestGetDriverCapabilities(t *testing.T) {
 
 	supportedCapabilities := "compute,display,utility,video"

cmd/nvidia-container-runtime-hook/hook_config.go

@@ -4,46 +4,50 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"path"
 	"reflect"
 	"strings"
-	"sync"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config/image"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/info"
+)
+
+const (
+	configPath = "/etc/nvidia-container-runtime/config.toml"
+	driverPath = "/run/nvidia/driver"
 )
 
 // hookConfig wraps the toolkit config.
 // This allows for functions to be defined on the local type.
 type hookConfig struct {
-	sync.Mutex
 	*config.Config
-	containerConfig *containerConfig
 }
 
 // loadConfig loads the required paths for the hook config.
 func loadConfig() (*config.Config, error) {
-	configFilePath, required := getConfigFilePath()
-	cfg, err := config.New(
-		config.WithConfigFile(configFilePath),
-		config.WithRequired(true),
-	)
-	if err == nil {
-		return cfg.Config()
-	} else if os.IsNotExist(err) && !required {
-		return config.GetDefault()
+	var configPaths []string
+	var required bool
+	if len(*configflag) != 0 {
+		configPaths = append(configPaths, *configflag)
+		required = true
+	} else {
+		configPaths = append(configPaths, path.Join(driverPath, configPath), configPath)
 	}
-	return nil, fmt.Errorf("couldn't open required configuration file: %v", err)
-}
 
-func getConfigFilePath() (string, bool) {
-	if configFromFlag := *configflag; configFromFlag != "" {
-		return configFromFlag, true
+	for _, p := range configPaths {
+		cfg, err := config.New(
+			config.WithConfigFile(p),
+			config.WithRequired(true),
+		)
+		if err == nil {
+			return cfg.Config()
+		} else if os.IsNotExist(err) && !required {
+			continue
+		}
+		return nil, fmt.Errorf("couldn't open required configuration file: %v", err)
 	}
-	if configFromEnvvar := os.Getenv(config.FilePathOverrideEnvVar); configFromEnvvar != "" {
-		return configFromEnvvar, true
-	}
-	return config.GetConfigFilePath(), false
+
+	return config.GetDefault()
 }
 
 func getHookConfig() (*hookConfig, error) {
@@ -51,7 +55,7 @@ func getHookConfig() (*hookConfig, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to load config: %v", err)
 	}
-	config := &hookConfig{Config: cfg}
+	config := &hookConfig{cfg}
 
 	allSupportedDriverCapabilities := image.SupportedDriverCapabilities
 	if config.SupportedDriverCapabilities == "all" {
@@ -69,8 +73,8 @@ func getHookConfig() (*hookConfig, error) {
 
 // getConfigOption returns the toml config option associated with the
 // specified struct field.
-func (c *hookConfig) getConfigOption(fieldName string) string {
-	t := reflect.TypeOf(&c)
+func (c hookConfig) getConfigOption(fieldName string) string {
+	t := reflect.TypeOf(c)
 	f, ok := t.FieldByName(fieldName)
 	if !ok {
 		return fieldName
@@ -84,7 +88,7 @@ func (c *hookConfig) getConfigOption(fieldName string) string {
 
 // getSwarmResourceEnvvars returns the swarm resource envvars for the config.
 func (c *hookConfig) getSwarmResourceEnvvars() []string {
-	if c == nil || c.SwarmResource == "" {
+	if c.SwarmResource == "" {
 		return nil
 	}
 
@@ -123,21 +127,3 @@ func (c *hookConfig) nvidiaContainerCliCUDACompatModeFlags() []string {
 	}
 	return []string{flag}
 }
-
-func (c *hookConfig) assertModeIsLegacy() error {
-	if c.NVIDIAContainerRuntimeHookConfig.SkipModeDetection {
-		return nil
-	}
-
-	mr := info.NewRuntimeModeResolver(
-		info.WithLogger(&logInterceptor{}),
-		info.WithImage(&c.containerConfig.Image),
-		info.WithDefaultMode(info.LegacyRuntimeMode),
-	)
-
-	mode := mr.ResolveRuntimeMode(c.NVIDIAContainerRuntimeConfig.Mode)
-	if mode == "legacy" {
-		return nil
-	}
-	return fmt.Errorf("invoking the NVIDIA Container Runtime Hook directly (e.g. specifying the docker --gpus flag) is not supported. Please use the NVIDIA Container Runtime (e.g. specify the --runtime=nvidia flag) instead")
-}

cmd/nvidia-container-runtime-hook/hook_config_test.go

@@ -90,10 +90,10 @@ func TestGetHookConfig(t *testing.T) {
 				}
 			}
 
-			var cfg *hookConfig
+			var cfg hookConfig
 			getHookConfig := func() {
 				c, _ := getHookConfig()
-				cfg = c
+				cfg = *c
 			}
 
 			if tc.expectedPanic {

cmd/nvidia-container-runtime-hook/main.go

@@ -55,7 +55,7 @@ func getCLIPath(config config.ContainerCLIConfig) string {
 }
 
 // getRootfsPath returns an absolute path. We don't need to resolve symlinks for now.
-func getRootfsPath(config *containerConfig) string {
+func getRootfsPath(config containerConfig) string {
 	rootfs, err := filepath.Abs(config.Rootfs)
 	if err != nil {
 		log.Panicln(err)
@@ -82,8 +82,8 @@ func doPrestart() {
 		return
 	}
 
-	if err := hook.assertModeIsLegacy(); err != nil {
-		log.Panicf("%v", err)
+	if !hook.NVIDIAContainerRuntimeHookConfig.SkipModeDetection && info.ResolveAutoMode(&logInterceptor{}, hook.NVIDIAContainerRuntimeConfig.Mode, container.Image) != "legacy" {
+		log.Panicln("invoking the NVIDIA Container Runtime Hook directly (e.g. specifying the docker --gpus flag) is not supported. Please use the NVIDIA Container Runtime (e.g. specify the --runtime=nvidia flag) instead.")
 	}
 
 	rootfs := getRootfsPath(container)

cmd/nvidia-container-runtime/README.md

@@ -21,8 +21,8 @@ The `runtimes` config option allows for the low-level runtime to be specified. T
 The default value for this setting is:
 ```toml
 runtimes = [
+    "docker-runc",
     "runc",
-    "crun",
 ]
 ```
 

cmd/nvidia-container-runtime/main_test.go

@@ -122,10 +122,11 @@ func TestGoodInput(t *testing.T) {
 	err = cmdCreate.Run()
 	require.NoError(t, err, "runtime should not return an error")
 
-	// Check config.json to ensure that the NVIDIA prestart was not inserted.
+	// Check config.json for NVIDIA prestart hook
 	spec, err = cfg.getRuntimeSpec()
 	require.NoError(t, err, "should be no errors when reading and parsing spec from config.json")
-	require.Empty(t, spec.Hooks, "there should be no hooks in config.json")
+	require.NotEmpty(t, spec.Hooks, "there should be hooks in config.json")
+	require.Equal(t, 1, nvidiaHookCount(spec.Hooks), "exactly one nvidia prestart hook should be inserted correctly into config.json")
 }
 
 // NVIDIA prestart hook already present in config file
@@ -167,10 +168,11 @@ func TestDuplicateHook(t *testing.T) {
 	output, err := cmdCreate.CombinedOutput()
 	require.NoErrorf(t, err, "runtime should not return an error", "output=%v", string(output))
 
-	// Check config.json to ensure that the NVIDIA prestart hook was removed.
+	// Check config.json for NVIDIA prestart hook
 	spec, err = cfg.getRuntimeSpec()
 	require.NoError(t, err, "should be no errors when reading and parsing spec from config.json")
-	require.Empty(t, spec.Hooks, "there should be no hooks in config.json")
+	require.NotEmpty(t, spec.Hooks, "there should be hooks in config.json")
+	require.Equal(t, 1, nvidiaHookCount(spec.Hooks), "exactly one nvidia prestart hook should be inserted correctly into config.json")
 }
 
 // addNVIDIAHook is a basic wrapper for an addHookModifier that is used for
@@ -238,3 +240,18 @@ func (c testConfig) generateNewRuntimeSpec() error {
 	}
 	return nil
 }
+
+// Return number of valid NVIDIA prestart hooks in runtime spec
+func nvidiaHookCount(hooks *specs.Hooks) int {
+	if hooks == nil {
+		return 0
+	}
+
+	count := 0
+	for _, hook := range hooks.Prestart {
+		if strings.Contains(hook.Path, nvidiaHook) {
+			count++
+		}
+	}
+	return count
+}

cmd/nvidia-ctk-installer/container/container.go

@@ -22,7 +22,7 @@ import (
 	"os/exec"
 
 	"github.com/sirupsen/logrus"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container/operator"
 	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine"
@@ -53,7 +53,7 @@ type Options struct {
 }
 
 // ParseArgs parses the command line arguments to the CLI
-func ParseArgs(c *cli.Command, o *Options) error {
+func ParseArgs(c *cli.Context, o *Options) error {
 	if o.RuntimeDir != "" {
 		logrus.Debug("Runtime directory already set; ignoring arguments")
 		return nil
@@ -61,7 +61,7 @@ func ParseArgs(c *cli.Command, o *Options) error {
 
 	args := c.Args()
 
-	logrus.Infof("Parsing arguments: %v", args)
+	logrus.Infof("Parsing arguments: %v", args.Slice())
 	if c.NArg() != 1 {
 		return fmt.Errorf("incorrect number of arguments")
 	}

cmd/nvidia-ctk-installer/container/runtime/containerd/containerd.go

@@ -21,7 +21,7 @@ import (
 	"fmt"
 
 	log "github.com/sirupsen/logrus"
-	cli "github.com/urfave/cli/v3"
+	cli "github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container"
 	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine"
@@ -44,7 +44,7 @@ type Options struct {
 	useLegacyConfig bool
 	runtimeType     string
 
-	ContainerRuntimeModesCDIAnnotationPrefixes []string
+	ContainerRuntimeModesCDIAnnotationPrefixes cli.StringSlice
 
 	runtimeConfigOverrideJSON string
 }
@@ -58,26 +58,26 @@ func Flags(opts *Options) []cli.Flag {
 				"containerd.runtimes.default_runtime config section is used to define the default " +
 				"runtime instead of container.default_runtime_name.",
 			Destination: &opts.useLegacyConfig,
-			Sources:     cli.EnvVars("CONTAINERD_USE_LEGACY_CONFIG"),
+			EnvVars:     []string{"CONTAINERD_USE_LEGACY_CONFIG"},
 		},
 		&cli.StringFlag{
 			Name:        "runtime-type",
 			Usage:       "The runtime_type to use for the configured runtime classes",
 			Value:       defaultRuntmeType,
 			Destination: &opts.runtimeType,
-			Sources:     cli.EnvVars("CONTAINERD_RUNTIME_TYPE"),
+			EnvVars:     []string{"CONTAINERD_RUNTIME_TYPE"},
 		},
 		&cli.StringSliceFlag{
 			Name:        "nvidia-container-runtime-modes.cdi.annotation-prefixes",
 			Destination: &opts.ContainerRuntimeModesCDIAnnotationPrefixes,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_MODES_CDI_ANNOTATION_PREFIXES"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_MODES_CDI_ANNOTATION_PREFIXES"},
 		},
 		&cli.StringFlag{
 			Name:        "runtime-config-override",
 			Destination: &opts.runtimeConfigOverrideJSON,
 			Usage:       "specify additional runtime options as a JSON string. The paths are relative to the runtime config.",
 			Value:       "{}",
-			Sources:     cli.EnvVars("RUNTIME_CONFIG_OVERRIDE", "CONTAINERD_RUNTIME_CONFIG_OVERRIDE"),
+			EnvVars:     []string{"RUNTIME_CONFIG_OVERRIDE", "CONTAINERD_RUNTIME_CONFIG_OVERRIDE"},
 		},
 	}
 
@@ -85,8 +85,8 @@ func Flags(opts *Options) []cli.Flag {
 }
 
 // Setup updates a containerd configuration to include the nvidia-containerd-runtime and reloads it
-func Setup(c *cli.Command, o *container.Options, co *Options) error {
-	log.Infof("Starting 'setup' for %v", c.Name)
+func Setup(c *cli.Context, o *container.Options, co *Options) error {
+	log.Infof("Starting 'setup' for %v", c.App.Name)
 
 	cfg, err := getRuntimeConfig(o, co)
 	if err != nil {
@@ -103,14 +103,14 @@ func Setup(c *cli.Command, o *container.Options, co *Options) error {
 		return fmt.Errorf("unable to restart containerd: %v", err)
 	}
 
-	log.Infof("Completed 'setup' for %v", c.Name)
+	log.Infof("Completed 'setup' for %v", c.App.Name)
 
 	return nil
 }
 
 // Cleanup reverts a containerd configuration to remove the nvidia-containerd-runtime and reloads it
-func Cleanup(c *cli.Command, o *container.Options, co *Options) error {
-	log.Infof("Starting 'cleanup' for %v", c.Name)
+func Cleanup(c *cli.Context, o *container.Options, co *Options) error {
+	log.Infof("Starting 'cleanup' for %v", c.App.Name)
 
 	cfg, err := getRuntimeConfig(o, co)
 	if err != nil {
@@ -127,7 +127,7 @@ func Cleanup(c *cli.Command, o *container.Options, co *Options) error {
 		return fmt.Errorf("unable to restart containerd: %v", err)
 	}
 
-	log.Infof("Completed 'cleanup' for %v", c.Name)
+	log.Infof("Completed 'cleanup' for %v", c.App.Name)
 
 	return nil
 }
@@ -140,7 +140,7 @@ func RestartContainerd(o *container.Options) error {
 // containerAnnotationsFromCDIPrefixes returns the container annotations to set for the given CDI prefixes.
 func (o *Options) containerAnnotationsFromCDIPrefixes() []string {
 	var annotations []string
-	for _, prefix := range o.ContainerRuntimeModesCDIAnnotationPrefixes {
+	for _, prefix := range o.ContainerRuntimeModesCDIAnnotationPrefixes.Value() {
 		annotations = append(annotations, prefix+"*")
 	}
 

cmd/nvidia-ctk-installer/container/runtime/crio/crio.go

@@ -22,7 +22,7 @@ import (
 	"path/filepath"
 
 	log "github.com/sirupsen/logrus"
-	cli "github.com/urfave/cli/v3"
+	cli "github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
@@ -63,7 +63,7 @@ func Flags(opts *Options) []cli.Flag {
 			Usage:       "path to the cri-o hooks directory",
 			Value:       defaultHooksDir,
 			Destination: &opts.hooksDir,
-			Sources:     cli.EnvVars("CRIO_HOOKS_DIR"),
+			EnvVars:     []string{"CRIO_HOOKS_DIR"},
 			DefaultText: defaultHooksDir,
 		},
 		&cli.StringFlag{
@@ -71,7 +71,7 @@ func Flags(opts *Options) []cli.Flag {
 			Usage:       "filename of the cri-o hook that will be created / removed in the hooks directory",
 			Value:       defaultHookFilename,
 			Destination: &opts.hookFilename,
-			Sources:     cli.EnvVars("CRIO_HOOK_FILENAME"),
+			EnvVars:     []string{"CRIO_HOOK_FILENAME"},
 			DefaultText: defaultHookFilename,
 		},
 		&cli.StringFlag{
@@ -79,7 +79,7 @@ func Flags(opts *Options) []cli.Flag {
 			Usage:       "the configuration mode to use. One of [hook | config]",
 			Value:       defaultConfigMode,
 			Destination: &opts.configMode,
-			Sources:     cli.EnvVars("CRIO_CONFIG_MODE"),
+			EnvVars:     []string{"CRIO_CONFIG_MODE"},
 		},
 	}
 
@@ -87,8 +87,8 @@ func Flags(opts *Options) []cli.Flag {
 }
 
 // Setup installs the prestart hook required to launch GPU-enabled containers
-func Setup(c *cli.Command, o *container.Options, co *Options) error {
-	log.Infof("Starting 'setup' for %v", c.Name)
+func Setup(c *cli.Context, o *container.Options, co *Options) error {
+	log.Infof("Starting 'setup' for %v", c.App.Name)
 
 	switch co.configMode {
 	case "hook":
@@ -136,8 +136,8 @@ func setupConfig(o *container.Options) error {
 }
 
 // Cleanup removes the specified prestart hook
-func Cleanup(c *cli.Command, o *container.Options, co *Options) error {
-	log.Infof("Starting 'cleanup' for %v", c.Name)
+func Cleanup(c *cli.Context, o *container.Options, co *Options) error {
+	log.Infof("Starting 'cleanup' for %v", c.App.Name)
 
 	switch co.configMode {
 	case "hook":

cmd/nvidia-ctk-installer/container/runtime/docker/docker.go

@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	log "github.com/sirupsen/logrus"
-	cli "github.com/urfave/cli/v3"
+	cli "github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container"
 	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine"
@@ -42,8 +42,8 @@ func Flags(opts *Options) []cli.Flag {
 }
 
 // Setup updates docker configuration to include the nvidia runtime and reloads it
-func Setup(c *cli.Command, o *container.Options) error {
-	log.Infof("Starting 'setup' for %v", c.Name)
+func Setup(c *cli.Context, o *container.Options) error {
+	log.Infof("Starting 'setup' for %v", c.App.Name)
 
 	cfg, err := getRuntimeConfig(o)
 	if err != nil {
@@ -60,14 +60,14 @@ func Setup(c *cli.Command, o *container.Options) error {
 		return fmt.Errorf("unable to restart docker: %v", err)
 	}
 
-	log.Infof("Completed 'setup' for %v", c.Name)
+	log.Infof("Completed 'setup' for %v", c.App.Name)
 
 	return nil
 }
 
 // Cleanup reverts docker configuration to remove the nvidia runtime and reloads it
-func Cleanup(c *cli.Command, o *container.Options) error {
-	log.Infof("Starting 'cleanup' for %v", c.Name)
+func Cleanup(c *cli.Context, o *container.Options) error {
+	log.Infof("Starting 'cleanup' for %v", c.App.Name)
 
 	cfg, err := getRuntimeConfig(o)
 	if err != nil {
@@ -84,7 +84,7 @@ func Cleanup(c *cli.Command, o *container.Options) error {
 		return fmt.Errorf("unable to signal docker: %v", err)
 	}
 
-	log.Infof("Completed 'cleanup' for %v", c.Name)
+	log.Infof("Completed 'cleanup' for %v", c.App.Name)
 
 	return nil
 }

cmd/nvidia-ctk-installer/container/runtime/runtime.go

@@ -19,7 +19,7 @@ package runtime
 import (
 	"fmt"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container"
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container/runtime/containerd"
@@ -52,40 +52,40 @@ func Flags(opts *Options) []cli.Flag {
 			Usage:       "Path to the runtime config file",
 			Value:       runtimeSpecificDefault,
 			Destination: &opts.Config,
-			Sources:     cli.EnvVars("RUNTIME_CONFIG", "CONTAINERD_CONFIG", "DOCKER_CONFIG"),
+			EnvVars:     []string{"RUNTIME_CONFIG", "CONTAINERD_CONFIG", "DOCKER_CONFIG"},
 		},
 		&cli.StringFlag{
 			Name:        "executable-path",
 			Usage:       "The path to the runtime executable. This is used to extract the current config",
 			Destination: &opts.ExecutablePath,
-			Sources:     cli.EnvVars("RUNTIME_EXECUTABLE_PATH"),
+			EnvVars:     []string{"RUNTIME_EXECUTABLE_PATH"},
 		},
 		&cli.StringFlag{
 			Name:        "socket",
 			Usage:       "Path to the runtime socket file",
 			Value:       runtimeSpecificDefault,
 			Destination: &opts.Socket,
-			Sources:     cli.EnvVars("RUNTIME_SOCKET", "CONTAINERD_SOCKET", "DOCKER_SOCKET"),
+			EnvVars:     []string{"RUNTIME_SOCKET", "CONTAINERD_SOCKET", "DOCKER_SOCKET"},
 		},
 		&cli.StringFlag{
 			Name:        "restart-mode",
 			Usage:       "Specify how the runtime should be restarted; If 'none' is selected it will not be restarted [signal | systemd | none ]",
 			Value:       runtimeSpecificDefault,
 			Destination: &opts.RestartMode,
-			Sources:     cli.EnvVars("RUNTIME_RESTART_MODE"),
+			EnvVars:     []string{"RUNTIME_RESTART_MODE"},
 		},
 		&cli.BoolFlag{
 			Name:        "enable-cdi-in-runtime",
 			Usage:       "Enable CDI in the configured runt	ime",
 			Destination: &opts.EnableCDI,
-			Sources:     cli.EnvVars("RUNTIME_ENABLE_CDI"),
+			EnvVars:     []string{"RUNTIME_ENABLE_CDI"},
 		},
 		&cli.StringFlag{
 			Name:        "host-root",
 			Usage:       "Specify the path to the host root to be used when restarting the runtime using systemd",
 			Value:       defaultHostRootMount,
 			Destination: &opts.HostRootMount,
-			Sources:     cli.EnvVars("HOST_ROOT_MOUNT"),
+			EnvVars:     []string{"HOST_ROOT_MOUNT"},
 		},
 		&cli.StringFlag{
 			Name:        "runtime-name",
@@ -93,14 +93,14 @@ func Flags(opts *Options) []cli.Flag {
 			Usage:       "Specify the name of the `nvidia` runtime. If set-as-default is selected, the runtime is used as the default runtime.",
 			Value:       defaultRuntimeName,
 			Destination: &opts.RuntimeName,
-			Sources:     cli.EnvVars("NVIDIA_RUNTIME_NAME", "CONTAINERD_RUNTIME_CLASS", "DOCKER_RUNTIME_NAME"),
+			EnvVars:     []string{"NVIDIA_RUNTIME_NAME", "CONTAINERD_RUNTIME_CLASS", "DOCKER_RUNTIME_NAME"},
 		},
 		&cli.BoolFlag{
 			Name:        "set-as-default",
 			Usage:       "Set the `nvidia` runtime as the default runtime.",
 			Value:       defaultSetAsDefault,
 			Destination: &opts.SetAsDefault,
-			Sources:     cli.EnvVars("NVIDIA_RUNTIME_SET_AS_DEFAULT", "CONTAINERD_SET_AS_DEFAULT", "DOCKER_SET_AS_DEFAULT"),
+			EnvVars:     []string{"NVIDIA_RUNTIME_SET_AS_DEFAULT", "CONTAINERD_SET_AS_DEFAULT", "DOCKER_SET_AS_DEFAULT"},
 			Hidden:      true,
 		},
 	}
@@ -112,7 +112,7 @@ func Flags(opts *Options) []cli.Flag {
 }
 
 // Validate checks whether the specified options are valid
-func (opts *Options) Validate(logger logger.Interface, c *cli.Command, runtime string, toolkitRoot string, to *toolkit.Options) error {
+func (opts *Options) Validate(logger logger.Interface, c *cli.Context, runtime string, toolkitRoot string, to *toolkit.Options) error {
 	// We set this option here to ensure that it is available in future calls.
 	opts.RuntimeDir = toolkitRoot
 
@@ -164,7 +164,7 @@ func (opts *Options) Validate(logger logger.Interface, c *cli.Command, runtime s
 	return nil
 }
 
-func Setup(c *cli.Command, opts *Options, runtime string) error {
+func Setup(c *cli.Context, opts *Options, runtime string) error {
 	switch runtime {
 	case containerd.Name:
 		return containerd.Setup(c, &opts.Options, &opts.containerdOptions)
@@ -177,7 +177,7 @@ func Setup(c *cli.Command, opts *Options, runtime string) error {
 	}
 }
 
-func Cleanup(c *cli.Command, opts *Options, runtime string) error {
+func Cleanup(c *cli.Context, opts *Options, runtime string) error {
 	switch runtime {
 	case containerd.Name:
 		return containerd.Cleanup(c, &opts.Options, &opts.containerdOptions)

cmd/nvidia-ctk-installer/main.go

@@ -1,21 +1,19 @@
 package main
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"os/signal"
 	"path/filepath"
 	"syscall"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 	"golang.org/x/sys/unix"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container/runtime"
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/toolkit"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/info"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup"
 )
 
 const (
@@ -29,7 +27,7 @@ const (
 )
 
 var availableRuntimes = map[string]struct{}{"docker": {}, "crio": {}, "containerd": {}}
-var defaultLowLevelRuntimes = []string{"runc", "crun"}
+var defaultLowLevelRuntimes = []string{"docker-runc", "runc", "crun"}
 
 var waitingForSignal = make(chan bool, 1)
 var signalReceived = make(chan bool, 1)
@@ -38,11 +36,10 @@ var signalReceived = make(chan bool, 1)
 type options struct {
 	toolkitInstallDir string
 
-	noDaemon    bool
-	runtime     string
-	pidFile     string
-	sourceRoot  string
-	packageType string
+	noDaemon   bool
+	runtime    string
+	pidFile    string
+	sourceRoot string
 
 	toolkitOptions toolkit.Options
 	runtimeOptions runtime.Options
@@ -58,7 +55,7 @@ func main() {
 
 	// Run the CLI
 	logger.Infof("Starting %v", c.Name)
-	if err := c.Run(context.Background(), os.Args); err != nil {
+	if err := c.Run(os.Args); err != nil {
 		logger.Errorf("error running %v: %v", c.Name, err)
 		os.Exit(1)
 	}
@@ -74,27 +71,27 @@ type app struct {
 }
 
 // NewApp creates the CLI app fro the specified options.
-func NewApp(logger logger.Interface) *cli.Command {
+func NewApp(logger logger.Interface) *cli.App {
 	a := app{
 		logger: logger,
 	}
 	return a.build()
 }
 
-func (a app) build() *cli.Command {
+func (a app) build() *cli.App {
 	options := options{
 		toolkitOptions: toolkit.Options{},
 	}
 	// Create the top-level CLI
-	c := cli.Command{}
+	c := cli.NewApp()
 	c.Name = "nvidia-ctk-installer"
 	c.Usage = "Install the NVIDIA Container Toolkit and configure the specified runtime to use the `nvidia` runtime."
 	c.Version = info.GetVersionString()
-	c.Before = func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-		return ctx, a.Before(cmd, &options)
+	c.Before = func(ctx *cli.Context) error {
+		return a.Before(ctx, &options)
 	}
-	c.Action = func(ctx context.Context, cmd *cli.Command) error {
-		return a.Run(cmd, &options)
+	c.Action = func(ctx *cli.Context) error {
+		return a.Run(ctx, &options)
 	}
 
 	// Setup flags for the CLI
@@ -104,7 +101,7 @@ func (a app) build() *cli.Command {
 			Aliases:     []string{"n"},
 			Usage:       "terminate immediately after setting up the runtime. Note that no cleanup will be performed",
 			Destination: &options.noDaemon,
-			Sources:     cli.EnvVars("NO_DAEMON"),
+			EnvVars:     []string{"NO_DAEMON"},
 		},
 		&cli.StringFlag{
 			Name:        "runtime",
@@ -112,7 +109,7 @@ func (a app) build() *cli.Command {
 			Usage:       "the runtime to setup on this node. One of {'docker', 'crio', 'containerd'}",
 			Value:       defaultRuntime,
 			Destination: &options.runtime,
-			Sources:     cli.EnvVars("RUNTIME"),
+			EnvVars:     []string{"RUNTIME"},
 		},
 		&cli.StringFlag{
 			Name:    "toolkit-install-dir",
@@ -123,46 +120,31 @@ func (a app) build() *cli.Command {
 				"recommended that this match the path on the host.",
 			Value:       defaultToolkitInstallDir,
 			Destination: &options.toolkitInstallDir,
-			Sources:     cli.EnvVars("TOOLKIT_INSTALL_DIR", "ROOT"),
+			EnvVars:     []string{"TOOLKIT_INSTALL_DIR", "ROOT"},
 		},
 		&cli.StringFlag{
-			Name:        "toolkit-source-root",
-			Usage:       "The folder where the required toolkit artifacts can be found. If this is not specified, the path /artifacts/{{ .ToolkitPackageType }} is used where ToolkitPackageType is the resolved package type",
+			Name:        "source-root",
+			Value:       "/",
+			Usage:       "The folder where the required toolkit artifacts can be found",
 			Destination: &options.sourceRoot,
-			Sources:     cli.EnvVars("TOOLKIT_SOURCE_ROOT"),
-		},
-		&cli.StringFlag{
-			Name:        "toolkit-package-type",
-			Usage:       "specify the package type to use for the toolkit. One of ['deb', 'rpm', 'auto', '']. If 'auto' or '' are used, the type is inferred automatically.",
-			Value:       "auto",
-			Destination: &options.packageType,
-			Sources:     cli.EnvVars("TOOLKIT_PACKAGE_TYPE"),
+			EnvVars:     []string{"SOURCE_ROOT"},
 		},
 		&cli.StringFlag{
 			Name:        "pid-file",
 			Value:       defaultPidFile,
 			Usage:       "the path to a toolkit.pid file to ensure that only a single configuration instance is running",
 			Destination: &options.pidFile,
-			Sources:     cli.EnvVars("TOOLKIT_PID_FILE", "PID_FILE"),
+			EnvVars:     []string{"TOOLKIT_PID_FILE", "PID_FILE"},
 		},
 	}
 
 	c.Flags = append(c.Flags, toolkit.Flags(&options.toolkitOptions)...)
 	c.Flags = append(c.Flags, runtime.Flags(&options.runtimeOptions)...)
 
-	return &c
+	return c
 }
 
-func (a *app) Before(c *cli.Command, o *options) error {
-	if o.sourceRoot == "" {
-		sourceRoot, err := a.resolveSourceRoot(o.runtimeOptions.HostRootMount, o.packageType)
-		if err != nil {
-			return fmt.Errorf("failed to resolve source root: %v", err)
-		}
-		a.logger.Infof("Resolved source root to %v", sourceRoot)
-		o.sourceRoot = sourceRoot
-	}
-
+func (a *app) Before(c *cli.Context, o *options) error {
 	a.toolkit = toolkit.NewInstaller(
 		toolkit.WithLogger(a.logger),
 		toolkit.WithSourceRoot(o.sourceRoot),
@@ -171,7 +153,7 @@ func (a *app) Before(c *cli.Command, o *options) error {
 	return a.validateFlags(c, o)
 }
 
-func (a *app) validateFlags(c *cli.Command, o *options) error {
+func (a *app) validateFlags(c *cli.Context, o *options) error {
 	if o.toolkitInstallDir == "" {
 		return fmt.Errorf("the install root must be specified")
 	}
@@ -194,21 +176,21 @@ func (a *app) validateFlags(c *cli.Command, o *options) error {
 // Run installs the NVIDIA Container Toolkit and updates the requested runtime.
 // If the application is run as a daemon, the application waits and unconfigures
 // the runtime on termination.
-func (a *app) Run(c *cli.Command, o *options) error {
+func (a *app) Run(c *cli.Context, o *options) error {
 	err := a.initialize(o.pidFile)
 	if err != nil {
 		return fmt.Errorf("unable to initialize: %v", err)
 	}
 	defer a.shutdown(o.pidFile)
 
-	if len(o.toolkitOptions.ContainerRuntimeRuntimes) == 0 {
+	if len(o.toolkitOptions.ContainerRuntimeRuntimes.Value()) == 0 {
 		lowlevelRuntimePaths, err := runtime.GetLowlevelRuntimePaths(&o.runtimeOptions, o.runtime)
 		if err != nil {
 			return fmt.Errorf("unable to determine runtime options: %w", err)
 		}
 		lowlevelRuntimePaths = append(lowlevelRuntimePaths, defaultLowLevelRuntimes...)
 
-		o.toolkitOptions.ContainerRuntimeRuntimes = lowlevelRuntimePaths
+		o.toolkitOptions.ContainerRuntimeRuntimes = *cli.NewStringSlice(lowlevelRuntimePaths...)
 	}
 
 	err = a.toolkit.Install(c, &o.toolkitOptions)
@@ -295,35 +277,3 @@ func (a *app) shutdown(pidFile string) {
 		a.logger.Warningf("Unable to remove pidfile: %v", err)
 	}
 }
-
-func (a *app) resolveSourceRoot(hostRoot string, packageType string) (string, error) {
-	resolvedPackageType, err := a.resolvePackageType(hostRoot, packageType)
-	if err != nil {
-		return "", err
-	}
-	switch resolvedPackageType {
-	case "deb":
-		return "/artifacts/deb", nil
-	case "rpm":
-		return "/artifacts/rpm", nil
-	default:
-		return "", fmt.Errorf("invalid package type: %v", resolvedPackageType)
-	}
-}
-
-func (a *app) resolvePackageType(hostRoot string, packageType string) (rPackageTypes string, rerr error) {
-	if packageType != "" && packageType != "auto" {
-		return packageType, nil
-	}
-
-	locator := lookup.NewExecutableLocator(a.logger, hostRoot)
-	if candidates, err := locator.Locate("/usr/bin/rpm"); err == nil && len(candidates) > 0 {
-		return "rpm", nil
-	}
-
-	if candidates, err := locator.Locate("/usr/bin/dpkg"); err == nil && len(candidates) > 0 {
-		return "deb", nil
-	}
-
-	return "deb", nil
-}

cmd/nvidia-ctk-installer/main_test.go

@@ -17,7 +17,6 @@
 package main
 
 import (
-	"context"
 	"os"
 	"path/filepath"
 	"strings"
@@ -68,7 +67,7 @@ swarm-resource = ""
   debug = "/dev/null"
   log-level = "info"
   mode = "auto"
-  runtimes = ["runc", "crun"]
+  runtimes = ["docker-runc", "runc", "crun"]
 
   [nvidia-container-runtime.modes]
 
@@ -132,7 +131,7 @@ swarm-resource = ""
   debug = "/dev/null"
   log-level = "info"
   mode = "auto"
-  runtimes = ["runc", "crun"]
+  runtimes = ["docker-runc", "runc", "crun"]
 
   [nvidia-container-runtime.modes]
 
@@ -199,7 +198,7 @@ swarm-resource = ""
   debug = "/dev/null"
   log-level = "info"
   mode = "auto"
-  runtimes = ["runc", "crun"]
+  runtimes = ["docker-runc", "runc", "crun"]
 
   [nvidia-container-runtime.modes]
 
@@ -263,7 +262,7 @@ swarm-resource = ""
   debug = "/dev/null"
   log-level = "info"
   mode = "auto"
-  runtimes = ["runc", "crun"]
+  runtimes = ["docker-runc", "runc", "crun"]
 
   [nvidia-container-runtime.modes]
 
@@ -349,7 +348,7 @@ swarm-resource = ""
   debug = "/dev/null"
   log-level = "info"
   mode = "auto"
-  runtimes = ["runc", "crun"]
+  runtimes = ["docker-runc", "runc", "crun"]
 
   [nvidia-container-runtime.modes]
 
@@ -434,10 +433,10 @@ swarm-resource = ""
 				"--driver-root-ctr-path=" + hostRoot,
 				"--pid-file=" + filepath.Join(testRoot, "toolkit.pid"),
 				"--restart-mode=none",
-				"--toolkit-source-root=" + filepath.Join(artifactRoot, "deb"),
+				"--source-root=" + filepath.Join(artifactRoot, "deb"),
 			}
 
-			err := app.Run(context.Background(), append(testArgs, tc.args...))
+			err := app.Run(append(testArgs, tc.args...))
 
 			require.NoError(t, err)
 

cmd/nvidia-ctk-installer/toolkit/installer/directory.go

@@ -28,7 +28,7 @@ type createDirectory struct {
 	logger logger.Interface
 }
 
-func (t *ToolkitInstaller) createDirectory() Installer {
+func (t *toolkitInstaller) createDirectory() Installer {
 	return &createDirectory{
 		logger: t.logger,
 	}

cmd/nvidia-ctk-installer/toolkit/installer/executables.go

@@ -28,18 +28,20 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk-installer/container/operator"
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
 )
 
 type executable struct {
 	requiresKernelModule bool
 	path                 string
 	symlink              string
+	args                 []string
 	env                  map[string]string
 }
 
-func (t *ToolkitInstaller) collectExecutables(destDir string) ([]Installer, error) {
-	configFilePath := t.ConfigFilePath(destDir)
+func (t *toolkitInstaller) collectExecutables(destDir string) ([]Installer, error) {
+	configHome := filepath.Join(destDir, ".config")
+	configDir := filepath.Join(configHome, "nvidia-container-runtime")
+	configPath := filepath.Join(configDir, "config.toml")
 
 	executables := []executable{
 		{
@@ -54,7 +56,7 @@ func (t *ToolkitInstaller) collectExecutables(destDir string) ([]Installer, erro
 			path:                 runtime.Path,
 			requiresKernelModule: true,
 			env: map[string]string{
-				config.FilePathOverrideEnvVar: configFilePath,
+				"XDG_CONFIG_HOME": configHome,
 			},
 		}
 		executables = append(executables, e)
@@ -70,9 +72,7 @@ func (t *ToolkitInstaller) collectExecutables(destDir string) ([]Installer, erro
 		executable{
 			path:    "nvidia-container-runtime-hook",
 			symlink: "nvidia-container-toolkit",
-			env: map[string]string{
-				config.FilePathOverrideEnvVar: configFilePath,
-			},
+			args:    []string{fmt.Sprintf("-config %s", configPath)},
 		},
 	)
 
@@ -94,6 +94,7 @@ func (t *ToolkitInstaller) collectExecutables(destDir string) ([]Installer, erro
 			Source:            executablePath,
 			WrappedExecutable: dotRealFilename,
 			CheckModules:      executable.requiresKernelModule,
+			Args:              executable.args,
 			Envvars: map[string]string{
 				"PATH": strings.Join([]string{destDir, "$PATH"}, ":"),
 			},
@@ -123,6 +124,7 @@ type wrapper struct {
 	Envvars           map[string]string
 	WrappedExecutable string
 	CheckModules      bool
+	Args              []string
 }
 
 type render struct {
@@ -163,6 +165,9 @@ fi
 {{$key}}={{$value}} \
 {{- end }}
 	{{ .DestDir }}/{{ .WrappedExecutable }} \
+{{- range $arg := .Args }}
+		{{$arg}} \
+{{- end }}
 		"$@"
 `
 

cmd/nvidia-ctk-installer/toolkit/installer/executables_test.go

@@ -68,6 +68,19 @@ fi
 PATH=/foo/bar/baz \
 	/dest-dir/some-runtime \
 		"$@"
+`,
+		},
+		{
+			description: "args are added",
+			w: &wrapper{
+				WrappedExecutable: "some-runtime",
+				Args:              []string{"--config foo", "bar"},
+			},
+			expected: `#! /bin/sh
+	/dest-dir/some-runtime \
+		--config foo \
+		bar \
+		"$@"
 `,
 		},
 	}

cmd/nvidia-ctk-installer/toolkit/installer/installer.go

@@ -33,7 +33,7 @@ type Installer interface {
 	Install(string) error
 }
 
-type ToolkitInstaller struct {
+type toolkitInstaller struct {
 	logger       logger.Interface
 	ignoreErrors bool
 	sourceRoot   string
@@ -43,13 +43,11 @@ type ToolkitInstaller struct {
 	ensureTargetDirectory Installer
 }
 
-var _ Installer = (*ToolkitInstaller)(nil)
+var _ Installer = (*toolkitInstaller)(nil)
 
 // New creates a toolkit installer with the specified options.
-func New(opts ...Option) (*ToolkitInstaller, error) {
-	t := &ToolkitInstaller{
-		sourceRoot: "/",
-	}
+func New(opts ...Option) (Installer, error) {
+	t := &toolkitInstaller{}
 	for _, opt := range opts {
 		opt(t)
 	}
@@ -57,6 +55,9 @@ func New(opts ...Option) (*ToolkitInstaller, error) {
 	if t.logger == nil {
 		t.logger = logger.New()
 	}
+	if t.sourceRoot == "" {
+		t.sourceRoot = "/"
+	}
 	if t.artifactRoot == nil {
 		artifactRoot, err := newArtifactRoot(t.logger, t.sourceRoot)
 		if err != nil {
@@ -73,7 +74,7 @@ func New(opts ...Option) (*ToolkitInstaller, error) {
 }
 
 // Install ensures that the required toolkit files are installed in the specified directory.
-func (t *ToolkitInstaller) Install(destDir string) error {
+func (t *toolkitInstaller) Install(destDir string) error {
 	var installers []Installer
 
 	installers = append(installers, t.ensureTargetDirectory)
@@ -98,11 +99,6 @@ func (t *ToolkitInstaller) Install(destDir string) error {
 	return errs
 }
 
-func (t *ToolkitInstaller) ConfigFilePath(destDir string) string {
-	toolkitConfigDir := filepath.Join(destDir, ".config", "nvidia-container-runtime")
-	return filepath.Join(toolkitConfigDir, "config.toml")
-}
-
 type symlink struct {
 	linkname string
 	target   string

cmd/nvidia-ctk-installer/toolkit/installer/installer_test.go

@@ -112,7 +112,7 @@ func TestToolkitInstaller(t *testing.T) {
 			return nil
 		},
 	}
-	i := ToolkitInstaller{
+	i := toolkitInstaller{
 		logger:                logger,
 		artifactRoot:          r,
 		ensureTargetDirectory: createDirectory,
@@ -172,8 +172,8 @@ if [ "${?}" != "0" ]; then
 	echo "nvidia driver modules are not yet loaded, invoking runc directly"
 	exec runc "$@"
 fi
-NVIDIA_CTK_CONFIG_FILE_PATH=/foo/bar/baz/.config/nvidia-container-runtime/config.toml \
 PATH=/foo/bar/baz:$PATH \
+XDG_CONFIG_HOME=/foo/bar/baz/.config \
 	/foo/bar/baz/nvidia-container-runtime.real \
 		"$@"
 `,
@@ -187,8 +187,8 @@ if [ "${?}" != "0" ]; then
 	echo "nvidia driver modules are not yet loaded, invoking runc directly"
 	exec runc "$@"
 fi
-NVIDIA_CTK_CONFIG_FILE_PATH=/foo/bar/baz/.config/nvidia-container-runtime/config.toml \
 PATH=/foo/bar/baz:$PATH \
+XDG_CONFIG_HOME=/foo/bar/baz/.config \
 	/foo/bar/baz/nvidia-container-runtime.cdi.real \
 		"$@"
 `,
@@ -202,8 +202,8 @@ if [ "${?}" != "0" ]; then
 	echo "nvidia driver modules are not yet loaded, invoking runc directly"
 	exec runc "$@"
 fi
-NVIDIA_CTK_CONFIG_FILE_PATH=/foo/bar/baz/.config/nvidia-container-runtime/config.toml \
 PATH=/foo/bar/baz:$PATH \
+XDG_CONFIG_HOME=/foo/bar/baz/.config \
 	/foo/bar/baz/nvidia-container-runtime.legacy.real \
 		"$@"
 `,
@@ -240,9 +240,9 @@ PATH=/foo/bar/baz:$PATH \
 				path: "/foo/bar/baz/nvidia-container-runtime-hook",
 				mode: 0777,
 				wrapper: `#! /bin/sh
-NVIDIA_CTK_CONFIG_FILE_PATH=/foo/bar/baz/.config/nvidia-container-runtime/config.toml \
 PATH=/foo/bar/baz:$PATH \
 	/foo/bar/baz/nvidia-container-runtime-hook.real \
+		-config /foo/bar/baz/.config/nvidia-container-runtime/config.toml \
 		"$@"
 `,
 			},

cmd/nvidia-ctk-installer/toolkit/installer/libraries.go

@@ -28,7 +28,7 @@ import (
 // A predefined set of library candidates are considered, with the first one
 // resulting in success being installed to the toolkit folder. The install process
 // resolves the symlink for the library and copies the versioned library itself.
-func (t *ToolkitInstaller) collectLibraries() ([]Installer, error) {
+func (t *toolkitInstaller) collectLibraries() ([]Installer, error) {
 	requiredLibraries := []string{
 		"libnvidia-container.so.1",
 		"libnvidia-container-go.so.1",

cmd/nvidia-ctk-installer/toolkit/installer/options.go

@@ -19,29 +19,29 @@ package installer
 
 import "github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 
-type Option func(*ToolkitInstaller)
+type Option func(*toolkitInstaller)
 
 func WithLogger(logger logger.Interface) Option {
-	return func(ti *ToolkitInstaller) {
+	return func(ti *toolkitInstaller) {
 		ti.logger = logger
 	}
 }
 
 func WithArtifactRoot(artifactRoot *artifactRoot) Option {
-	return func(ti *ToolkitInstaller) {
+	return func(ti *toolkitInstaller) {
 		ti.artifactRoot = artifactRoot
 	}
 }
 
 func WithIgnoreErrors(ignoreErrors bool) Option {
-	return func(ti *ToolkitInstaller) {
+	return func(ti *toolkitInstaller) {
 		ti.ignoreErrors = ignoreErrors
 	}
 }
 
 // WithSourceRoot sets the root directory for locating artifacts to be installed.
 func WithSourceRoot(sourceRoot string) Option {
-	return func(ti *ToolkitInstaller) {
+	return func(ti *toolkitInstaller) {
 		ti.sourceRoot = sourceRoot
 	}
 }

cmd/nvidia-ctk-installer/toolkit/toolkit.go

@@ -22,7 +22,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 	"tags.cncf.io/container-device-interface/pkg/cdi"
 	"tags.cncf.io/container-device-interface/pkg/parser"
 
@@ -37,6 +37,8 @@ import (
 const (
 	// DefaultNvidiaDriverRoot specifies the default NVIDIA driver run directory
 	DefaultNvidiaDriverRoot = "/run/nvidia/driver"
+
+	configFilename = "config.toml"
 )
 
 type cdiOptions struct {
@@ -58,9 +60,9 @@ type Options struct {
 	ContainerRuntimeLogLevel string
 
 	ContainerRuntimeModesCdiDefaultKind        string
-	ContainerRuntimeModesCDIAnnotationPrefixes []string
+	ContainerRuntimeModesCDIAnnotationPrefixes cli.StringSlice
 
-	ContainerRuntimeRuntimes []string
+	ContainerRuntimeRuntimes cli.StringSlice
 
 	ContainerRuntimeHookSkipModeDetection bool
 
@@ -69,14 +71,14 @@ type Options struct {
 	// CDI stores the CDI options for the toolkit.
 	CDI cdiOptions
 
-	createDeviceNodes []string
+	createDeviceNodes cli.StringSlice
 
 	acceptNVIDIAVisibleDevicesWhenUnprivileged bool
 	acceptNVIDIAVisibleDevicesAsVolumeMounts   bool
 
 	ignoreErrors bool
 
-	optInFeatures []string
+	optInFeatures cli.StringSlice
 }
 
 func Flags(opts *Options) []cli.Flag {
@@ -86,106 +88,106 @@ func Flags(opts *Options) []cli.Flag {
 			Aliases:     []string{"nvidia-driver-root"},
 			Value:       DefaultNvidiaDriverRoot,
 			Destination: &opts.DriverRoot,
-			Sources:     cli.EnvVars("NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"),
+			EnvVars:     []string{"NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"},
 		},
 		&cli.StringFlag{
 			Name:        "driver-root-ctr-path",
 			Value:       DefaultNvidiaDriverRoot,
 			Destination: &opts.DriverRootCtrPath,
-			Sources:     cli.EnvVars("DRIVER_ROOT_CTR_PATH"),
+			EnvVars:     []string{"DRIVER_ROOT_CTR_PATH"},
 		},
 		&cli.StringFlag{
 			Name:        "dev-root",
 			Usage:       "Specify the root where `/dev` is located. If this is not specified, the driver-root is assumed.",
 			Destination: &opts.DevRoot,
-			Sources:     cli.EnvVars("NVIDIA_DEV_ROOT", "DEV_ROOT"),
+			EnvVars:     []string{"NVIDIA_DEV_ROOT", "DEV_ROOT"},
 		},
 		&cli.StringFlag{
 			Name:        "dev-root-ctr-path",
 			Usage:       "Specify the root where `/dev` is located in the container. If this is not specified, the driver-root-ctr-path is assumed.",
 			Destination: &opts.DevRootCtrPath,
-			Sources:     cli.EnvVars("DEV_ROOT_CTR_PATH"),
+			EnvVars:     []string{"DEV_ROOT_CTR_PATH"},
 		},
 		&cli.StringFlag{
 			Name:        "nvidia-container-runtime.debug",
 			Aliases:     []string{"nvidia-container-runtime-debug"},
 			Usage:       "Specify the location of the debug log file for the NVIDIA Container Runtime",
 			Destination: &opts.ContainerRuntimeDebug,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_DEBUG"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_DEBUG"},
 		},
 		&cli.StringFlag{
 			Name:        "nvidia-container-runtime.log-level",
 			Aliases:     []string{"nvidia-container-runtime-debug-log-level"},
 			Destination: &opts.ContainerRuntimeLogLevel,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_LOG_LEVEL"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_LOG_LEVEL"},
 		},
 		&cli.StringFlag{
 			Name:        "nvidia-container-runtime.mode",
 			Aliases:     []string{"nvidia-container-runtime-mode"},
 			Destination: &opts.ContainerRuntimeMode,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_MODE"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_MODE"},
 		},
 		&cli.StringFlag{
 			Name:        "nvidia-container-runtime.modes.cdi.default-kind",
 			Destination: &opts.ContainerRuntimeModesCdiDefaultKind,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_MODES_CDI_DEFAULT_KIND"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_MODES_CDI_DEFAULT_KIND"},
 		},
 		&cli.StringSliceFlag{
 			Name:        "nvidia-container-runtime.modes.cdi.annotation-prefixes",
 			Destination: &opts.ContainerRuntimeModesCDIAnnotationPrefixes,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_MODES_CDI_ANNOTATION_PREFIXES"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_MODES_CDI_ANNOTATION_PREFIXES"},
 		},
 		&cli.StringSliceFlag{
 			Name:        "nvidia-container-runtime.runtimes",
 			Destination: &opts.ContainerRuntimeRuntimes,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_RUNTIMES"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_RUNTIMES"},
 		},
 		&cli.BoolFlag{
 			Name:        "nvidia-container-runtime-hook.skip-mode-detection",
 			Value:       true,
 			Destination: &opts.ContainerRuntimeHookSkipModeDetection,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_RUNTIME_HOOK_SKIP_MODE_DETECTION"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_RUNTIME_HOOK_SKIP_MODE_DETECTION"},
 		},
 		&cli.StringFlag{
 			Name:        "nvidia-container-cli.debug",
 			Aliases:     []string{"nvidia-container-cli-debug"},
 			Usage:       "Specify the location of the debug log file for the NVIDIA Container CLI",
 			Destination: &opts.ContainerCLIDebug,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_CLI_DEBUG"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_CLI_DEBUG"},
 		},
 		&cli.BoolFlag{
 			Name:        "accept-nvidia-visible-devices-envvar-when-unprivileged",
 			Usage:       "Set the accept-nvidia-visible-devices-envvar-when-unprivileged config option",
 			Value:       true,
 			Destination: &opts.acceptNVIDIAVisibleDevicesWhenUnprivileged,
-			Sources:     cli.EnvVars("ACCEPT_NVIDIA_VISIBLE_DEVICES_ENVVAR_WHEN_UNPRIVILEGED"),
+			EnvVars:     []string{"ACCEPT_NVIDIA_VISIBLE_DEVICES_ENVVAR_WHEN_UNPRIVILEGED"},
 		},
 		&cli.BoolFlag{
 			Name:        "accept-nvidia-visible-devices-as-volume-mounts",
 			Usage:       "Set the accept-nvidia-visible-devices-as-volume-mounts config option",
 			Destination: &opts.acceptNVIDIAVisibleDevicesAsVolumeMounts,
-			Sources:     cli.EnvVars("ACCEPT_NVIDIA_VISIBLE_DEVICES_AS_VOLUME_MOUNTS"),
+			EnvVars:     []string{"ACCEPT_NVIDIA_VISIBLE_DEVICES_AS_VOLUME_MOUNTS"},
 		},
 		&cli.BoolFlag{
 			Name:        "cdi-enabled",
 			Aliases:     []string{"enable-cdi"},
 			Usage:       "enable the generation of a CDI specification",
 			Destination: &opts.CDI.Enabled,
-			Sources:     cli.EnvVars("CDI_ENABLED", "ENABLE_CDI"),
+			EnvVars:     []string{"CDI_ENABLED", "ENABLE_CDI"},
 		},
 		&cli.StringFlag{
 			Name:        "cdi-output-dir",
 			Usage:       "the directory where the CDI output files are to be written. If this is set to '', no CDI specification is generated.",
 			Value:       "/var/run/cdi",
 			Destination: &opts.CDI.outputDir,
-			Sources:     cli.EnvVars("CDI_OUTPUT_DIR"),
+			EnvVars:     []string{"CDI_OUTPUT_DIR"},
 		},
 		&cli.StringFlag{
 			Name:        "cdi-kind",
 			Usage:       "the vendor string to use for the generated CDI specification",
 			Value:       "management.nvidia.com/gpu",
 			Destination: &opts.CDI.kind,
-			Sources:     cli.EnvVars("CDI_KIND"),
+			EnvVars:     []string{"CDI_KIND"},
 		},
 		&cli.BoolFlag{
 			Name:        "ignore-errors",
@@ -196,15 +198,15 @@ func Flags(opts *Options) []cli.Flag {
 		&cli.StringSliceFlag{
 			Name:        "create-device-nodes",
 			Usage:       "(Only applicable with --cdi-enabled) specifies which device nodes should be created. If any one of the options is set to '' or 'none', no device nodes will be created.",
-			Value:       []string{"control"},
+			Value:       cli.NewStringSlice("control"),
 			Destination: &opts.createDeviceNodes,
-			Sources:     cli.EnvVars("CREATE_DEVICE_NODES"),
+			EnvVars:     []string{"CREATE_DEVICE_NODES"},
 		},
 		&cli.StringSliceFlag{
 			Name:        "opt-in-features",
 			Hidden:      true,
 			Destination: &opts.optInFeatures,
-			Sources:     cli.EnvVars("NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES"),
+			EnvVars:     []string{"NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES"},
 		},
 	}
 
@@ -213,8 +215,7 @@ func Flags(opts *Options) []cli.Flag {
 
 // An Installer is used to install the NVIDIA Container Toolkit from the toolkit container.
 type Installer struct {
-	logger logger.Interface
-
+	logger     logger.Interface
 	sourceRoot string
 	// toolkitRoot specifies the destination path at which the toolkit is installed.
 	toolkitRoot string
@@ -259,7 +260,7 @@ func (t *Installer) ValidateOptions(opts *Options) error {
 	}
 
 	isDisabled := false
-	for _, mode := range opts.createDeviceNodes {
+	for _, mode := range opts.createDeviceNodes.Value() {
 		if mode != "" && mode != "none" && mode != "control" {
 			return fmt.Errorf("invalid --create-device-nodes value: %v", mode)
 		}
@@ -273,7 +274,7 @@ func (t *Installer) ValidateOptions(opts *Options) error {
 		isDisabled = true
 	}
 	if isDisabled {
-		opts.createDeviceNodes = []string{}
+		opts.createDeviceNodes = *cli.NewStringSlice()
 	}
 
 	return nil
@@ -281,7 +282,7 @@ func (t *Installer) ValidateOptions(opts *Options) error {
 
 // Install installs the components of the NVIDIA container toolkit.
 // Any existing installation is removed.
-func (t *Installer) Install(cli *cli.Command, opts *Options) error {
+func (t *Installer) Install(cli *cli.Context, opts *Options) error {
 	if t == nil {
 		return fmt.Errorf("toolkit installer is not initilized")
 	}
@@ -314,7 +315,7 @@ func (t *Installer) Install(cli *cli.Command, opts *Options) error {
 		t.logger.Errorf("Ignoring error: %v", fmt.Errorf("could not install toolkit components: %w", err))
 	}
 
-	err = t.installToolkitConfig(cli, opts, toolkit.ConfigFilePath(t.toolkitRoot))
+	err = t.installToolkitConfig(cli, opts)
 	if err != nil && !opts.ignoreErrors {
 		return fmt.Errorf("error installing NVIDIA container toolkit config: %v", err)
 	} else if err != nil {
@@ -341,11 +342,13 @@ func (t *Installer) Install(cli *cli.Command, opts *Options) error {
 
 // installToolkitConfig installs the config file for the NVIDIA container toolkit ensuring
 // that the settings are updated to match the desired install and nvidia driver directories.
-func (t *Installer) installToolkitConfig(c *cli.Command, opts *Options, toolkitConfigPath string) error {
+func (t *Installer) installToolkitConfig(c *cli.Context, opts *Options) error {
+	toolkitConfigDir := filepath.Join(t.toolkitRoot, ".config", "nvidia-container-runtime")
+	toolkitConfigPath := filepath.Join(toolkitConfigDir, configFilename)
 
 	t.logger.Infof("Installing NVIDIA container toolkit config '%v'", toolkitConfigPath)
 
-	err := t.createDirectories(filepath.Dir(toolkitConfigPath))
+	err := t.createDirectories(toolkitConfigDir)
 	if err != nil && !opts.ignoreErrors {
 		return fmt.Errorf("could not create required directories: %v", err)
 	} else if err != nil {
@@ -387,12 +390,12 @@ func (t *Installer) installToolkitConfig(c *cli.Command, opts *Options, toolkitC
 		"nvidia-container-runtime-hook.skip-mode-detection": opts.ContainerRuntimeHookSkipModeDetection,
 	}
 
-	toolkitRuntimeList := opts.ContainerRuntimeRuntimes
+	toolkitRuntimeList := opts.ContainerRuntimeRuntimes.Value()
 	if len(toolkitRuntimeList) > 0 {
 		configValues["nvidia-container-runtime.runtimes"] = toolkitRuntimeList
 	}
 
-	for _, optInFeature := range opts.optInFeatures {
+	for _, optInFeature := range opts.optInFeatures.Value() {
 		configValues["features."+optInFeature] = true
 	}
 
@@ -462,7 +465,7 @@ func (t *Installer) createDirectories(dir ...string) error {
 }
 
 func (t *Installer) createDeviceNodes(opts *Options) error {
-	modes := opts.createDeviceNodes
+	modes := opts.createDeviceNodes.Value()
 	if len(modes) == 0 {
 		return nil
 	}

cmd/nvidia-ctk-installer/toolkit/toolkit_test.go

@@ -25,7 +25,7 @@ import (
 
 	testlog "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/require"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup/symlinks"
@@ -86,7 +86,6 @@ devices:
               hostPath: /host/driver/root/dev/nvidia-caps-imex-channels/channel2047
 containerEdits:
     env:
-        - NVIDIA_CTK_LIBCUDA_DIR=/lib/x86_64-linux-gnu
         - NVIDIA_VISIBLE_DEVICES=void
     hooks:
         - hookName: createContainer
@@ -98,15 +97,6 @@ containerEdits:
             - libcuda.so.1::/lib/x86_64-linux-gnu/libcuda.so
           env:
             - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: {{ .toolkitRoot }}/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - create-soname-symlinks
-            - --folder
-            - /lib/x86_64-linux-gnu
-          env:
-            - NVIDIA_CTK_DEBUG=false
         - hookName: createContainer
           path: {{ .toolkitRoot }}/nvidia-cdi-hook
           args:
@@ -153,7 +143,7 @@ containerEdits:
 			)
 			require.NoError(t, ti.ValidateOptions(&options))
 
-			err := ti.Install(&cli.Command{}, &options)
+			err := ti.Install(&cli.Context{}, &options)
 			if tc.expectedError == nil {
 				require.NoError(t, err)
 			} else {

cmd/nvidia-ctk/cdi/cdi.go

@@ -17,7 +17,7 @@
 package cdi
 
 import (
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi/generate"
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi/list"
@@ -45,7 +45,7 @@ func (m command) build() *cli.Command {
 		Usage: "Provide tools for interacting with Container Device Interface specifications",
 	}
 
-	hook.Commands = []*cli.Command{
+	hook.Subcommands = []*cli.Command{
 		generate.NewCommand(m.logger),
 		transform.NewCommand(m.logger),
 		list.NewCommand(m.logger),

cmd/nvidia-ctk/cdi/generate/generate.go

@@ -17,13 +17,12 @@
 package generate
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 	cdi "tags.cncf.io/container-device-interface/pkg/parser"
 
 	"github.com/NVIDIA/go-nvml/pkg/nvml"
@@ -47,7 +46,7 @@ type command struct {
 type options struct {
 	output               string
 	format               string
-	deviceNameStrategies []string
+	deviceNameStrategies cli.StringSlice
 	driverRoot           string
 	devRoot              string
 	nvidiaCDIHookPath    string
@@ -56,15 +55,12 @@ type options struct {
 	vendor               string
 	class                string
 
-	configSearchPaths  []string
-	librarySearchPaths []string
-	disabledHooks      []string
-
-	config string
+	configSearchPaths  cli.StringSlice
+	librarySearchPaths cli.StringSlice
 
 	csv struct {
-		files          []string
-		ignorePatterns []string
+		files          cli.StringSlice
+		ignorePatterns cli.StringSlice
 	}
 
 	// the following are used for dependency injection during spec generation.
@@ -83,73 +79,34 @@ func NewCommand(logger logger.Interface) *cli.Command {
 func (m command) build() *cli.Command {
 	opts := options{}
 
-	var flags []cli.Flag
-
 	// Create the 'generate-cdi' command
 	c := cli.Command{
 		Name:  "generate",
 		Usage: "Generate CDI specifications for use with CDI-enabled runtimes",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			// First, determine the config file path
-			var configFilePath string
-			if cmd.IsSet("config") {
-				configFilePath = cmd.String("config")
-			} else {
-				configFilePath = config.GetConfigFilePath()
-			}
-
-			// Load the config file
-			configToml, err := config.New(
-				config.WithConfigFile(configFilePath),
-			)
-			if err != nil {
-				return nil, err
-			}
-
-			// Get the typed config
-			cfg, err := configToml.Config()
-			if err != nil {
-				return nil, err
-			}
-
-			// Apply config defaults to flags that haven't been set via env vars or CLI
-			// we can't use urfave/cli-altsrc here because we need to check the config file
-			// for defaults, and we can't use the config file as an input source for the
-			// flags because the config file is not yet loaded.
-			m.applyConfigDefaults(cmd, &opts, cfg)
-
-			return ctx, m.validateFlags(cmd, &opts)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &opts)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &opts)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &opts)
 		},
 	}
 
-	flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:        "config",
-			Usage:       "Specify the path to the config file to use",
-			Destination: &opts.config,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CONFIG_FILE"),
-		},
+	c.Flags = []cli.Flag{
 		&cli.StringSliceFlag{
 			Name:        "config-search-path",
 			Usage:       "Specify the path to search for config files when discovering the entities that should be included in the CDI specification.",
 			Destination: &opts.configSearchPaths,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_CONFIG_SEARCH_PATHS"),
 		},
 		&cli.StringFlag{
 			Name:        "output",
 			Usage:       "Specify the file to output the generated CDI specification to. If this is '' the specification is output to STDOUT",
 			Destination: &opts.output,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_OUTPUT_FILE_PATH"),
 		},
 		&cli.StringFlag{
 			Name:        "format",
 			Usage:       "The output format for the generated spec [json | yaml]. This overrides the format defined by the output file extension (if specified).",
 			Value:       spec.FormatYAML,
 			Destination: &opts.format,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_OUTPUT_FORMAT"),
 		},
 		&cli.StringFlag{
 			Name:    "mode",
@@ -159,32 +116,27 @@ func (m command) build() *cli.Command {
 				"If mode is set to 'auto' the mode will be determined based on the system configuration.",
 			Value:       string(nvcdi.ModeAuto),
 			Destination: &opts.mode,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_MODE"),
 		},
 		&cli.StringFlag{
 			Name:        "dev-root",
 			Usage:       "Specify the root where `/dev` is located. If this is not specified, the driver-root is assumed.",
 			Destination: &opts.devRoot,
-			Sources:     cli.EnvVars("NVIDIA_CTK_DEV_ROOT"),
 		},
 		&cli.StringSliceFlag{
 			Name:        "device-name-strategy",
 			Usage:       "Specify the strategy for generating device names. If this is specified multiple times, the devices will be duplicated for each strategy. One of [index | uuid | type-index]",
-			Value:       []string{nvcdi.DeviceNameStrategyIndex, nvcdi.DeviceNameStrategyUUID},
+			Value:       cli.NewStringSlice(nvcdi.DeviceNameStrategyIndex, nvcdi.DeviceNameStrategyUUID),
 			Destination: &opts.deviceNameStrategies,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_DEVICE_NAME_STRATEGIES"),
 		},
 		&cli.StringFlag{
 			Name:        "driver-root",
 			Usage:       "Specify the NVIDIA GPU driver root to use when discovering the entities that should be included in the CDI specification.",
 			Destination: &opts.driverRoot,
-			Sources:     cli.EnvVars("NVIDIA_CTK_DRIVER_ROOT"),
 		},
 		&cli.StringSliceFlag{
 			Name:        "library-search-path",
 			Usage:       "Specify the path to search for libraries when discovering the entities that should be included in the CDI specification.\n\tNote: This option only applies to CSV mode.",
 			Destination: &opts.librarySearchPaths,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_LIBRARY_SEARCH_PATHS"),
 		},
 		&cli.StringFlag{
 			Name:    "nvidia-cdi-hook-path",
@@ -193,13 +145,11 @@ func (m command) build() *cli.Command {
 				"If not specified, the PATH will be searched for `nvidia-cdi-hook`. " +
 				"NOTE: That if this is specified as `nvidia-ctk`, the PATH will be searched for `nvidia-ctk` instead.",
 			Destination: &opts.nvidiaCDIHookPath,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_HOOK_PATH"),
 		},
 		&cli.StringFlag{
 			Name:        "ldconfig-path",
 			Usage:       "Specify the path to use for ldconfig in the generated CDI specification",
 			Destination: &opts.ldconfigPath,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_LDCONFIG_PATH"),
 		},
 		&cli.StringFlag{
 			Name:        "vendor",
@@ -207,7 +157,6 @@ func (m command) build() *cli.Command {
 			Usage:       "the vendor string to use for the generated CDI specification.",
 			Value:       "nvidia.com",
 			Destination: &opts.vendor,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_VENDOR"),
 		},
 		&cli.StringFlag{
 			Name:        "class",
@@ -215,61 +164,24 @@ func (m command) build() *cli.Command {
 			Usage:       "the class string to use for the generated CDI specification.",
 			Value:       "gpu",
 			Destination: &opts.class,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_CLASS"),
 		},
 		&cli.StringSliceFlag{
 			Name:        "csv.file",
 			Usage:       "The path to the list of CSV files to use when generating the CDI specification in CSV mode.",
-			Value:       csv.DefaultFileList(),
+			Value:       cli.NewStringSlice(csv.DefaultFileList()...),
 			Destination: &opts.csv.files,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_CSV_FILES"),
 		},
 		&cli.StringSliceFlag{
 			Name:        "csv.ignore-pattern",
-			Usage:       "specify a pattern the CSV mount specifications.",
+			Usage:       "Specify a pattern the CSV mount specifications.",
 			Destination: &opts.csv.ignorePatterns,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_CSV_IGNORE_PATTERNS"),
-		},
-		&cli.StringSliceFlag{
-			Name:    "disable-hook",
-			Aliases: []string{"disable-hooks"},
-			Usage: "specify a specific hook to skip when generating CDI " +
-				"specifications. This can be specified multiple times and the " +
-				"special hook name 'all' can be used ensure that the generated " +
-				"CDI specification does not include any hooks.",
-			Destination: &opts.disabledHooks,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_DISABLED_HOOKS"),
 		},
 	}
 
-	c.Flags = flags
-
 	return &c
 }
 
-// applyConfigDefaults applies default values from the config file to flags that haven't been set
-// via environment variables or CLI flags
-func (m command) applyConfigDefaults(cmd *cli.Command, opts *options, cfg *config.Config) {
-	// Apply mode from config if not set via env var or CLI
-	if !cmd.IsSet("mode") && cfg.NVIDIAContainerRuntimeConfig.Mode != "" {
-		opts.mode = cfg.NVIDIAContainerRuntimeConfig.Mode
-		m.logger.Debugf("Setting mode from config: %s", opts.mode)
-	}
-
-	// Apply ldconfig path from config if not set via env var or CLI
-	if !cmd.IsSet("ldconfig-path") && cfg.NVIDIAContainerCLIConfig.Ldconfig != "" {
-		opts.ldconfigPath = string(cfg.NVIDIAContainerCLIConfig.Ldconfig)
-		m.logger.Debugf("Setting ldconfig-path from config: %s", opts.ldconfigPath)
-	}
-
-	// Apply driver-root
-	if !cmd.IsSet("driver-root") && cfg.NVIDIAContainerCLIConfig.Root != "" {
-		opts.driverRoot = cfg.NVIDIAContainerCLIConfig.Root
-		m.logger.Debugf("Setting driver-root from config: %s", opts.driverRoot)
-	}
-}
-
-func (m command) validateFlags(c *cli.Command, opts *options) error {
+func (m command) validateFlags(c *cli.Context, opts *options) error {
 	opts.format = strings.ToLower(opts.format)
 	switch opts.format {
 	case spec.FormatJSON:
@@ -283,7 +195,7 @@ func (m command) validateFlags(c *cli.Command, opts *options) error {
 		return fmt.Errorf("invalid discovery mode: %v", opts.mode)
 	}
 
-	for _, strategy := range opts.deviceNameStrategies {
+	for _, strategy := range opts.deviceNameStrategies.Value() {
 		_, err := nvcdi.NewDeviceNamer(strategy)
 		if err != nil {
 			return err
@@ -310,7 +222,7 @@ func (m command) validateFlags(c *cli.Command, opts *options) error {
 	return nil
 }
 
-func (m command) run(c *cli.Command, opts *options) error {
+func (m command) run(c *cli.Context, opts *options) error {
 	spec, err := m.generateSpec(opts)
 	if err != nil {
 		return fmt.Errorf("failed to generate CDI spec: %v", err)
@@ -342,7 +254,7 @@ func formatFromFilename(filename string) string {
 
 func (m command) generateSpec(opts *options) (spec.Interface, error) {
 	var deviceNamers []nvcdi.DeviceNamer
-	for _, strategy := range opts.deviceNameStrategies {
+	for _, strategy := range opts.deviceNameStrategies.Value() {
 		deviceNamer, err := nvcdi.NewDeviceNamer(strategy)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create device namer: %v", err)
@@ -350,7 +262,7 @@ func (m command) generateSpec(opts *options) (spec.Interface, error) {
 		deviceNamers = append(deviceNamers, deviceNamer)
 	}
 
-	cdiOptions := []nvcdi.Option{
+	cdilib, err := nvcdi.New(
 		nvcdi.WithLogger(m.logger),
 		nvcdi.WithDriverRoot(opts.driverRoot),
 		nvcdi.WithDevRoot(opts.devRoot),
@@ -358,19 +270,13 @@ func (m command) generateSpec(opts *options) (spec.Interface, error) {
 		nvcdi.WithLdconfigPath(opts.ldconfigPath),
 		nvcdi.WithDeviceNamers(deviceNamers...),
 		nvcdi.WithMode(opts.mode),
-		nvcdi.WithConfigSearchPaths(opts.configSearchPaths),
-		nvcdi.WithLibrarySearchPaths(opts.librarySearchPaths),
-		nvcdi.WithCSVFiles(opts.csv.files),
-		nvcdi.WithCSVIgnorePatterns(opts.csv.ignorePatterns),
+		nvcdi.WithConfigSearchPaths(opts.configSearchPaths.Value()),
+		nvcdi.WithLibrarySearchPaths(opts.librarySearchPaths.Value()),
+		nvcdi.WithCSVFiles(opts.csv.files.Value()),
+		nvcdi.WithCSVIgnorePatterns(opts.csv.ignorePatterns.Value()),
 		// We set the following to allow for dependency injection:
 		nvcdi.WithNvmlLib(opts.nvmllib),
-	}
-
-	for _, hook := range opts.disabledHooks {
-		cdiOptions = append(cdiOptions, nvcdi.WithDisabledHook(hook))
-	}
-
-	cdilib, err := nvcdi.New(cdiOptions...)
+	)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create CDI library: %v", err)
 	}

cmd/nvidia-ctk/cdi/generate/generate_test.go

@@ -79,7 +79,6 @@ devices:
               hostPath: {{ .driverRoot }}/dev/nvidia0
 containerEdits:
     env:
-        - NVIDIA_CTK_LIBCUDA_DIR=/lib/x86_64-linux-gnu
         - NVIDIA_VISIBLE_DEVICES=void
     deviceNodes:
         - path: /dev/nvidiactl
@@ -102,15 +101,6 @@ containerEdits:
             - --host-driver-version=999.88.77
           env:
             - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - create-soname-symlinks
-            - --folder
-            - /lib/x86_64-linux-gnu
-          env:
-            - NVIDIA_CTK_DEBUG=false
         - hookName: createContainer
           path: /usr/bin/nvidia-cdi-hook
           args:
@@ -120,227 +110,6 @@ containerEdits:
             - /lib/x86_64-linux-gnu
           env:
             - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - disable-device-node-modification
-          env:
-            - NVIDIA_CTK_DEBUG=false
-    mounts:
-        - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          containerPath: /lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          options:
-            - ro
-            - nosuid
-            - nodev
-            - rbind
-            - rprivate
-`,
-		},
-		{
-			description: "disableHooks1",
-			options: options{
-				format:        "yaml",
-				mode:          "nvml",
-				vendor:        "example.com",
-				class:         "device",
-				driverRoot:    driverRoot,
-				disabledHooks: []string{"enable-cuda-compat"},
-			},
-			expectedOptions: options{
-				format:            "yaml",
-				mode:              "nvml",
-				vendor:            "example.com",
-				class:             "device",
-				nvidiaCDIHookPath: "/usr/bin/nvidia-cdi-hook",
-				driverRoot:        driverRoot,
-				disabledHooks:     []string{"enable-cuda-compat"},
-			},
-			expectedSpec: `---
-cdiVersion: 0.5.0
-kind: example.com/device
-devices:
-    - name: "0"
-      containerEdits:
-        deviceNodes:
-            - path: /dev/nvidia0
-              hostPath: {{ .driverRoot }}/dev/nvidia0
-    - name: all
-      containerEdits:
-        deviceNodes:
-            - path: /dev/nvidia0
-              hostPath: {{ .driverRoot }}/dev/nvidia0
-containerEdits:
-    env:
-        - NVIDIA_CTK_LIBCUDA_DIR=/lib/x86_64-linux-gnu
-        - NVIDIA_VISIBLE_DEVICES=void
-    deviceNodes:
-        - path: /dev/nvidiactl
-          hostPath: {{ .driverRoot }}/dev/nvidiactl
-    hooks:
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - create-symlinks
-            - --link
-            - libcuda.so.1::/lib/x86_64-linux-gnu/libcuda.so
-          env:
-            - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - create-soname-symlinks
-            - --folder
-            - /lib/x86_64-linux-gnu
-          env:
-            - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - update-ldcache
-            - --folder
-            - /lib/x86_64-linux-gnu
-          env:
-            - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - disable-device-node-modification
-          env:
-            - NVIDIA_CTK_DEBUG=false
-    mounts:
-        - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          containerPath: /lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          options:
-            - ro
-            - nosuid
-            - nodev
-            - rbind
-            - rprivate
-`,
-		},
-		{
-			description: "disableHooks2",
-			options: options{
-				format:        "yaml",
-				mode:          "nvml",
-				vendor:        "example.com",
-				class:         "device",
-				driverRoot:    driverRoot,
-				disabledHooks: []string{"enable-cuda-compat", "update-ldcache"},
-			},
-			expectedOptions: options{
-				format:            "yaml",
-				mode:              "nvml",
-				vendor:            "example.com",
-				class:             "device",
-				nvidiaCDIHookPath: "/usr/bin/nvidia-cdi-hook",
-				driverRoot:        driverRoot,
-				disabledHooks:     []string{"enable-cuda-compat", "update-ldcache"},
-			},
-			expectedSpec: `---
-cdiVersion: 0.5.0
-kind: example.com/device
-devices:
-    - name: "0"
-      containerEdits:
-        deviceNodes:
-            - path: /dev/nvidia0
-              hostPath: {{ .driverRoot }}/dev/nvidia0
-    - name: all
-      containerEdits:
-        deviceNodes:
-            - path: /dev/nvidia0
-              hostPath: {{ .driverRoot }}/dev/nvidia0
-containerEdits:
-    env:
-        - NVIDIA_CTK_LIBCUDA_DIR=/lib/x86_64-linux-gnu
-        - NVIDIA_VISIBLE_DEVICES=void
-    deviceNodes:
-        - path: /dev/nvidiactl
-          hostPath: {{ .driverRoot }}/dev/nvidiactl
-    hooks:
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - create-symlinks
-            - --link
-            - libcuda.so.1::/lib/x86_64-linux-gnu/libcuda.so
-          env:
-            - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - create-soname-symlinks
-            - --folder
-            - /lib/x86_64-linux-gnu
-          env:
-            - NVIDIA_CTK_DEBUG=false
-        - hookName: createContainer
-          path: /usr/bin/nvidia-cdi-hook
-          args:
-            - nvidia-cdi-hook
-            - disable-device-node-modification
-          env:
-            - NVIDIA_CTK_DEBUG=false
-    mounts:
-        - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          containerPath: /lib/x86_64-linux-gnu/libcuda.so.999.88.77
-          options:
-            - ro
-            - nosuid
-            - nodev
-            - rbind
-            - rprivate
-`,
-		},
-		{
-			description: "disableHooksAll",
-			options: options{
-				format:        "yaml",
-				mode:          "nvml",
-				vendor:        "example.com",
-				class:         "device",
-				driverRoot:    driverRoot,
-				disabledHooks: []string{"all"},
-			},
-			expectedOptions: options{
-				format:            "yaml",
-				mode:              "nvml",
-				vendor:            "example.com",
-				class:             "device",
-				nvidiaCDIHookPath: "/usr/bin/nvidia-cdi-hook",
-				driverRoot:        driverRoot,
-				disabledHooks:     []string{"all"},
-			},
-			expectedSpec: `---
-cdiVersion: 0.5.0
-kind: example.com/device
-devices:
-    - name: "0"
-      containerEdits:
-        deviceNodes:
-            - path: /dev/nvidia0
-              hostPath: {{ .driverRoot }}/dev/nvidia0
-    - name: all
-      containerEdits:
-        deviceNodes:
-            - path: /dev/nvidia0
-              hostPath: {{ .driverRoot }}/dev/nvidia0
-containerEdits:
-    env:
-        - NVIDIA_CTK_LIBCUDA_DIR=/lib/x86_64-linux-gnu
-        - NVIDIA_VISIBLE_DEVICES=void
-    deviceNodes:
-        - path: /dev/nvidiactl
-          hostPath: {{ .driverRoot }}/dev/nvidiactl
     mounts:
         - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/libcuda.so.999.88.77
           containerPath: /lib/x86_64-linux-gnu/libcuda.so.999.88.77

cmd/nvidia-ctk/cdi/list/list.go

@@ -17,11 +17,10 @@
 package list
 
 import (
-	"context"
 	"errors"
 	"fmt"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 	"tags.cncf.io/container-device-interface/pkg/cdi"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
@@ -32,7 +31,7 @@ type command struct {
 }
 
 type config struct {
-	cdiSpecDirs []string
+	cdiSpecDirs cli.StringSlice
 }
 
 // NewCommand constructs a cdi list command with the specified logger
@@ -51,11 +50,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "list",
 		Usage: "List the available CDI devices",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &cfg)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &cfg)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &cfg)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &cfg)
 		},
 	}
 
@@ -63,26 +62,25 @@ func (m command) build() *cli.Command {
 		&cli.StringSliceFlag{
 			Name:        "spec-dir",
 			Usage:       "specify the directories to scan for CDI specifications",
-			Value:       cdi.DefaultSpecDirs,
+			Value:       cli.NewStringSlice(cdi.DefaultSpecDirs...),
 			Destination: &cfg.cdiSpecDirs,
-			Sources:     cli.EnvVars("NVIDIA_CTK_CDI_SPEC_DIRS"),
 		},
 	}
 
 	return &c
 }
 
-func (m command) validateFlags(c *cli.Command, cfg *config) error {
-	if len(cfg.cdiSpecDirs) == 0 {
+func (m command) validateFlags(c *cli.Context, cfg *config) error {
+	if len(cfg.cdiSpecDirs.Value()) == 0 {
 		return errors.New("at least one CDI specification directory must be specified")
 	}
 	return nil
 }
 
-func (m command) run(c *cli.Command, cfg *config) error {
+func (m command) run(c *cli.Context, cfg *config) error {
 	registry, err := cdi.NewCache(
 		cdi.WithAutoRefresh(false),
-		cdi.WithSpecDirs(cfg.cdiSpecDirs...),
+		cdi.WithSpecDirs(cfg.cdiSpecDirs.Value()...),
 	)
 	if err != nil {
 		return fmt.Errorf("failed to create CDI cache: %v", err)

cmd/nvidia-ctk/cdi/transform/root/root.go

@@ -17,12 +17,11 @@
 package root
 
 import (
-	"context"
 	"fmt"
 	"io"
 	"os"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 	"tags.cncf.io/container-device-interface/pkg/cdi"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
@@ -61,11 +60,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "root",
 		Usage: "Apply a root transform to a CDI specification",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &opts)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &opts)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &opts)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &opts)
 		},
 	}
 
@@ -103,7 +102,7 @@ func (m command) build() *cli.Command {
 	return &c
 }
 
-func (m command) validateFlags(c *cli.Command, opts *options) error {
+func (m command) validateFlags(c *cli.Context, opts *options) error {
 	switch opts.relativeTo {
 	case "host":
 	case "container":
@@ -113,7 +112,7 @@ func (m command) validateFlags(c *cli.Command, opts *options) error {
 	return nil
 }
 
-func (m command) run(c *cli.Command, opts *options) error {
+func (m command) run(c *cli.Context, opts *options) error {
 	spec, err := opts.Load()
 	if err != nil {
 		return fmt.Errorf("failed to load CDI specification: %w", err)

cmd/nvidia-ctk/cdi/transform/transform.go

@@ -17,7 +17,7 @@
 package transform
 
 import (
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/cdi/transform/root"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
@@ -44,7 +44,7 @@ func (m command) build() *cli.Command {
 
 	c.Flags = []cli.Flag{}
 
-	c.Commands = []*cli.Command{
+	c.Subcommands = []*cli.Command{
 		root.NewCommand(m.logger),
 	}
 

cmd/nvidia-ctk/config/config.go

@@ -17,14 +17,13 @@
 package config
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"reflect"
 	"strconv"
 	"strings"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	createdefault "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/config/create-default"
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/config/flags"
@@ -40,7 +39,7 @@ type command struct {
 type options struct {
 	flags.Options
 	setListSeparator string
-	sets             []string
+	sets             cli.StringSlice
 }
 
 // NewCommand constructs an config command with the specified logger
@@ -59,11 +58,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "config",
 		Usage: "Interact with the NVIDIA Container Toolkit configuration",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, validateFlags(cmd, &opts)
+		Before: func(ctx *cli.Context) error {
+			return validateFlags(ctx, &opts)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return run(cmd, &opts)
+		Action: func(ctx *cli.Context) error {
+			return run(ctx, &opts)
 		},
 	}
 
@@ -105,21 +104,21 @@ func (m command) build() *cli.Command {
 		},
 	}
 
-	c.Commands = []*cli.Command{
+	c.Subcommands = []*cli.Command{
 		createdefault.NewCommand(m.logger),
 	}
 
 	return &c
 }
 
-func validateFlags(c *cli.Command, opts *options) error {
+func validateFlags(c *cli.Context, opts *options) error {
 	if opts.setListSeparator == "" {
 		return fmt.Errorf("set-list-separator must be set")
 	}
 	return nil
 }
 
-func run(c *cli.Command, opts *options) error {
+func run(c *cli.Context, opts *options) error {
 	cfgToml, err := config.New(
 		config.WithConfigFile(opts.Config),
 	)
@@ -127,7 +126,7 @@ func run(c *cli.Command, opts *options) error {
 		return fmt.Errorf("unable to create config: %v", err)
 	}
 
-	for _, set := range opts.sets {
+	for _, set := range opts.sets.Value() {
 		key, value, err := setFlagToKeyValue(set, opts.setListSeparator)
 		if err != nil {
 			return fmt.Errorf("invalid --set option %v: %w", set, err)

cmd/nvidia-ctk/config/create-default/create-default.go

@@ -17,10 +17,9 @@
 package defaultsubcommand
 
 import (
-	"context"
 	"fmt"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/config/flags"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config"
@@ -48,11 +47,11 @@ func (m command) build() *cli.Command {
 		Name:    "default",
 		Aliases: []string{"create-default", "generate-default"},
 		Usage:   "Generate the default NVIDIA Container Toolkit configuration file",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &opts)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &opts)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &opts)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &opts)
 		},
 	}
 
@@ -68,11 +67,11 @@ func (m command) build() *cli.Command {
 	return &c
 }
 
-func (m command) validateFlags(c *cli.Command, opts *flags.Options) error {
+func (m command) validateFlags(c *cli.Context, opts *flags.Options) error {
 	return opts.Validate()
 }
 
-func (m command) run(c *cli.Command, opts *flags.Options) error {
+func (m command) run(c *cli.Context, opts *flags.Options) error {
 	cfgToml, err := config.New()
 	if err != nil {
 		return fmt.Errorf("unable to load or create config: %v", err)

cmd/nvidia-ctk/hook/hook.go

@@ -17,12 +17,10 @@
 package hook
 
 import (
-	"context"
-
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-cdi-hook/commands"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )
 
 type hookCommand struct {
@@ -50,13 +48,13 @@ func (m hookCommand) build() *cli.Command {
 		// referring to a new hook that is not yet supported by an older NVIDIA
 		// Container Toolkit version or a hook that has been removed in newer
 		// version.
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			commands.IssueUnsupportedHookWarning(m.logger, cmd)
+		Action: func(ctx *cli.Context) error {
+			commands.IssueUnsupportedHookWarning(m.logger, ctx)
 			return nil
 		},
 	}
 
-	hook.Commands = commands.New(m.logger)
+	hook.Subcommands = commands.New(m.logger)
 
 	return &hook
 }

cmd/nvidia-ctk/info/info.go

@@ -17,7 +17,7 @@
 package info
 
 import (
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 )
@@ -42,7 +42,7 @@ func (m command) build() *cli.Command {
 		Usage: "Provide information about the system",
 	}
 
-	info.Commands = []*cli.Command{}
+	info.Subcommands = []*cli.Command{}
 
 	return &info
 }

cmd/nvidia-ctk/main.go

@@ -17,7 +17,6 @@
 package main
 
 import (
-	"context"
 	"os"
 
 	"github.com/sirupsen/logrus"
@@ -30,7 +29,7 @@ import (
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/system"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/info"
 
-	cli "github.com/urfave/cli/v3"
+	cli "github.com/urfave/cli/v2"
 )
 
 // options defines the options that can be set for the CLI through config files,
@@ -49,11 +48,11 @@ func main() {
 	opts := options{}
 
 	// Create the top-level CLI
-	c := cli.Command{}
+	c := cli.NewApp()
 	c.DisableSliceFlagSeparator = true
 	c.Name = "NVIDIA Container Toolkit CLI"
 	c.UseShortOptionHandling = true
-	c.EnableShellCompletion = true
+	c.EnableBashCompletion = true
 	c.Usage = "Tools to configure the NVIDIA Container Toolkit"
 	c.Version = info.GetVersionString()
 
@@ -64,18 +63,18 @@ func main() {
 			Aliases:     []string{"d"},
 			Usage:       "Enable debug-level logging",
 			Destination: &opts.Debug,
-			Sources:     cli.EnvVars("NVIDIA_CTK_DEBUG"),
+			EnvVars:     []string{"NVIDIA_CTK_DEBUG"},
 		},
 		&cli.BoolFlag{
 			Name:        "quiet",
 			Usage:       "Suppress all output except for errors; overrides --debug",
 			Destination: &opts.Quiet,
-			Sources:     cli.EnvVars("NVIDIA_CTK_QUIET"),
+			EnvVars:     []string{"NVIDIA_CTK_QUIET"},
 		},
 	}
 
 	// Set log-level for all subcommands
-	c.Before = func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
+	c.Before = func(c *cli.Context) error {
 		logLevel := logrus.InfoLevel
 		if opts.Debug {
 			logLevel = logrus.DebugLevel
@@ -84,7 +83,7 @@ func main() {
 			logLevel = logrus.ErrorLevel
 		}
 		logger.SetLevel(logLevel)
-		return ctx, nil
+		return nil
 	}
 
 	// Define the subcommands
@@ -98,7 +97,7 @@ func main() {
 	}
 
 	// Run the CLI
-	err := c.Run(context.Background(), os.Args)
+	err := c.Run(os.Args)
 	if err != nil {
 		logger.Errorf("%v", err)
 		os.Exit(1)

cmd/nvidia-ctk/runtime/configure/configure.go

@@ -17,11 +17,10 @@
 package configure
 
 import (
-	"context"
 	"fmt"
 	"path/filepath"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 	"github.com/NVIDIA/nvidia-container-toolkit/pkg/config/engine"
@@ -95,11 +94,11 @@ func (m command) build() *cli.Command {
 	configure := cli.Command{
 		Name:  "configure",
 		Usage: "Add a runtime to the specified container engine",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &config)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &config)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.configureWrapper(cmd, &config)
+		Action: func(c *cli.Context) error {
+			return m.configureWrapper(c, &config)
 		},
 	}
 
@@ -177,7 +176,7 @@ func (m command) build() *cli.Command {
 	return &configure
 }
 
-func (m command) validateFlags(c *cli.Command, config *config) error {
+func (m command) validateFlags(c *cli.Context, config *config) error {
 	if config.mode == "oci-hook" {
 		if !filepath.IsAbs(config.nvidiaRuntime.hookPath) {
 			return fmt.Errorf("the NVIDIA runtime hook path %q is not an absolute path", config.nvidiaRuntime.hookPath)
@@ -245,7 +244,7 @@ func (m command) validateFlags(c *cli.Command, config *config) error {
 }
 
 // configureWrapper updates the specified container engine config to enable the NVIDIA runtime
-func (m command) configureWrapper(c *cli.Command, config *config) error {
+func (m command) configureWrapper(c *cli.Context, config *config) error {
 	switch config.mode {
 	case "oci-hook":
 		return m.configureOCIHook(c, config)
@@ -256,7 +255,7 @@ func (m command) configureWrapper(c *cli.Command, config *config) error {
 }
 
 // configureConfigFile updates the specified container engine config file to enable the NVIDIA runtime.
-func (m command) configureConfigFile(c *cli.Command, config *config) error {
+func (m command) configureConfigFile(c *cli.Context, config *config) error {
 	configSource, err := config.resolveConfigSource()
 	if err != nil {
 		return err
@@ -351,7 +350,7 @@ func (c *config) getOutputConfigPath() string {
 }
 
 // configureOCIHook creates and configures the OCI hook for the NVIDIA runtime
-func (m *command) configureOCIHook(c *cli.Command, config *config) error {
+func (m *command) configureOCIHook(c *cli.Context, config *config) error {
 	err := ocihook.CreateHook(config.hookFilePath, config.nvidiaRuntime.hookPath)
 	if err != nil {
 		return fmt.Errorf("error creating OCI hook: %v", err)

cmd/nvidia-ctk/runtime/runtime.go

@@ -17,7 +17,7 @@
 package runtime
 
 import (
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/runtime/configure"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
@@ -42,7 +42,7 @@ func (m runtimeCommand) build() *cli.Command {
 		Usage: "A collection of runtime-related utilities for the NVIDIA Container Toolkit",
 	}
 
-	runtime.Commands = []*cli.Command{
+	runtime.Subcommands = []*cli.Command{
 		configure.NewCommand(m.logger),
 	}
 

cmd/nvidia-ctk/system/create-dev-char-symlinks/create-dev-char-symlinks.go

@@ -17,12 +17,11 @@
 package devchar
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/system/nvdevices"
@@ -62,11 +61,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "create-dev-char-symlinks",
 		Usage: "A utility to create symlinks to possible /dev/nv* devices in /dev/char",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &cfg)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &cfg)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &cfg)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &cfg)
 		},
 	}
 
@@ -76,46 +75,46 @@ func (m command) build() *cli.Command {
 			Usage:       "The path at which the symlinks will be created. Symlinks will be created as `DEV_CHAR`/MAJOR:MINOR where MAJOR and MINOR are the major and minor numbers of a corresponding device node.",
 			Value:       defaultDevCharPath,
 			Destination: &cfg.devCharPath,
-			Sources:     cli.EnvVars("DEV_CHAR_PATH"),
+			EnvVars:     []string{"DEV_CHAR_PATH"},
 		},
 		&cli.StringFlag{
 			Name:        "driver-root",
 			Usage:       "The path to the driver root. `DRIVER_ROOT`/dev is searched for NVIDIA device nodes.",
 			Value:       "/",
 			Destination: &cfg.driverRoot,
-			Sources:     cli.EnvVars("NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"),
+			EnvVars:     []string{"NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"},
 		},
 		&cli.BoolFlag{
 			Name:        "create-all",
 			Usage:       "Create all possible /dev/char symlinks instead of limiting these to existing device nodes.",
 			Destination: &cfg.createAll,
-			Sources:     cli.EnvVars("CREATE_ALL"),
+			EnvVars:     []string{"CREATE_ALL"},
 		},
 		&cli.BoolFlag{
 			Name:        "load-kernel-modules",
 			Usage:       "Load the NVIDIA kernel modules before creating symlinks. This is only applicable when --create-all is set.",
 			Destination: &cfg.loadKernelModules,
-			Sources:     cli.EnvVars("LOAD_KERNEL_MODULES"),
+			EnvVars:     []string{"LOAD_KERNEL_MODULES"},
 		},
 		&cli.BoolFlag{
 			Name:        "create-device-nodes",
 			Usage:       "Create the NVIDIA control device nodes in the driver root if they do not exist. This is only applicable when --create-all is set",
 			Destination: &cfg.createDeviceNodes,
-			Sources:     cli.EnvVars("CREATE_DEVICE_NODES"),
+			EnvVars:     []string{"CREATE_DEVICE_NODES"},
 		},
 		&cli.BoolFlag{
 			Name:        "dry-run",
 			Usage:       "If set, the command will not create any symlinks.",
 			Value:       false,
 			Destination: &cfg.dryRun,
-			Sources:     cli.EnvVars("DRY_RUN"),
+			EnvVars:     []string{"DRY_RUN"},
 		},
 	}
 
 	return &c
 }
 
-func (m command) validateFlags(r *cli.Command, cfg *config) error {
+func (m command) validateFlags(r *cli.Context, cfg *config) error {
 	if cfg.createAll {
 		return fmt.Errorf("create-all and watch are mutually exclusive")
 	}
@@ -133,7 +132,7 @@ func (m command) validateFlags(r *cli.Command, cfg *config) error {
 	return nil
 }
 
-func (m command) run(c *cli.Command, cfg *config) error {
+func (m command) run(c *cli.Context, cfg *config) error {
 	l, err := NewSymlinkCreator(
 		WithLogger(m.logger),
 		WithDevCharPath(cfg.devCharPath),

cmd/nvidia-ctk/system/create-device-nodes/create-device-nodes.go

@@ -17,10 +17,9 @@
 package createdevicenodes
 
 import (
-	"context"
 	"fmt"
 
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/system/nvdevices"
@@ -57,11 +56,11 @@ func (m command) build() *cli.Command {
 	c := cli.Command{
 		Name:  "create-device-nodes",
 		Usage: "A utility to create NVIDIA device nodes",
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			return ctx, m.validateFlags(cmd, &opts)
+		Before: func(c *cli.Context) error {
+			return m.validateFlags(c, &opts)
 		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return m.run(cmd, &opts)
+		Action: func(c *cli.Context) error {
+			return m.run(c, &opts)
 		},
 	}
 
@@ -75,13 +74,13 @@ func (m command) build() *cli.Command {
 			Value:       "/",
 			Destination: &opts.root,
 			// TODO: Remove the NVIDIA_DRIVER_ROOT and DRIVER_ROOT envvars.
-			Sources: cli.EnvVars("ROOT", "NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"),
+			EnvVars: []string{"ROOT", "NVIDIA_DRIVER_ROOT", "DRIVER_ROOT"},
 		},
 		&cli.StringFlag{
 			Name:        "dev-root",
 			Usage:       "specify the root where `/dev` is located. If this is not specified, the root is assumed.",
 			Destination: &opts.devRoot,
-			Sources:     cli.EnvVars("NVIDIA_DEV_ROOT", "DEV_ROOT"),
+			EnvVars:     []string{"NVIDIA_DEV_ROOT", "DEV_ROOT"},
 		},
 		&cli.BoolFlag{
 			Name:        "control-devices",
@@ -98,14 +97,14 @@ func (m command) build() *cli.Command {
 			Usage:       "if set, the command will not perform any operations",
 			Value:       false,
 			Destination: &opts.dryRun,
-			Sources:     cli.EnvVars("DRY_RUN"),
+			EnvVars:     []string{"DRY_RUN"},
 		},
 	}
 
 	return &c
 }
 
-func (m command) validateFlags(r *cli.Command, opts *options) error {
+func (m command) validateFlags(r *cli.Context, opts *options) error {
 	if opts.devRoot == "" && opts.root != "" {
 		m.logger.Infof("Using dev-root %q", opts.root)
 		opts.devRoot = opts.root
@@ -113,7 +112,7 @@ func (m command) validateFlags(r *cli.Command, opts *options) error {
 	return nil
 }
 
-func (m command) run(c *cli.Command, opts *options) error {
+func (m command) run(c *cli.Context, opts *options) error {
 	if opts.loadKernelModules {
 		modules := nvmodules.New(
 			nvmodules.WithLogger(m.logger),

cmd/nvidia-ctk/system/system.go

@@ -17,7 +17,7 @@
 package system
 
 import (
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 
 	devchar "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/system/create-dev-char-symlinks"
 	devicenodes "github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-ctk/system/create-device-nodes"
@@ -43,7 +43,7 @@ func (m command) build() *cli.Command {
 		Usage: "A collection of system-related utilities for the NVIDIA Container Toolkit",
 	}
 
-	system.Commands = []*cli.Command{
+	system.Subcommands = []*cli.Command{
 		devchar.NewCommand(m.logger),
 		devicenodes.NewCommand(m.logger),
 	}

deployments/container/Dockerfile

@@ -1,171 +0,0 @@
-# SPDX-FileCopyrightText: Copyright (c) 2019 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-ARG GOLANG_VERSION=x.x.x
-ARG VERSION="N/A"
-
-FROM nvcr.io/nvidia/cuda:12.9.0-base-ubi9 AS build
-
-RUN dnf install -y \
-    wget make git gcc \
-     && \
-    rm -rf /var/cache/yum/*
-
-ARG GOLANG_VERSION=x.x.x
-RUN set -eux; \
-    \
-    arch="$(uname -m)"; \
-    case "${arch##*-}" in \
-        x86_64 | amd64) ARCH='amd64' ;; \
-        ppc64el | ppc64le) ARCH='ppc64le' ;; \
-        aarch64 | arm64) ARCH='arm64' ;; \
-        *) echo "unsupported architecture" ; exit 1 ;; \
-    esac; \
-    wget -nv -O - https://storage.googleapis.com/golang/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz \
-    | tar -C /usr/local -xz
-
-
-ENV GOPATH=/go
-ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
-
-WORKDIR /build
-COPY . .
-
-RUN mkdir -p /artifacts/bin
-ARG VERSION="N/A"
-ARG GIT_COMMIT="unknown"
-RUN make PREFIX=/artifacts/bin cmd-nvidia-ctk-installer
-
-# The packaging stage collects the deb and rpm packages built for
-# supported architectures.
-FROM nvcr.io/nvidia/distroless/go:v3.1.9-dev AS packaging
-
-USER 0:0
-SHELL ["/busybox/sh", "-c"]
-RUN ln -s /busybox/sh /bin/sh
-
-ARG ARTIFACTS_ROOT
-COPY ${ARTIFACTS_ROOT} /artifacts/packages/
-
-WORKDIR /artifacts
-
-# build-args are added to the manifest.txt file below.
-ARG PACKAGE_VERSION
-ARG GIT_BRANCH
-ARG GIT_COMMIT
-ARG GIT_COMMIT_SHORT
-ARG SOURCE_DATE_EPOCH
-ARG VERSION
-
-# Create a manifest.txt file with the absolute paths of all deb and rpm packages in the container
-RUN echo "#IMAGE_EPOCH=$(date '+%s')" > /artifacts/manifest.txt && \
-    env | sed 's/^/#/g' >> /artifacts/manifest.txt && \
-    find /artifacts/packages -iname '*.deb' -o -iname '*.rpm' >> /artifacts/manifest.txt
-
-LABEL name="NVIDIA Container Toolkit Packages"
-LABEL vendor="NVIDIA"
-LABEL version="${VERSION}"
-LABEL release="N/A"
-LABEL summary="deb and rpm packages for the NVIDIA Container Toolkit"
-LABEL description="See summary"
-
-COPY LICENSE /licenses/
-
-# The debpackages stage is used to extract the contents of deb packages.
-FROM nvcr.io/nvidia/cuda:12.9.0-base-ubuntu20.04 AS debpackages
-
-ARG TARGETARCH
-ARG PACKAGE_DIST_DEB=ubuntu18.04
-
-COPY --from=packaging /artifacts/packages/${PACKAGE_DIST_DEB} /deb-packages
-
-RUN mkdir -p /artifacts/deb
-RUN set -eux; \
-    \
-    case "${TARGETARCH}" in \
-        x86_64 | amd64) ARCH='amd64' ;; \
-        ppc64el | ppc64le) ARCH='ppc64le' ;; \
-        aarch64 | arm64) ARCH='arm64' ;; \
-        *) echo "unsupported architecture" ; exit 1 ;; \
-    esac; \
-    for p in $(ls /deb-packages/${ARCH}/*.deb); do dpkg-deb -xv $p /artifacts/deb/; done
-
-# The rpmpackages stage is used to extract the contents of the rpm packages.
-FROM nvcr.io/nvidia/cuda:12.9.0-base-ubi9 AS rpmpackages
-RUN dnf install -y cpio
-
-ARG TARGETARCH
-ARG PACKAGE_DIST_RPM=centos7
-
-COPY --from=packaging /artifacts/packages/${PACKAGE_DIST_RPM} /rpm-packages
-
-RUN mkdir -p /artifacts/rpm
-RUN set -eux; \
-    \
-    case "${TARGETARCH}" in \
-        x86_64 | amd64) ARCH='x86_64' ;; \
-        ppc64el | ppc64le) ARCH='ppc64le' ;; \
-        aarch64 | arm64) ARCH='aarch64' ;; \
-        *) echo "unsupported architecture" ; exit 1 ;; \
-    esac; \
-    for p in $(ls /rpm-packages/${ARCH}/*.rpm); do rpm2cpio $p | cpio -idmv -D /artifacts/rpm; done
-
-# The artifacts image serves as an intermediate stage to collect the artifacts
-# From the previous stages:
-# - The extracted deb packages
-# - The extracted rpm packages
-# - The nvidia-ctk-installer binary
-FROM scratch AS artifacts
-
-COPY --from=rpmpackages /artifacts/rpm /artifacts/rpm
-COPY --from=debpackages /artifacts/deb /artifacts/deb
-COPY --from=build /artifacts/bin /artifacts/build
-
-# The application stage contains the application used as a GPU Operator
-# operand.
-FROM nvcr.io/nvidia/distroless/go:v3.1.9-dev AS application
-
-USER 0:0
-SHELL ["/busybox/sh", "-c"]
-RUN ln -s /busybox/sh /bin/sh
-
-ENV NVIDIA_DISABLE_REQUIRE="true"
-ENV NVIDIA_VISIBLE_DEVICES=void
-ENV NVIDIA_DRIVER_CAPABILITIES=utility
-
-COPY --from=artifacts /artifacts/rpm /artifacts/rpm
-COPY --from=artifacts /artifacts/deb /artifacts/deb
-COPY --from=artifacts /artifacts/build /work
-
-WORKDIR /work
-ENV PATH=/work:$PATH
-
-ARG VERSION
-LABEL io.k8s.display-name="NVIDIA Container Runtime Config"
-LABEL name="NVIDIA Container Runtime Config"
-LABEL vendor="NVIDIA"
-LABEL version="${VERSION}"
-LABEL release="N/A"
-LABEL summary="Automatically Configure your Container Runtime for GPU support."
-LABEL description="See summary"
-
-COPY LICENSE /licenses/
-
-ENTRYPOINT ["/work/nvidia-ctk-installer"]
-
-# The GPU Operator exec's nvidia-toolkit in its entrypoint.
-# We create a symlink here to ensure compatibility with older
-# GPU Operator versions.
-RUN ln -s /work/nvidia-ctk-installer /work/nvidia-toolkit

deployments/container/Dockerfile.packaging

@@ -0,0 +1,38 @@
+# Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG GOLANG_VERSION=x.x.x
+
+FROM nvcr.io/nvidia/cuda:12.9.0-base-ubuntu20.04
+
+ARG ARTIFACTS_ROOT
+COPY ${ARTIFACTS_ROOT} /artifacts/packages/
+
+WORKDIR /artifacts/packages
+
+# build-args are added to the manifest.txt file below.
+ARG PACKAGE_DIST
+ARG PACKAGE_VERSION
+ARG GIT_BRANCH
+ARG GIT_COMMIT
+ARG GIT_COMMIT_SHORT
+ARG SOURCE_DATE_EPOCH
+ARG VERSION
+
+# Create a manifest.txt file with the absolute paths of all deb and rpm packages in the container
+RUN echo "#IMAGE_EPOCH=$(date '+%s')" > /artifacts/manifest.txt && \
+    env | sed 's/^/#/g' >> /artifacts/manifest.txt && \
+    find /artifacts/packages -iname '*.deb' -o -iname '*.rpm' >> /artifacts/manifest.txt
+
+RUN mkdir /licenses && mv /NGC-DL-CONTAINER-LICENSE /licenses/NGC-DL-CONTAINER-LICENSE

deployments/container/Dockerfile.ubi8

@@ -0,0 +1,90 @@
+# Copyright (c) 2019-2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG GOLANG_VERSION=x.x.x
+ARG VERSION="N/A"
+
+FROM nvcr.io/nvidia/cuda:12.9.0-base-ubi8 AS build
+
+RUN yum install -y \
+    wget make git gcc \
+     && \
+    rm -rf /var/cache/yum/*
+
+ARG GOLANG_VERSION=x.x.x
+RUN set -eux; \
+    \
+    arch="$(uname -m)"; \
+    case "${arch##*-}" in \
+        x86_64 | amd64) ARCH='amd64' ;; \
+        ppc64el | ppc64le) ARCH='ppc64le' ;; \
+        aarch64 | arm64) ARCH='arm64' ;; \
+        *) echo "unsupported architecture" ; exit 1 ;; \
+    esac; \
+    wget -nv -O - https://storage.googleapis.com/golang/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz \
+    | tar -C /usr/local -xz
+
+
+ENV GOPATH=/go
+ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
+
+WORKDIR /build
+COPY . .
+
+RUN mkdir /artifacts
+ARG VERSION="N/A"
+ARG GIT_COMMIT="unknown"
+RUN make PREFIX=/artifacts cmd-nvidia-ctk-installer
+
+FROM nvcr.io/nvidia/cuda:12.9.0-base-ubi8
+
+ENV NVIDIA_DISABLE_REQUIRE="true"
+ENV NVIDIA_VISIBLE_DEVICES=void
+ENV NVIDIA_DRIVER_CAPABILITIES=utility
+
+ARG ARTIFACTS_ROOT
+ARG PACKAGE_DIST
+COPY ${ARTIFACTS_ROOT}/${PACKAGE_DIST} /artifacts/packages/${PACKAGE_DIST}
+
+WORKDIR /artifacts/packages
+
+ARG PACKAGE_VERSION
+ARG TARGETARCH
+ENV PACKAGE_ARCH=${TARGETARCH}
+
+RUN PACKAGE_ARCH=${PACKAGE_ARCH/amd64/x86_64} && PACKAGE_ARCH=${PACKAGE_ARCH/arm64/aarch64} && \
+    yum localinstall -y \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container1-1.*.rpm \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container-tools-1.*.rpm \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/nvidia-container-toolkit*-${PACKAGE_VERSION}*.rpm
+
+WORKDIR /work
+
+COPY --from=build /artifacts/nvidia-ctk-installer /work/nvidia-ctk-installer
+RUN ln -s nvidia-ctk-installer nvidia-toolkit
+
+ENV PATH=/work:$PATH
+
+ARG VERSION
+LABEL io.k8s.display-name="NVIDIA Container Runtime Config"
+LABEL name="NVIDIA Container Runtime Config"
+LABEL vendor="NVIDIA"
+LABEL version="${VERSION}"
+LABEL release="N/A"
+LABEL summary="Automatically Configure your Container Runtime for GPU support."
+LABEL description="See summary"
+
+RUN mkdir /licenses && mv /NGC-DL-CONTAINER-LICENSE /licenses/NGC-DL-CONTAINER-LICENSE
+
+ENTRYPOINT ["/work/nvidia-ctk-installer"]

deployments/container/Dockerfile.ubuntu

@@ -0,0 +1,98 @@
+# Copyright (c) 2019-2021, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG GOLANG_VERSION=x.x.x
+ARG VERSION="N/A"
+
+FROM nvcr.io/nvidia/cuda:12.9.0-base-ubuntu20.04 AS build
+
+RUN apt-get update && \
+    apt-get install -y wget make git gcc \
+    && \
+    rm -rf /var/lib/apt/lists/*
+
+ARG GOLANG_VERSION=x.x.x
+RUN set -eux; \
+    \
+    arch="$(uname -m)"; \
+    case "${arch##*-}" in \
+        x86_64 | amd64) ARCH='amd64' ;; \
+        ppc64el | ppc64le) ARCH='ppc64le' ;; \
+        aarch64 | arm64) ARCH='arm64' ;; \
+        *) echo "unsupported architecture" ; exit 1 ;; \
+    esac; \
+    wget -nv -O - https://storage.googleapis.com/golang/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz \
+    | tar -C /usr/local -xz
+
+ENV GOPATH=/go
+ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
+
+WORKDIR /build
+COPY . .
+
+RUN mkdir /artifacts
+ARG VERSION="N/A"
+ARG GIT_COMMIT="unknown"
+RUN make PREFIX=/artifacts cmd-nvidia-ctk-installer
+
+FROM nvcr.io/nvidia/cuda:12.9.0-base-ubuntu20.04
+
+# Remove the CUDA repository configurations to avoid issues with rotated GPG keys
+RUN rm -f /etc/apt/sources.list.d/cuda.list
+
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libcap2 \
+    curl \
+        && \
+    rm -rf /var/lib/apt/lists/*
+
+ENV NVIDIA_DISABLE_REQUIRE="true"
+ENV NVIDIA_VISIBLE_DEVICES=void
+ENV NVIDIA_DRIVER_CAPABILITIES=utility
+
+ARG ARTIFACTS_ROOT
+ARG PACKAGE_DIST
+COPY ${ARTIFACTS_ROOT}/${PACKAGE_DIST} /artifacts/packages/${PACKAGE_DIST}
+
+WORKDIR /artifacts/packages
+
+ARG PACKAGE_VERSION
+ARG TARGETARCH
+ENV PACKAGE_ARCH=${TARGETARCH}
+
+RUN dpkg -i \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container1_1.*.deb \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/libnvidia-container-tools_1.*.deb \
+    ${PACKAGE_DIST}/${PACKAGE_ARCH}/nvidia-container-toolkit*_${PACKAGE_VERSION}*.deb
+
+WORKDIR /work
+
+COPY --from=build /artifacts/nvidia-ctk-installer /work/nvidia-ctk-installer
+RUN ln -s nvidia-ctk-installer nvidia-toolkit
+
+ENV PATH=/work:$PATH
+
+ARG VERSION
+LABEL io.k8s.display-name="NVIDIA Container Runtime Config"
+LABEL name="NVIDIA Container Runtime Config"
+LABEL vendor="NVIDIA"
+LABEL version="${VERSION}"
+LABEL release="N/A"
+LABEL summary="Automatically Configure your Container Runtime for GPU support."
+LABEL description="See summary"
+
+RUN mkdir /licenses && mv /NGC-DL-CONTAINER-LICENSE /licenses/NGC-DL-CONTAINER-LICENSE
+
+ENTRYPOINT ["/work/nvidia-ctk-installer"]

deployments/container/Makefile

@@ -29,17 +29,17 @@ include $(CURDIR)/versions.mk
 
 IMAGE_VERSION := $(VERSION)
 
-IMAGE_TAG ?= $(VERSION)
+IMAGE_TAG ?= $(VERSION)-$(DIST)
 IMAGE = $(IMAGE_NAME):$(IMAGE_TAG)
 
 OUT_IMAGE_NAME ?= $(IMAGE_NAME)
 OUT_IMAGE_VERSION ?= $(IMAGE_VERSION)
-OUT_IMAGE_TAG = $(OUT_IMAGE_VERSION)
+OUT_IMAGE_TAG = $(OUT_IMAGE_VERSION)-$(DIST)
 OUT_IMAGE = $(OUT_IMAGE_NAME):$(OUT_IMAGE_TAG)
 
 ##### Public rules #####
-DEFAULT_PUSH_TARGET := application
-DISTRIBUTIONS := $(DEFAULT_PUSH_TARGET)
+DEFAULT_PUSH_TARGET := ubuntu20.04
+DISTRIBUTIONS := ubuntu20.04 ubi8
 
 META_TARGETS := packaging
 
@@ -56,16 +56,30 @@ else
 include $(CURDIR)/deployments/container/multi-arch.mk
 endif
 
+# For the default push target we also push a short tag equal to the version.
+# We skip this for the development release
+DEVEL_RELEASE_IMAGE_VERSION ?= devel
+PUSH_MULTIPLE_TAGS ?= true
+ifeq ($(strip $(OUT_IMAGE_VERSION)),$(DEVEL_RELEASE_IMAGE_VERSION))
+PUSH_MULTIPLE_TAGS = false
+endif
+ifeq ($(PUSH_MULTIPLE_TAGS),true)
+push-$(DEFAULT_PUSH_TARGET): push-short
+endif
+
+push-%: DIST = $(*)
+push-short: DIST = $(DEFAULT_PUSH_TARGET)
+
 # Define the push targets
 $(PUSH_TARGETS): push-%:
 	$(CURDIR)/scripts/publish-image.sh $(IMAGE) $(OUT_IMAGE)
 
-DOCKERFILE = $(CURDIR)/deployments/container/Dockerfile
+push-short:
+	$(CURDIR)/scripts/publish-image.sh $(IMAGE) $(OUT_IMAGE)
 
-# For packaging targets we set the output image tag to include the -packaging suffix.
-%-packaging: INTERMEDIATE_TARGET := --target=packaging
-%-packaging: IMAGE_TAG = $(IMAGE_VERSION)-packaging
-%-packaging: OUT_IMAGE_TAG = $(IMAGE_VERSION)-packaging
+
+build-%: DIST = $(*)
+build-%: DOCKERFILE = $(CURDIR)/deployments/container/Dockerfile.$(DOCKERFILE_SUFFIX)
 
 ARTIFACTS_ROOT ?= $(shell realpath --relative-to=$(CURDIR) $(DIST_DIR))
 
@@ -76,12 +90,10 @@ $(IMAGE_TARGETS): image-%: $(ARTIFACTS_ROOT)
 		--provenance=false --sbom=false \
 		$(DOCKER_BUILD_OPTIONS) \
 		$(DOCKER_BUILD_PLATFORM_OPTIONS) \
-		$(INTERMEDIATE_TARGET) \
 		--tag $(IMAGE) \
 		--build-arg ARTIFACTS_ROOT="$(ARTIFACTS_ROOT)" \
 		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
-		--build-arg PACKAGE_DIST_DEB="$(PACKAGE_DIST_DEB)" \
-		--build-arg PACKAGE_DIST_RPM="$(PACKAGE_DIST_RPM)" \
+		--build-arg PACKAGE_DIST="$(PACKAGE_DIST)" \
 		--build-arg PACKAGE_VERSION="$(PACKAGE_VERSION)" \
 		--build-arg VERSION="$(VERSION)" \
 		--build-arg GIT_COMMIT="$(GIT_COMMIT)" \
@@ -91,17 +103,25 @@ $(IMAGE_TARGETS): image-%: $(ARTIFACTS_ROOT)
 		-f $(DOCKERFILE) \
 		$(CURDIR)
 
+build-ubuntu%: DOCKERFILE_SUFFIX := ubuntu
+build-ubuntu%: PACKAGE_DIST = ubuntu18.04
 
-PACKAGE_DIST_DEB = ubuntu18.04
-# TODO: This needs to be set to centos8 for ppc64le builds
-PACKAGE_DIST_RPM = centos7
+build-ubi8: DOCKERFILE_SUFFIX := ubi8
+build-ubi8: PACKAGE_DIST = centos7
 
-# Handle the default build target.
-.PHONY: build push
-build: build-$(DEFAULT_PUSH_TARGET)
-push: push-$(DEFAULT_PUSH_TARGET)
+build-packaging: DOCKERFILE_SUFFIX := packaging
+build-packaging: PACKAGE_ARCH := amd64
+build-packaging: PACKAGE_DIST = all
 
 # Test targets
+test-%: DIST = $(*)
+
+# Handle the default build target.
+.PHONY: build
+build: $(DEFAULT_PUSH_TARGET)
+$(DEFAULT_PUSH_TARGET): build-$(DEFAULT_PUSH_TARGET)
+$(DEFAULT_PUSH_TARGET): DIST = $(DEFAULT_PUSH_TARGET)
+
 TEST_CASES ?= docker crio containerd
 $(TEST_TARGETS): test-%:
 	TEST_CASES="$(TEST_CASES)" bash -x $(CURDIR)/test/container/main.sh run \

deployments/container/native-only.mk

@@ -23,3 +23,11 @@ $(BUILD_TARGETS): build-%: image-%
 else
 $(BUILD_TARGETS): build-%: image-%
 endif
+
+# For the default distribution we also retag the image.
+# Note: This needs to be updated for multi-arch images.
+ifeq ($(IMAGE_TAG),$(VERSION)-$(DIST))
+$(DEFAULT_PUSH_TARGET):
+	$(DOCKER) image inspect $(IMAGE) > /dev/null || $(DOCKER) pull $(IMAGE)
+	$(DOCKER) tag $(IMAGE) $(subst :$(IMAGE_TAG),:$(VERSION),$(IMAGE))
+endif

deployments/devel/Dockerfile

@@ -14,7 +14,7 @@
 
 # This Dockerfile is also used to define the golang version used in this project
 # This allows dependabot to manage this version in addition to other images.
-FROM golang:1.24.4
+FROM golang:1.24.3
 
 WORKDIR /work
 COPY * .

deployments/systemd/nvidia-cdi-refresh.service

@@ -1,28 +0,0 @@
-# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-[Unit]
-Description=Refresh NVIDIA CDI specification file
-ConditionPathExists=/usr/bin/nvidia-smi
-ConditionPathExists=/usr/bin/nvidia-ctk
-
-[Service]
-Type=oneshot
-EnvironmentFile=-/etc/nvidia-container-toolkit/cdi-refresh.env
-ExecCondition=/usr/bin/grep -qE '/nvidia.ko' /lib/modules/%v/modules.dep
-ExecStart=/usr/bin/nvidia-ctk cdi generate --output=/var/run/cdi/nvidia.yaml
-CapabilityBoundingSet=CAP_SYS_MODULE CAP_SYS_ADMIN CAP_MKNOD
-
-[Install]
-WantedBy=multi-user.target

docker/Dockerfile.debian

@@ -55,7 +55,9 @@ RUN make PREFIX=${DIST_DIR} cmds
 
 WORKDIR $DIST_DIR
 COPY packaging/debian ./debian
-COPY deployments/systemd/ .
+
+ARG LIBNVIDIA_CONTAINER_TOOLS_VERSION
+ENV LIBNVIDIA_CONTAINER_TOOLS_VERSION ${LIBNVIDIA_CONTAINER_TOOLS_VERSION}
 
 RUN dch --create --package="${PKG_NAME}" \
         --newversion "${REVISION}" \
@@ -65,6 +67,6 @@ RUN dch --create --package="${PKG_NAME}" \
     if [ "$REVISION" != "$(dpkg-parsechangelog --show-field=Version)" ]; then exit 1; fi
 
 CMD export DISTRIB="$(lsb_release -cs)" && \
-    debuild -eDISTRIB -eSECTION -eVERSION="${REVISION}" \
+    debuild -eDISTRIB -eSECTION -eLIBNVIDIA_CONTAINER_TOOLS_VERSION -eVERSION="${REVISION}" \
     --dpkg-buildpackage-hook='sh debian/prepare' -i -us -uc -b && \
     mv /tmp/*.deb /dist

docker/Dockerfile.opensuse-leap

@@ -46,7 +46,9 @@ RUN make PREFIX=${DIST_DIR} cmds
 
 WORKDIR $DIST_DIR/..
 COPY packaging/rpm .
-COPY deployments/systemd/ .
+
+ARG LIBNVIDIA_CONTAINER_TOOLS_VERSION
+ENV LIBNVIDIA_CONTAINER_TOOLS_VERSION ${LIBNVIDIA_CONTAINER_TOOLS_VERSION}
 
 CMD arch=$(uname -m) && \
     rpmbuild --clean --target=$arch -bb \
@@ -54,6 +56,7 @@ CMD arch=$(uname -m) && \
              -D "release_date $(date +'%a %b %d %Y')" \
              -D "git_commit ${GIT_COMMIT}" \
              -D "version ${PKG_VERS}" \
+             -D "libnvidia_container_tools_version ${LIBNVIDIA_CONTAINER_TOOLS_VERSION}" \
              -D "release ${PKG_REV}" \
              SPECS/nvidia-container-toolkit.spec && \
     mv RPMS/$arch/*.rpm /dist

docker/Dockerfile.rpm-yum

@@ -71,7 +71,9 @@ RUN make PREFIX=${DIST_DIR} cmds
 
 WORKDIR $DIST_DIR/..
 COPY packaging/rpm .
-COPY deployments/systemd/ ${DIST_DIR}/
+
+ARG LIBNVIDIA_CONTAINER_TOOLS_VERSION
+ENV LIBNVIDIA_CONTAINER_TOOLS_VERSION ${LIBNVIDIA_CONTAINER_TOOLS_VERSION}
 
 CMD arch=$(uname -m) && \
     rpmbuild --clean --target=$arch -bb \
@@ -79,6 +81,7 @@ CMD arch=$(uname -m) && \
              -D "release_date $(date +'%a %b %d %Y')" \
              -D "git_commit ${GIT_COMMIT}" \
              -D "version ${PKG_VERS}" \
+             -D "libnvidia_container_tools_version ${LIBNVIDIA_CONTAINER_TOOLS_VERSION}" \
              -D "release ${PKG_REV}" \
              SPECS/nvidia-container-toolkit.spec && \
     mv RPMS/$arch/*.rpm /dist

docker/Dockerfile.ubuntu

@@ -53,16 +53,18 @@ RUN make PREFIX=${DIST_DIR} cmds
 
 WORKDIR $DIST_DIR
 COPY packaging/debian ./debian
-COPY deployments/systemd/ .
+
+ARG LIBNVIDIA_CONTAINER_TOOLS_VERSION
+ENV LIBNVIDIA_CONTAINER_TOOLS_VERSION ${LIBNVIDIA_CONTAINER_TOOLS_VERSION}
 
 RUN dch --create --package="${PKG_NAME}" \
         --newversion "${REVISION}" \
             "See https://gitlab.com/nvidia/container-toolkit/container-toolkit/-/blob/${GIT_COMMIT}/CHANGELOG.md for the changelog" && \
-    dch --append "Bump libnvidia-container dependency to ${REVISION}" && \
+    dch --append "Bump libnvidia-container dependency to ${LIBNVIDIA_CONTAINER_TOOLS_VERSION}" && \
     dch -r "" && \
     if [ "$REVISION" != "$(dpkg-parsechangelog --show-field=Version)" ]; then exit 1; fi
 
 CMD export DISTRIB="$(lsb_release -cs)" && \
-    debuild -eDISTRIB -eSECTION -eVERSION="${REVISION}" \
+    debuild -eDISTRIB -eSECTION -eLIBNVIDIA_CONTAINER_TOOLS_VERSION -eVERSION="${REVISION}" \
     --dpkg-buildpackage-hook='sh debian/prepare' -i -us -uc -b && \
     mv /tmp/*.deb /dist

docker/docker.mk

@@ -85,6 +85,11 @@ docker-all: $(AMD64_TARGETS) $(X86_64_TARGETS) \
 --%: docker-build-%
 	@
 
+LIBNVIDIA_CONTAINER_VERSION ?= $(LIB_VERSION)
+LIBNVIDIA_CONTAINER_TAG ?= $(LIB_TAG)
+
+LIBNVIDIA_CONTAINER_TOOLS_VERSION := $(LIBNVIDIA_CONTAINER_VERSION)$(if $(LIBNVIDIA_CONTAINER_TAG),~$(LIBNVIDIA_CONTAINER_TAG))-1
+
 # private ubuntu target
 --ubuntu%: OS := ubuntu
 
@@ -124,6 +129,7 @@ docker-build-%:
 	    --build-arg PKG_NAME="$(LIB_NAME)" \
 	    --build-arg PKG_VERS="$(PACKAGE_VERSION)" \
 	    --build-arg PKG_REV="$(PACKAGE_REVISION)" \
+	    --build-arg LIBNVIDIA_CONTAINER_TOOLS_VERSION="$(LIBNVIDIA_CONTAINER_TOOLS_VERSION)" \
 	    --build-arg GIT_COMMIT="$(GIT_COMMIT)" \
 	    --tag $(BUILDIMAGE) \
 	    --file $(DOCKERFILE) .

go.mod

@@ -1,12 +1,10 @@
 module github.com/NVIDIA/nvidia-container-toolkit
 
-go 1.23.2
-
-toolchain go1.24.4
+go 1.23.0
 
 require (
-	github.com/NVIDIA/go-nvlib v0.7.3
-	github.com/NVIDIA/go-nvml v0.12.9-0
+	github.com/NVIDIA/go-nvlib v0.7.2
+	github.com/NVIDIA/go-nvml v0.12.4-1
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/moby/sys/reexec v0.1.0
 	github.com/moby/sys/symlink v0.3.0
@@ -15,14 +13,15 @@ require (
 	github.com/pelletier/go-toml v1.9.5
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.10.0
-	github.com/urfave/cli/v3 v3.3.8
-	golang.org/x/mod v0.25.0
+	github.com/urfave/cli/v2 v2.27.6
+	golang.org/x/mod v0.24.0
 	golang.org/x/sys v0.33.0
 	tags.cncf.io/container-device-interface v1.0.1
 	tags.cncf.io/container-device-interface/specs-go v1.0.0
 )
 
 require (
+	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -31,8 +30,10 @@ require (
 	github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rogpeppe/go-internal v1.11.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect

go.sum

@@ -1,9 +1,11 @@
-github.com/NVIDIA/go-nvlib v0.7.3 h1:kXc8PkWUlrwedSpM4fR8xT/DAq1NKy8HqhpgteFcGAw=
-github.com/NVIDIA/go-nvlib v0.7.3/go.mod h1:i95Je7GinMy/+BDs++DAdbPmT2TubjNP8i8joC7DD7I=
-github.com/NVIDIA/go-nvml v0.12.9-0 h1:e344UK8ZkeMeeLkdQtRhmXRxNf+u532LDZPGMtkdus0=
-github.com/NVIDIA/go-nvml v0.12.9-0/go.mod h1:+KNA7c7gIBH7SKSJ1ntlwkfN80zdx8ovl4hrK3LmPt4=
+github.com/NVIDIA/go-nvlib v0.7.2 h1:7sy/NVUa4sM9FLKwH6CjBfHSWrJUmv8emVyxLTzjfOA=
+github.com/NVIDIA/go-nvlib v0.7.2/go.mod h1:2Kh2kYSP5IJ8EKf0/SYDzHiQKb9EJkwOf2LQzu6pXzY=
+github.com/NVIDIA/go-nvml v0.12.4-1 h1:WKUvqshhWSNTfm47ETRhv0A0zJyr1ncCuHiXwoTrBEc=
+github.com/NVIDIA/go-nvml v0.12.4-1/go.mod h1:8Llmj+1Rr+9VGGwZuRer5N/aCjxGuR5nPb/9ebBiIEQ=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
+github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
 github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
@@ -53,6 +55,8 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
 github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
@@ -65,8 +69,8 @@ github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli/v3 v3.3.8 h1:BzolUExliMdet9NlJ/u4m5vHSotJ3PzEqSAZ1oPMa/E=
-github.com/urfave/cli/v3 v3.3.8/go.mod h1:FJSKtM/9AiiTOJL4fJ6TbMUkxBXn7GO9guZqoZtpYpo=
+github.com/urfave/cli/v2 v2.27.6 h1:VdRdS98FNhKZ8/Az8B7MTyGQmpIr36O1EHybx/LaZ4g=
+github.com/urfave/cli/v2 v2.27.6/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@@ -74,8 +78,10 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHo
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

hack/pull-packages.sh

@@ -53,6 +53,6 @@ docker run --rm \
     -v $(pwd):$(pwd) \
     -w $(pwd) \
     -u $(id -u):$(id -g) \
-    --entrypoint="sh" \
+    --entrypoint="bash" \
         ${IMAGE} \
-        -c "cp -p -R /artifacts/* ${DIST_DIR}"
+        -c "cp --preserve=timestamps -R /artifacts/* ${DIST_DIR}"

internal/config/config.go

@@ -31,10 +31,8 @@ import (
 )
 
 const (
-	FilePathOverrideEnvVar = "NVIDIA_CTK_CONFIG_FILE_PATH"
-	RelativeFilePath       = "nvidia-container-runtime/config.toml"
-
-	configRootOverride = "XDG_CONFIG_HOME"
+	configOverride = "XDG_CONFIG_HOME"
+	configFilePath = "nvidia-container-runtime/config.toml"
 
 	nvidiaCTKExecutable          = "nvidia-ctk"
 	nvidiaCTKDefaultFilePath     = "/usr/bin/nvidia-ctk"
@@ -76,15 +74,11 @@ type Config struct {
 
 // GetConfigFilePath returns the path to the config file for the configured system
 func GetConfigFilePath() string {
-	if configFilePathOverride := os.Getenv(FilePathOverrideEnvVar); configFilePathOverride != "" {
-		return configFilePathOverride
-	}
-	configRoot := "/etc"
-	if XDGConfigDir := os.Getenv(configRootOverride); len(XDGConfigDir) != 0 {
-		configRoot = XDGConfigDir
+	if XDGConfigDir := os.Getenv(configOverride); len(XDGConfigDir) != 0 {
+		return filepath.Join(XDGConfigDir, configFilePath)
 	}
 
-	return filepath.Join(configRoot, RelativeFilePath)
+	return filepath.Join("/etc", configFilePath)
 }
 
 // GetConfig sets up the config struct. Values are read from a toml file
@@ -116,7 +110,7 @@ func GetDefault() (*Config, error) {
 		NVIDIAContainerRuntimeConfig: RuntimeConfig{
 			DebugFilePath: "/dev/null",
 			LogLevel:      "info",
-			Runtimes:      []string{"runc", "crun"},
+			Runtimes:      []string{"docker-runc", "runc", "crun"},
 			Mode:          "auto",
 			Modes: modesConfig{
 				CSV: csvModeConfig{

internal/config/config_test.go

@@ -27,26 +27,9 @@ import (
 
 func TestGetConfigWithCustomConfig(t *testing.T) {
 	testDir := t.TempDir()
-	t.Setenv(configRootOverride, testDir)
+	t.Setenv(configOverride, testDir)
 
-	filename := filepath.Join(testDir, RelativeFilePath)
-
-	// By default debug is disabled
-	contents := []byte("[nvidia-container-runtime]\ndebug = \"/nvidia-container-toolkit.log\"")
-
-	require.NoError(t, os.MkdirAll(filepath.Dir(filename), 0766))
-	require.NoError(t, os.WriteFile(filename, contents, 0600))
-
-	cfg, err := GetConfig()
-	require.NoError(t, err)
-	require.Equal(t, "/nvidia-container-toolkit.log", cfg.NVIDIAContainerRuntimeConfig.DebugFilePath)
-}
-
-func TestGetConfigWithConfigFilePathOverride(t *testing.T) {
-	testDir := t.TempDir()
-	filename := filepath.Join(testDir, RelativeFilePath)
-
-	t.Setenv(FilePathOverrideEnvVar, filename)
+	filename := filepath.Join(testDir, configFilePath)
 
 	// By default debug is disabled
 	contents := []byte("[nvidia-container-runtime]\ndebug = \"/nvidia-container-toolkit.log\"")
@@ -80,7 +63,7 @@ func TestGetConfig(t *testing.T) {
 				NVIDIAContainerRuntimeConfig: RuntimeConfig{
 					DebugFilePath: "/dev/null",
 					LogLevel:      "info",
-					Runtimes:      []string{"runc", "crun"},
+					Runtimes:      []string{"docker-runc", "runc", "crun"},
 					Mode:          "auto",
 					Modes: modesConfig{
 						CSV: csvModeConfig{
@@ -187,7 +170,7 @@ func TestGetConfig(t *testing.T) {
 				NVIDIAContainerRuntimeConfig: RuntimeConfig{
 					DebugFilePath: "/dev/null",
 					LogLevel:      "info",
-					Runtimes:      []string{"runc", "crun"},
+					Runtimes:      []string{"docker-runc", "runc", "crun"},
 					Mode:          "auto",
 					Modes: modesConfig{
 						CSV: csvModeConfig{
@@ -306,7 +289,7 @@ func TestGetConfig(t *testing.T) {
 				NVIDIAContainerRuntimeConfig: RuntimeConfig{
 					DebugFilePath: "/dev/null",
 					LogLevel:      "info",
-					Runtimes:      []string{"runc", "crun"},
+					Runtimes:      []string{"docker-runc", "runc", "crun"},
 					Mode:          "auto",
 					Modes: modesConfig{
 						CSV: csvModeConfig{
@@ -348,7 +331,7 @@ func TestGetConfig(t *testing.T) {
 				NVIDIAContainerRuntimeConfig: RuntimeConfig{
 					DebugFilePath: "/dev/null",
 					LogLevel:      "info",
-					Runtimes:      []string{"runc", "crun"},
+					Runtimes:      []string{"docker-runc", "runc", "crun"},
 					Mode:          "auto",
 					Modes: modesConfig{
 						CSV: csvModeConfig{

internal/config/image/builder.go

@@ -21,35 +21,22 @@ import (
 	"strings"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 )
 
 type builder struct {
-	CUDA
-
+	env            map[string]string
+	mounts         []specs.Mount
 	disableRequire bool
 }
 
-// Option is a functional option for creating a CUDA image.
-type Option func(*builder) error
-
 // New creates a new CUDA image from the input options.
 func New(opt ...Option) (CUDA, error) {
-	b := &builder{
-		CUDA: CUDA{
-			acceptEnvvarUnprivileged: true,
-		},
-	}
+	b := &builder{}
 	for _, o := range opt {
 		if err := o(b); err != nil {
 			return CUDA{}, err
 		}
 	}
-
-	if b.logger == nil {
-		b.logger = logger.New()
-	}
 	if b.env == nil {
 		b.env = make(map[string]string)
 	}
@@ -63,36 +50,15 @@ func (b builder) build() (CUDA, error) {
 		b.env[EnvVarNvidiaDisableRequire] = "true"
 	}
 
-	return b.CUDA, nil
+	c := CUDA{
+		env:    b.env,
+		mounts: b.mounts,
+	}
+	return c, nil
 }
 
-func WithAcceptDeviceListAsVolumeMounts(acceptDeviceListAsVolumeMounts bool) Option {
-	return func(b *builder) error {
-		b.acceptDeviceListAsVolumeMounts = acceptDeviceListAsVolumeMounts
-		return nil
-	}
-}
-
-func WithAcceptEnvvarUnprivileged(acceptEnvvarUnprivileged bool) Option {
-	return func(b *builder) error {
-		b.acceptEnvvarUnprivileged = acceptEnvvarUnprivileged
-		return nil
-	}
-}
-
-func WithAnnotations(annotations map[string]string) Option {
-	return func(b *builder) error {
-		b.annotations = annotations
-		return nil
-	}
-}
-
-func WithAnnotationsPrefixes(annotationsPrefixes []string) Option {
-	return func(b *builder) error {
-		b.annotationsPrefixes = annotationsPrefixes
-		return nil
-	}
-}
+// Option is a functional option for creating a CUDA image.
+type Option func(*builder) error
 
 // WithDisableRequire sets the disable require option.
 func WithDisableRequire(disableRequire bool) Option {
@@ -127,14 +93,6 @@ func WithEnvMap(env map[string]string) Option {
 	}
 }
 
-// WithLogger sets the logger to use when creating the CUDA image.
-func WithLogger(logger logger.Interface) Option {
-	return func(b *builder) error {
-		b.logger = logger
-		return nil
-	}
-}
-
 // WithMounts sets the mounts associated with the CUDA image.
 func WithMounts(mounts []specs.Mount) Option {
 	return func(b *builder) error {
@@ -142,20 +100,3 @@ func WithMounts(mounts []specs.Mount) Option {
 		return nil
 	}
 }
-
-// WithPreferredVisibleDevicesEnvVars sets the environment variables that
-// should take precedence over the default NVIDIA_VISIBLE_DEVICES.
-func WithPreferredVisibleDevicesEnvVars(preferredVisibleDeviceEnvVars ...string) Option {
-	return func(b *builder) error {
-		b.preferredVisibleDeviceEnvVars = preferredVisibleDeviceEnvVars
-		return nil
-	}
-}
-
-// WithPrivileged sets whether an image is privileged or not.
-func WithPrivileged(isPrivileged bool) Option {
-	return func(b *builder) error {
-		b.isPrivileged = isPrivileged
-		return nil
-	}
-}

internal/config/image/cuda_image.go

@@ -19,15 +19,12 @@ package image
 import (
 	"fmt"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/mod/semver"
 	"tags.cncf.io/container-device-interface/pkg/parser"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/logger"
 )
 
 const (
@@ -41,44 +38,27 @@ const (
 // a map of environment variable to values that can be used to perform lookups
 // such as requirements.
 type CUDA struct {
-	logger logger.Interface
-
-	annotations  map[string]string
-	env          map[string]string
-	isPrivileged bool
-	mounts       []specs.Mount
-
-	annotationsPrefixes            []string
-	acceptDeviceListAsVolumeMounts bool
-	acceptEnvvarUnprivileged       bool
-	preferredVisibleDeviceEnvVars  []string
+	env    map[string]string
+	mounts []specs.Mount
 }
 
 // NewCUDAImageFromSpec creates a CUDA image from the input OCI runtime spec.
 // The process environment is read (if present) to construc the CUDA Image.
-func NewCUDAImageFromSpec(spec *specs.Spec, opts ...Option) (CUDA, error) {
-	if spec == nil {
-		return New(opts...)
-	}
-
+func NewCUDAImageFromSpec(spec *specs.Spec) (CUDA, error) {
 	var env []string
-	if spec.Process != nil {
+	if spec != nil && spec.Process != nil {
 		env = spec.Process.Env
 	}
 
-	specOpts := []Option{
-		WithAnnotations(spec.Annotations),
+	return New(
 		WithEnv(env),
 		WithMounts(spec.Mounts),
-		WithPrivileged(IsPrivileged((*OCISpec)(spec))),
-	}
-
-	return New(append(opts, specOpts...)...)
+	)
 }
 
-// newCUDAImageFromEnv creates a CUDA image from the input environment. The environment
+// NewCUDAImageFromEnv creates a CUDA image from the input environment. The environment
 // is a list of strings of the form ENVAR=VALUE.
-func newCUDAImageFromEnv(env []string) (CUDA, error) {
+func NewCUDAImageFromEnv(env []string) (CUDA, error) {
 	return New(WithEnv(env))
 }
 
@@ -103,10 +83,6 @@ func (i CUDA) IsLegacy() bool {
 	return len(legacyCudaVersion) > 0 && len(cudaRequire) == 0
 }
 
-func (i CUDA) IsPrivileged() bool {
-	return i.isPrivileged
-}
-
 // GetRequirements returns the requirements from all NVIDIA_REQUIRE_ environment
 // variables.
 func (i CUDA) GetRequirements() ([]string, error) {
@@ -144,8 +120,8 @@ func (i CUDA) HasDisableRequire() bool {
 	return false
 }
 
-// devicesFromEnvvars returns the devices requested by the image through environment variables
-func (i CUDA) devicesFromEnvvars(envVars ...string) []string {
+// DevicesFromEnvvars returns the devices requested by the image through environment variables
+func (i CUDA) DevicesFromEnvvars(envVars ...string) VisibleDevices {
 	// We concantenate all the devices from the specified env.
 	var isSet bool
 	var devices []string
@@ -166,15 +142,15 @@ func (i CUDA) devicesFromEnvvars(envVars ...string) []string {
 
 	// Environment variable unset with legacy image: default to "all".
 	if !isSet && len(devices) == 0 && i.IsLegacy() {
-		devices = []string{"all"}
+		return NewVisibleDevices("all")
 	}
 
 	// Environment variable unset or empty or "void": return nil
 	if len(devices) == 0 || requested["void"] {
-		devices = []string{"void"}
+		return NewVisibleDevices("void")
 	}
 
-	return NewVisibleDevices(devices...).List()
+	return NewVisibleDevices(devices...)
 }
 
 // GetDriverCapabilities returns the requested driver capabilities.
@@ -224,137 +200,46 @@ func parseMajorMinorVersion(version string) (string, error) {
 // OnlyFullyQualifiedCDIDevices returns true if all devices requested in the image are requested as CDI devices/
 func (i CUDA) OnlyFullyQualifiedCDIDevices() bool {
 	var hasCDIdevice bool
-	for _, device := range i.VisibleDevices() {
+	for _, device := range i.VisibleDevicesFromEnvVar() {
 		if !parser.IsQualifiedName(device) {
 			return false
 		}
 		hasCDIdevice = true
 	}
+
+	for _, device := range i.DevicesFromMounts() {
+		if !strings.HasPrefix(device, "cdi/") {
+			return false
+		}
+		hasCDIdevice = true
+	}
 	return hasCDIdevice
 }
 
-// visibleEnvVars returns the environment variables that are used to determine device visibility.
-// It returns the preferred environment variables that are set, or NVIDIA_VISIBLE_DEVICES if none are set.
-func (i CUDA) visibleEnvVars() []string {
-	var envVars []string
-	for _, envVar := range i.preferredVisibleDeviceEnvVars {
-		if !i.HasEnvvar(envVar) {
-			continue
-		}
-		envVars = append(envVars, envVar)
-	}
-	if len(envVars) > 0 {
-		return envVars
-	}
-	return []string{EnvVarNvidiaVisibleDevices}
+// VisibleDevicesFromEnvVar returns the set of visible devices requested through
+// the NVIDIA_VISIBLE_DEVICES environment variable.
+func (i CUDA) VisibleDevicesFromEnvVar() []string {
+	return i.DevicesFromEnvvars(EnvVarNvidiaVisibleDevices).List()
 }
 
-// VisibleDevices returns a list of devices requested in the container image.
-// If volume mount requests are enabled these are returned if requested,
-// otherwise device requests through environment variables are considered.
-// In cases where environment variable requests required privileged containers,
-// such devices requests are ignored.
-func (i CUDA) VisibleDevices() []string {
-	// If annotation device requests are present, these are preferred.
-	annotationDeviceRequests := i.cdiDeviceRequestsFromAnnotations()
-	if len(annotationDeviceRequests) > 0 {
-		return annotationDeviceRequests
-	}
-
-	// If enabled, try and get the device list from volume mounts first
-	if i.acceptDeviceListAsVolumeMounts {
-		volumeMountDeviceRequests := i.visibleDevicesFromMounts()
-		if len(volumeMountDeviceRequests) > 0 {
-			return volumeMountDeviceRequests
-		}
-	}
-
-	// Get the Fallback to reading from the environment variable if privileges are correct
-	envVarDeviceRequests := i.visibleDevicesFromEnvVar()
-	if len(envVarDeviceRequests) == 0 {
-		return nil
-	}
-
-	// If the container is privileged, or environment variable requests are
-	// allowed for unprivileged containers, these devices are returned.
-	if i.isPrivileged || i.acceptEnvvarUnprivileged {
-		return envVarDeviceRequests
-	}
-
-	// We log a warning if we are ignoring the environment variable requests.
-	envVars := i.visibleEnvVars()
-	if len(envVars) > 0 {
-		i.logger.Warningf("Ignoring devices requested by environment variable(s) in unprivileged container: %v", envVars)
-	}
-
-	return nil
-}
-
-// cdiDeviceRequestsFromAnnotations returns a list of devices specified in the
-// annotations.
-// Keys starting with the specified prefixes are considered and expected to
-// contain a comma-separated list of fully-qualified CDI devices names.
-// The format of the requested devices is not checked and the list is not
-// deduplicated.
-func (i CUDA) cdiDeviceRequestsFromAnnotations() []string {
-	if len(i.annotationsPrefixes) == 0 || len(i.annotations) == 0 {
-		return nil
-	}
-
-	var annotationKeys []string
-	for key := range i.annotations {
-		for _, prefix := range i.annotationsPrefixes {
-			if strings.HasPrefix(key, prefix) {
-				annotationKeys = append(annotationKeys, key)
-				// There is no need to check additional prefixes since we
-				// typically deduplicate devices in any case.
-				break
-			}
-		}
-	}
-	// We sort the annotationKeys for consistent results.
-	slices.Sort(annotationKeys)
-
+// VisibleDevicesFromMounts returns the set of visible devices requested as mounts.
+func (i CUDA) VisibleDevicesFromMounts() []string {
 	var devices []string
-	for _, key := range annotationKeys {
-		devices = append(devices, strings.Split(i.annotations[key], ",")...)
-	}
-	return devices
-}
-
-// visibleDevicesFromEnvVar returns the set of visible devices requested through environment variables.
-// If any of the preferredVisibleDeviceEnvVars are present in the image, they
-// are used to determine the visible devices. If this is not the case, the
-// NVIDIA_VISIBLE_DEVICES environment variable is used.
-func (i CUDA) visibleDevicesFromEnvVar() []string {
-	envVars := i.visibleEnvVars()
-	return i.devicesFromEnvvars(envVars...)
-}
-
-// visibleDevicesFromMounts returns the set of visible devices requested as mounts.
-func (i CUDA) visibleDevicesFromMounts() []string {
-	var devices []string
-	for _, device := range i.requestsFromMounts() {
+	for _, device := range i.DevicesFromMounts() {
 		switch {
+		case strings.HasPrefix(device, volumeMountDevicePrefixCDI):
+			continue
 		case strings.HasPrefix(device, volumeMountDevicePrefixImex):
 			continue
-		case strings.HasPrefix(device, volumeMountDevicePrefixCDI):
-			name, err := cdiDeviceMountRequest(device).qualifiedName()
-			if err != nil {
-				i.logger.Warningf("Ignoring invalid mount request for CDI device %v: %v", device, err)
-				continue
-			}
-			devices = append(devices, name)
-		default:
-			devices = append(devices, device)
 		}
-
+		devices = append(devices, device)
 	}
 	return devices
 }
 
-// requestsFromMounts returns a list of device specified as mounts.
-func (i CUDA) requestsFromMounts() []string {
+// DevicesFromMounts returns a list of device specified as mounts.
+// TODO: This should be merged with getDevicesFromMounts used in the NVIDIA Container Runtime
+func (i CUDA) DevicesFromMounts() []string {
 	root := filepath.Clean(DeviceListAsVolumeMountsRoot)
 	seen := make(map[string]bool)
 	var devices []string
@@ -386,35 +271,28 @@ func (i CUDA) requestsFromMounts() []string {
 	return devices
 }
 
-// a cdiDeviceMountRequest represents a CDI device requests as a mount.
-// Here the host path /dev/null is mounted to a particular path in the container.
-// The container path has the form:
-// /var/run/nvidia-container-devices/cdi/<vendor>/<class>/<device>
-// or
-// /var/run/nvidia-container-devices/cdi/<vendor>/<class>=<device>
-type cdiDeviceMountRequest string
-
-// qualifiedName returns the fully-qualified name of the CDI device.
-func (m cdiDeviceMountRequest) qualifiedName() (string, error) {
-	if !strings.HasPrefix(string(m), volumeMountDevicePrefixCDI) {
-		return "", fmt.Errorf("invalid mount CDI device request: %s", m)
+// CDIDevicesFromMounts returns a list of CDI devices specified as mounts on the image.
+func (i CUDA) CDIDevicesFromMounts() []string {
+	var devices []string
+	for _, mountDevice := range i.DevicesFromMounts() {
+		if !strings.HasPrefix(mountDevice, volumeMountDevicePrefixCDI) {
+			continue
+		}
+		parts := strings.SplitN(strings.TrimPrefix(mountDevice, volumeMountDevicePrefixCDI), "/", 3)
+		if len(parts) != 3 {
+			continue
+		}
+		vendor := parts[0]
+		class := parts[1]
+		device := parts[2]
+		devices = append(devices, fmt.Sprintf("%s/%s=%s", vendor, class, device))
 	}
-
-	requestedDevice := strings.TrimPrefix(string(m), volumeMountDevicePrefixCDI)
-	if parser.IsQualifiedName(requestedDevice) {
-		return requestedDevice, nil
-	}
-
-	parts := strings.SplitN(requestedDevice, "/", 3)
-	if len(parts) != 3 {
-		return "", fmt.Errorf("invalid mount CDI device request: %s", m)
-	}
-	return fmt.Sprintf("%s/%s=%s", parts[0], parts[1], parts[2]), nil
+	return devices
 }
 
 // ImexChannelsFromEnvVar returns the list of IMEX channels requested for the image.
 func (i CUDA) ImexChannelsFromEnvVar() []string {
-	imexChannels := i.devicesFromEnvvars(EnvVarNvidiaImexChannels)
+	imexChannels := i.DevicesFromEnvvars(EnvVarNvidiaImexChannels).List()
 	if len(imexChannels) == 1 && imexChannels[0] == "all" {
 		return nil
 	}
@@ -424,7 +302,7 @@ func (i CUDA) ImexChannelsFromEnvVar() []string {
 // ImexChannelsFromMounts returns the list of IMEX channels requested for the image.
 func (i CUDA) ImexChannelsFromMounts() []string {
 	var channels []string
-	for _, mountDevice := range i.requestsFromMounts() {
+	for _, mountDevice := range i.DevicesFromMounts() {
 		if !strings.HasPrefix(mountDevice, volumeMountDevicePrefixImex) {
 			continue
 		}

internal/config/image/cuda_image_test.go

@@ -21,91 +21,9 @@ import (
 	"testing"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
-	testlog "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/require"
 )
 
-func TestNewCUDAImageFromSpec(t *testing.T) {
-	logger, _ := testlog.NewNullLogger()
-
-	testCases := []struct {
-		description string
-		spec        *specs.Spec
-		options     []Option
-		expected    CUDA
-	}{
-		{
-			description: "no env vars",
-			spec: &specs.Spec{
-				Process: &specs.Process{
-					Env: []string{},
-				},
-			},
-			expected: CUDA{
-				logger:                   logger,
-				env:                      map[string]string{},
-				acceptEnvvarUnprivileged: true,
-			},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES=all",
-			spec: &specs.Spec{
-				Process: &specs.Process{
-					Env: []string{"NVIDIA_VISIBLE_DEVICES=all"},
-				},
-			},
-			expected: CUDA{
-				logger:                   logger,
-				env:                      map[string]string{"NVIDIA_VISIBLE_DEVICES": "all"},
-				acceptEnvvarUnprivileged: true,
-			},
-		},
-		{
-			description: "Spec overrides options",
-			spec: &specs.Spec{
-				Process: &specs.Process{
-					Env: []string{"NVIDIA_VISIBLE_DEVICES=all"},
-				},
-				Mounts: []specs.Mount{
-					{
-						Source:      "/spec-source",
-						Destination: "/spec-destination",
-					},
-				},
-			},
-			options: []Option{
-				WithEnvMap(map[string]string{"OTHER": "value"}),
-				WithMounts([]specs.Mount{
-					{
-						Source:      "/option-source",
-						Destination: "/option-destination",
-					},
-				}),
-			},
-			expected: CUDA{
-				logger: logger,
-				env:    map[string]string{"NVIDIA_VISIBLE_DEVICES": "all"},
-				mounts: []specs.Mount{
-					{
-						Source:      "/spec-source",
-						Destination: "/spec-destination",
-					},
-				},
-				acceptEnvvarUnprivileged: true,
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			options := append([]Option{WithLogger(logger)}, tc.options...)
-			image, err := NewCUDAImageFromSpec(tc.spec, options...)
-			require.NoError(t, err)
-			require.EqualValues(t, tc.expected, image)
-		})
-	}
-}
-
 func TestParseMajorMinorVersionValid(t *testing.T) {
 	var tests = []struct {
 		version  string
@@ -204,7 +122,7 @@ func TestGetRequirements(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.description, func(t *testing.T) {
-			image, err := newCUDAImageFromEnv(tc.env)
+			image, err := NewCUDAImageFromEnv(tc.env)
 			require.NoError(t, err)
 
 			requirements, err := image.GetRequirements()
@@ -215,226 +133,6 @@ func TestGetRequirements(t *testing.T) {
 	}
 }
 
-func TestGetDevicesFromEnvvar(t *testing.T) {
-	envDockerResourceGPUs := "DOCKER_RESOURCE_GPUS"
-	gpuID := "GPU-12345"
-	anotherGPUID := "GPU-67890"
-	thirdGPUID := "MIG-12345"
-
-	var tests = []struct {
-		description                   string
-		preferredVisibleDeviceEnvVars []string
-		env                           map[string]string
-		expectedDevices               []string
-	}{
-		{
-			description: "empty env returns nil for non-legacy image",
-		},
-		{
-			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: "",
-			},
-		},
-		{
-			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: "void",
-			},
-		},
-		{
-			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: "none",
-			},
-			expectedDevices: []string{""},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: gpuID,
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: gpuID,
-				EnvVarCudaVersion:          "legacy",
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "empty env returns all for legacy image",
-			env: map[string]string{
-				EnvVarCudaVersion: "legacy",
-			},
-			expectedDevices: []string{"all"},
-		},
-		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is ignored when
-		// not enabled
-		{
-			description: "missing NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				envDockerResourceGPUs: anotherGPUID,
-			},
-		},
-		{
-			description: "blank NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: "",
-				envDockerResourceGPUs:      anotherGPUID,
-			},
-		},
-		{
-			description: "'void' NVIDIA_VISIBLE_DEVICES returns nil for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: "void",
-				envDockerResourceGPUs:      anotherGPUID,
-			},
-		},
-		{
-			description: "'none' NVIDIA_VISIBLE_DEVICES returns empty for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: "none",
-				envDockerResourceGPUs:      anotherGPUID,
-			},
-			expectedDevices: []string{""},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for non-legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: gpuID,
-				envDockerResourceGPUs:      anotherGPUID,
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "NVIDIA_VISIBLE_DEVICES set returns value for legacy image",
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: gpuID,
-				envDockerResourceGPUs:      anotherGPUID,
-				EnvVarCudaVersion:          "legacy",
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description: "empty env returns all for legacy image",
-			env: map[string]string{
-				envDockerResourceGPUs: anotherGPUID,
-				EnvVarCudaVersion:     "legacy",
-			},
-			expectedDevices: []string{"all"},
-		},
-		// Add the `DOCKER_RESOURCE_GPUS` envvar and ensure that this is selected when
-		// enabled
-		{
-			description:                   "empty env returns nil for non-legacy image",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-		},
-		{
-			description:                   "blank DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: "",
-			},
-		},
-		{
-			description:                   "'void' DOCKER_RESOURCE_GPUS returns nil for non-legacy image",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: "void",
-			},
-		},
-		{
-			description:                   "'none' DOCKER_RESOURCE_GPUS returns empty for non-legacy image",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: "none",
-			},
-			expectedDevices: []string{""},
-		},
-		{
-			description:                   "DOCKER_RESOURCE_GPUS set returns value for non-legacy image",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: gpuID,
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description:                   "DOCKER_RESOURCE_GPUS set returns value for legacy image",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: gpuID,
-				EnvVarCudaVersion:     "legacy",
-			},
-			expectedDevices: []string{gpuID},
-		},
-		{
-			description:                   "DOCKER_RESOURCE_GPUS is selected if present",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				envDockerResourceGPUs: anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-		{
-			description:                   "DOCKER_RESOURCE_GPUS overrides NVIDIA_VISIBLE_DEVICES if present",
-			preferredVisibleDeviceEnvVars: []string{envDockerResourceGPUs},
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: gpuID,
-				envDockerResourceGPUs:      anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-		{
-			description:                   "DOCKER_RESOURCE_GPUS_ADDITIONAL overrides NVIDIA_VISIBLE_DEVICES if present",
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS_ADDITIONAL"},
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices:        gpuID,
-				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-		{
-			description:                   "All available swarm resource envvars are selected and override NVIDIA_VISIBLE_DEVICES if present",
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS", "DOCKER_RESOURCE_GPUS_ADDITIONAL"},
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices:        gpuID,
-				"DOCKER_RESOURCE_GPUS":            thirdGPUID,
-				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
-			},
-			expectedDevices: []string{thirdGPUID, anotherGPUID},
-		},
-		{
-			description:                   "DOCKER_RESOURCE_GPUS_ADDITIONAL or DOCKER_RESOURCE_GPUS override NVIDIA_VISIBLE_DEVICES if present",
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS", "DOCKER_RESOURCE_GPUS_ADDITIONAL"},
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices:        gpuID,
-				"DOCKER_RESOURCE_GPUS_ADDITIONAL": anotherGPUID,
-			},
-			expectedDevices: []string{anotherGPUID},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.description, func(t *testing.T) {
-			image, err := New(
-				WithEnvMap(tc.env),
-				WithPrivileged(true),
-				WithAcceptDeviceListAsVolumeMounts(false),
-				WithAcceptEnvvarUnprivileged(false),
-				WithPreferredVisibleDevicesEnvVars(tc.preferredVisibleDeviceEnvVars...),
-			)
-
-			require.NoError(t, err)
-			devices := image.visibleDevicesFromEnvVar()
-			require.EqualValues(t, tc.expectedDevices, devices)
-		})
-	}
-}
-
 func TestGetVisibleDevicesFromMounts(t *testing.T) {
 	var tests = []struct {
 		description     string
@@ -487,9 +185,9 @@ func TestGetVisibleDevicesFromMounts(t *testing.T) {
 			expectedDevices: []string{"GPU0-MIG0/0/1", "GPU1-MIG0/0/1"},
 		},
 		{
-			description:     "cdi devices are included",
-			mounts:          makeTestMounts("GPU0", "nvidia.com/gpu=all", "GPU1"),
-			expectedDevices: []string{"GPU0", "nvidia.com/gpu=all", "GPU1"},
+			description:     "cdi devices are ignored",
+			mounts:          makeTestMounts("GPU0", "cdi/nvidia.com/gpu=all", "GPU1"),
+			expectedDevices: []string{"GPU0", "GPU1"},
 		},
 		{
 			description:     "imex devices are ignored",
@@ -499,195 +197,8 @@ func TestGetVisibleDevicesFromMounts(t *testing.T) {
 	}
 	for _, tc := range tests {
 		t.Run(tc.description, func(t *testing.T) {
-			image, err := New(WithMounts(tc.mounts))
-			require.NoError(t, err)
-			require.Equal(t, tc.expectedDevices, image.visibleDevicesFromMounts())
-		})
-	}
-}
-
-func TestVisibleDevices(t *testing.T) {
-	var tests = []struct {
-		description                   string
-		mountDevices                  []specs.Mount
-		envvarDevices                 string
-		privileged                    bool
-		acceptUnprivileged            bool
-		acceptMounts                  bool
-		preferredVisibleDeviceEnvVars []string
-		env                           map[string]string
-		expectedDevices               []string
-	}{
-		{
-			description: "Mount devices, unprivileged, no accept unprivileged",
-			mountDevices: []specs.Mount{
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(DeviceListAsVolumeMountsRoot, "GPU0"),
-				},
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(DeviceListAsVolumeMountsRoot, "GPU1"),
-				},
-			},
-			envvarDevices:      "GPU2,GPU3",
-			privileged:         false,
-			acceptUnprivileged: false,
-			acceptMounts:       true,
-			expectedDevices:    []string{"GPU0", "GPU1"},
-		},
-		{
-			description:        "No mount devices, unprivileged, no accept unprivileged",
-			mountDevices:       nil,
-			envvarDevices:      "GPU0,GPU1",
-			privileged:         false,
-			acceptUnprivileged: false,
-			acceptMounts:       true,
-			expectedDevices:    nil,
-		},
-		{
-			description:        "No mount devices, privileged, no accept unprivileged",
-			mountDevices:       nil,
-			envvarDevices:      "GPU0,GPU1",
-			privileged:         true,
-			acceptUnprivileged: false,
-			acceptMounts:       true,
-			expectedDevices:    []string{"GPU0", "GPU1"},
-		},
-		{
-			description:        "No mount devices, unprivileged, accept unprivileged",
-			mountDevices:       nil,
-			envvarDevices:      "GPU0,GPU1",
-			privileged:         false,
-			acceptUnprivileged: true,
-			acceptMounts:       true,
-			expectedDevices:    []string{"GPU0", "GPU1"},
-		},
-		{
-			description: "Mount devices, unprivileged, accept unprivileged, no accept mounts",
-			mountDevices: []specs.Mount{
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(DeviceListAsVolumeMountsRoot, "GPU0"),
-				},
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(DeviceListAsVolumeMountsRoot, "GPU1"),
-				},
-			},
-			envvarDevices:      "GPU2,GPU3",
-			privileged:         false,
-			acceptUnprivileged: true,
-			acceptMounts:       false,
-			expectedDevices:    []string{"GPU2", "GPU3"},
-		},
-		{
-			description: "Mount devices, unprivileged, no accept unprivileged, no accept mounts",
-			mountDevices: []specs.Mount{
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(DeviceListAsVolumeMountsRoot, "GPU0"),
-				},
-				{
-					Source:      "/dev/null",
-					Destination: filepath.Join(DeviceListAsVolumeMountsRoot, "GPU1"),
-				},
-			},
-			envvarDevices:      "GPU2,GPU3",
-			privileged:         false,
-			acceptUnprivileged: false,
-			acceptMounts:       false,
-			expectedDevices:    nil,
-		},
-		// New test cases for visibleEnvVars functionality
-		{
-			description:                   "preferred env var set and present in env, privileged",
-			mountDevices:                  nil,
-			envvarDevices:                 "",
-			privileged:                    true,
-			acceptUnprivileged:            false,
-			acceptMounts:                  true,
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS"},
-			env: map[string]string{
-				"DOCKER_RESOURCE_GPUS": "GPU-12345",
-			},
-			expectedDevices: []string{"GPU-12345"},
-		},
-		{
-			description:                   "preferred env var set and present in env, unprivileged but accepted",
-			mountDevices:                  nil,
-			envvarDevices:                 "",
-			privileged:                    false,
-			acceptUnprivileged:            true,
-			acceptMounts:                  true,
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS"},
-			env: map[string]string{
-				"DOCKER_RESOURCE_GPUS": "GPU-12345",
-			},
-			expectedDevices: []string{"GPU-12345"},
-		},
-		{
-			description:                   "preferred env var set and present in env, unprivileged and not accepted",
-			mountDevices:                  nil,
-			envvarDevices:                 "",
-			privileged:                    false,
-			acceptUnprivileged:            false,
-			acceptMounts:                  true,
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS"},
-			env: map[string]string{
-				"DOCKER_RESOURCE_GPUS": "GPU-12345",
-			},
-			expectedDevices: nil,
-		},
-		{
-			description:                   "multiple preferred env vars, both present, privileged",
-			mountDevices:                  nil,
-			envvarDevices:                 "",
-			privileged:                    true,
-			acceptUnprivileged:            false,
-			acceptMounts:                  true,
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS", "DOCKER_RESOURCE_GPUS_ADDITIONAL"},
-			env: map[string]string{
-				"DOCKER_RESOURCE_GPUS":            "GPU-12345",
-				"DOCKER_RESOURCE_GPUS_ADDITIONAL": "GPU-67890",
-			},
-			expectedDevices: []string{"GPU-12345", "GPU-67890"},
-		},
-		{
-			description:                   "preferred env var not present, fallback to NVIDIA_VISIBLE_DEVICES, privileged",
-			mountDevices:                  nil,
-			envvarDevices:                 "GPU-12345",
-			privileged:                    true,
-			acceptUnprivileged:            false,
-			acceptMounts:                  true,
-			preferredVisibleDeviceEnvVars: []string{"DOCKER_RESOURCE_GPUS"},
-			env: map[string]string{
-				EnvVarNvidiaVisibleDevices: "GPU-12345",
-			},
-			expectedDevices: []string{"GPU-12345"},
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.description, func(t *testing.T) {
-			// Create env map with both NVIDIA_VISIBLE_DEVICES and any additional env vars
-			env := make(map[string]string)
-			if tc.envvarDevices != "" {
-				env[EnvVarNvidiaVisibleDevices] = tc.envvarDevices
-			}
-			for k, v := range tc.env {
-				env[k] = v
-			}
-
-			image, err := New(
-				WithEnvMap(env),
-				WithMounts(tc.mountDevices),
-				WithPrivileged(tc.privileged),
-				WithAcceptDeviceListAsVolumeMounts(tc.acceptMounts),
-				WithAcceptEnvvarUnprivileged(tc.acceptUnprivileged),
-				WithPreferredVisibleDevicesEnvVars(tc.preferredVisibleDeviceEnvVars...),
-			)
-			require.NoError(t, err)
-			require.Equal(t, tc.expectedDevices, image.VisibleDevices())
+			image, _ := New(WithMounts(tc.mounts))
+			require.Equal(t, tc.expectedDevices, image.VisibleDevicesFromMounts())
 		})
 	}
 }
@@ -713,7 +224,7 @@ func TestImexChannelsFromEnvVar(t *testing.T) {
 	for _, tc := range testCases {
 		for id, baseEnvvars := range map[string][]string{"": nil, "legacy": {"CUDA_VERSION=1.2.3"}} {
 			t.Run(tc.description+id, func(t *testing.T) {
-				i, err := newCUDAImageFromEnv(append(baseEnvvars, tc.env...))
+				i, err := NewCUDAImageFromEnv(append(baseEnvvars, tc.env...))
 				require.NoError(t, err)
 
 				channels := i.ImexChannelsFromEnvVar()
@@ -723,73 +234,6 @@ func TestImexChannelsFromEnvVar(t *testing.T) {
 	}
 }
 
-func TestCDIDeviceRequestsFromAnnotations(t *testing.T) {
-	testCases := []struct {
-		description     string
-		prefixes        []string
-		annotations     map[string]string
-		expectedDevices []string
-	}{
-		{
-			description: "no annotations",
-		},
-		{
-			description: "no matching annotations",
-			prefixes:    []string{"not-prefix/"},
-			annotations: map[string]string{
-				"prefix/foo": "example.com/device=bar",
-			},
-		},
-		{
-			description: "single matching annotation",
-			prefixes:    []string{"prefix/"},
-			annotations: map[string]string{
-				"prefix/foo": "example.com/device=bar",
-			},
-			expectedDevices: []string{"example.com/device=bar"},
-		},
-		{
-			description: "multiple matching annotations",
-			prefixes:    []string{"prefix/", "another-prefix/"},
-			annotations: map[string]string{
-				"prefix/foo":         "example.com/device=bar",
-				"another-prefix/bar": "example.com/device=baz",
-			},
-			expectedDevices: []string{"example.com/device=bar", "example.com/device=baz"},
-		},
-		{
-			description: "multiple matching annotations with duplicate devices",
-			prefixes:    []string{"prefix/", "another-prefix/"},
-			annotations: map[string]string{
-				"prefix/foo":         "example.com/device=bar",
-				"another-prefix/bar": "example.com/device=bar",
-			},
-			expectedDevices: []string{"example.com/device=bar", "example.com/device=bar"},
-		},
-		{
-			description: "invalid devices are returned as is",
-			prefixes:    []string{"prefix/"},
-			annotations: map[string]string{
-				"prefix/foo": "example.com/device",
-			},
-			expectedDevices: []string{"example.com/device"},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.description, func(t *testing.T) {
-			image, err := New(
-				WithAnnotationsPrefixes(tc.prefixes),
-				WithAnnotations(tc.annotations),
-			)
-			require.NoError(t, err)
-
-			devices := image.cdiDeviceRequestsFromAnnotations()
-			require.ElementsMatch(t, tc.expectedDevices, devices)
-		})
-	}
-}
-
 func makeTestMounts(paths ...string) []specs.Mount {
 	var mounts []specs.Mount
 	for _, path := range paths {

internal/config/image/privileged.go

@@ -24,39 +24,20 @@ const (
 	capSysAdmin = "CAP_SYS_ADMIN"
 )
 
-type CapabilitiesGetter interface {
-	GetCapabilities() []string
-}
-
-type OCISpec specs.Spec
-
-type OCISpecCapabilities specs.LinuxCapabilities
-
 // IsPrivileged returns true if the container is a privileged container.
-func IsPrivileged(s CapabilitiesGetter) bool {
-	if s == nil {
+func IsPrivileged(s *specs.Spec) bool {
+	if s.Process.Capabilities == nil {
 		return false
 	}
-	for _, c := range s.GetCapabilities() {
+
+	// We only make sure that the bounding capabibility set has
+	// CAP_SYS_ADMIN. This allows us to make sure that the container was
+	// actually started as '--privileged', but also allow non-root users to
+	// access the privileged NVIDIA capabilities.
+	for _, c := range s.Process.Capabilities.Bounding {
 		if c == capSysAdmin {
 			return true
 		}
 	}
-
 	return false
 }
-
-func (s OCISpec) GetCapabilities() []string {
-	if s.Process == nil || s.Process.Capabilities == nil {
-		return nil
-	}
-	return (*OCISpecCapabilities)(s.Process.Capabilities).GetCapabilities()
-}
-
-func (c OCISpecCapabilities) GetCapabilities() []string {
-	// We only make sure that the bounding capability set has
-	// CAP_SYS_ADMIN. This allows us to make sure that the container was
-	// actually started as '--privileged', but also allow non-root users to
-	// access the privileged NVIDIA capabilities.
-	return c.Bounding
-}

internal/config/image/privileged_test.go

@@ -1,57 +0,0 @@
-/**
-# Copyright (c) NVIDIA CORPORATION.  All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package image
-
-import (
-	"testing"
-
-	"github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/stretchr/testify/require"
-)
-
-func TestIsPrivileged(t *testing.T) {
-	var tests = []struct {
-		spec     specs.Spec
-		expected bool
-	}{
-		{
-			specs.Spec{
-				Process: &specs.Process{
-					Capabilities: &specs.LinuxCapabilities{
-						Bounding: []string{"CAP_SYS_ADMIN"},
-					},
-				},
-			},
-			true,
-		},
-		{
-			specs.Spec{
-				Process: &specs.Process{
-					Capabilities: &specs.LinuxCapabilities{
-						Bounding: []string{"CAP_SYS_FOO"},
-					},
-				},
-			},
-			false,
-		},
-	}
-	for i, tc := range tests {
-		privileged := IsPrivileged((*OCISpec)(&tc.spec))
-
-		require.Equal(t, tc.expected, privileged, "%d: %v", i, tc)
-	}
-}

internal/config/toml_test.go

@@ -62,7 +62,7 @@ load-kmods = true
 #debug = "/var/log/nvidia-container-runtime.log"
 log-level = "info"
 mode = "auto"
-runtimes = ["runc", "crun"]
+runtimes = ["docker-runc", "runc", "crun"]
 
 [nvidia-container-runtime.modes]
 

internal/discover/cache.go

@@ -23,7 +23,6 @@ type cache struct {
 
 	sync.Mutex
 	devices []Device
-	envVars []EnvVar
 	hooks   []Hook
 	mounts  []Mount
 }
@@ -52,20 +51,6 @@ func (c *cache) Devices() ([]Device, error) {
 	return c.devices, nil
 }
 
-func (c *cache) EnvVars() ([]EnvVar, error) {
-	c.Lock()
-	defer c.Unlock()
-
-	if c.envVars == nil {
-		envVars, err := c.d.EnvVars()
-		if err != nil {
-			return nil, err
-		}
-		c.envVars = envVars
-	}
-	return c.envVars, nil
-}
-
 func (c *cache) Hooks() ([]Hook, error) {
 	c.Lock()
 	defer c.Unlock()

internal/discover/discover.go

@@ -22,12 +22,6 @@ type Device struct {
 	Path     string
 }
 
-// EnvVar represents a discovered environment variable.
-type EnvVar struct {
-	Name  string
-	Value string
-}
-
 // Mount represents a discovered mount.
 type Mount struct {
 	HostPath string
@@ -48,7 +42,6 @@ type Hook struct {
 //go:generate moq -rm -fmt=goimports -stub -out discover_mock.go . Discover
 type Discover interface {
 	Devices() ([]Device, error)
-	EnvVars() ([]EnvVar, error)
 	Mounts() ([]Mount, error)
 	Hooks() ([]Hook, error)
 }

internal/discover/discover_mock.go

@@ -20,9 +20,6 @@ var _ Discover = &DiscoverMock{}
 //			DevicesFunc: func() ([]Device, error) {
 //				panic("mock out the Devices method")
 //			},
-//			EnvVarsFunc: func() ([]EnvVar, error) {
-//				panic("mock out the EnvVars method")
-//			},
 //			HooksFunc: func() ([]Hook, error) {
 //				panic("mock out the Hooks method")
 //			},
@@ -39,9 +36,6 @@ type DiscoverMock struct {
 	// DevicesFunc mocks the Devices method.
 	DevicesFunc func() ([]Device, error)
 
-	// EnvVarsFunc mocks the EnvVars method.
-	EnvVarsFunc func() ([]EnvVar, error)
-
 	// HooksFunc mocks the Hooks method.
 	HooksFunc func() ([]Hook, error)
 
@@ -53,9 +47,6 @@ type DiscoverMock struct {
 		// Devices holds details about calls to the Devices method.
 		Devices []struct {
 		}
-		// EnvVars holds details about calls to the EnvVars method.
-		EnvVars []struct {
-		}
 		// Hooks holds details about calls to the Hooks method.
 		Hooks []struct {
 		}
@@ -64,7 +55,6 @@ type DiscoverMock struct {
 		}
 	}
 	lockDevices sync.RWMutex
-	lockEnvVars sync.RWMutex
 	lockHooks   sync.RWMutex
 	lockMounts  sync.RWMutex
 }
@@ -100,37 +90,6 @@ func (mock *DiscoverMock) DevicesCalls() []struct {
 	return calls
 }
 
-// EnvVars calls EnvVarsFunc.
-func (mock *DiscoverMock) EnvVars() ([]EnvVar, error) {
-	callInfo := struct {
-	}{}
-	mock.lockEnvVars.Lock()
-	mock.calls.EnvVars = append(mock.calls.EnvVars, callInfo)
-	mock.lockEnvVars.Unlock()
-	if mock.EnvVarsFunc == nil {
-		var (
-			envVarsOut []EnvVar
-			errOut     error
-		)
-		return envVarsOut, errOut
-	}
-	return mock.EnvVarsFunc()
-}
-
-// EnvVarsCalls gets all the calls that were made to EnvVars.
-// Check the length with:
-//
-//	len(mockedDiscover.EnvVarsCalls())
-func (mock *DiscoverMock) EnvVarsCalls() []struct {
-} {
-	var calls []struct {
-	}
-	mock.lockEnvVars.RLock()
-	calls = mock.calls.EnvVars
-	mock.lockEnvVars.RUnlock()
-	return calls
-}
-
 // Hooks calls HooksFunc.
 func (mock *DiscoverMock) Hooks() ([]Hook, error) {
 	callInfo := struct {

internal/discover/envvar.go

@@ -1,41 +0,0 @@
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package discover
-
-var _ Discover = (*EnvVar)(nil)
-
-// Devices returns an empty list of devices for a EnvVar discoverer.
-func (e EnvVar) Devices() ([]Device, error) {
-	return nil, nil
-}
-
-// EnvVars returns an empty list of envs for a EnvVar discoverer.
-func (e EnvVar) EnvVars() ([]EnvVar, error) {
-	return []EnvVar{e}, nil
-}
-
-// Mounts returns an empty list of mounts for a EnvVar discoverer.
-func (e EnvVar) Mounts() ([]Mount, error) {
-	return nil, nil
-}
-
-// Hooks allows the Hook type to also implement the Discoverer interface.
-// It returns a single hook
-func (e EnvVar) Hooks() ([]Hook, error) {
-	return nil, nil
-}

internal/discover/first-valid.go

@@ -45,19 +45,6 @@ func (f firstOf) Devices() ([]Device, error) {
 	return nil, errs
 }
 
-func (f firstOf) EnvVars() ([]EnvVar, error) {
-	var errs error
-	for _, d := range f {
-		envs, err := d.EnvVars()
-		if err != nil {
-			errs = errors.Join(errs, err)
-			continue
-		}
-		return envs, nil
-	}
-	return nil, errs
-}
-
 func (f firstOf) Hooks() ([]Hook, error) {
 	var errs error
 	for _, d := range f {

internal/discover/graphics.go

@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/config/image"
@@ -82,25 +81,14 @@ func NewGraphicsMountsDiscoverer(logger logger.Interface, driver *root.Driver, h
 // vulkan ICD files are at {{ .driverRoot }}/vulkan instead of in /etc/vulkan.
 func newVulkanConfigsDiscover(logger logger.Interface, driver *root.Driver) Discover {
 	locator := lookup.First(driver.Configs(), driver.Files())
-
-	required := []string{
-		"vulkan/icd.d/nvidia_icd.json",
-		"vulkan/icd.d/nvidia_layers.json",
-		"vulkan/implicit_layer.d/nvidia_layers.json",
-	}
-	// For some RPM-based driver packages, the vulkan ICD files are installed to
-	// /usr/share/vulkan/icd.d/nvidia_icd.%{_target_cpu}.json
-	// We also include this in the list of candidates for the ICD file.
-	switch runtime.GOARCH {
-	case "amd64":
-		required = append(required, "vulkan/icd.d/nvidia_icd.x86_64.json")
-	case "arm64":
-		required = append(required, "vulkan/icd.d/nvidia_icd.aarch64.json")
-	}
 	return &mountsToContainerPath{
-		logger:        logger,
-		locator:       locator,
-		required:      required,
+		logger:  logger,
+		locator: locator,
+		required: []string{
+			"vulkan/icd.d/nvidia_icd.json",
+			"vulkan/icd.d/nvidia_layers.json",
+			"vulkan/implicit_layer.d/nvidia_layers.json",
+		},
 		containerRoot: "/etc",
 	}
 }

internal/discover/graphics_test.go

@@ -25,7 +25,7 @@ import (
 
 func TestGraphicsLibrariesDiscoverer(t *testing.T) {
 	logger, _ := testlog.NewNullLogger()
-	hookCreator := NewHookCreator()
+	hookCreator := NewHookCreator("/usr/bin/nvidia-cdi-hook", false)
 
 	testCases := []struct {
 		description    string

internal/discover/hooks.go

@@ -23,36 +23,6 @@ import (
 	"tags.cncf.io/container-device-interface/pkg/cdi"
 )
 
-// A HookName represents a supported CDI hooks.
-type HookName string
-
-const (
-	// AllHooks is a special hook name that allows all hooks to be matched.
-	AllHooks = HookName("all")
-
-	// A ChmodHook is used to set the file mode of the specified paths.
-	// Deprecated: The chmod hook is deprecated and will be removed in a future release.
-	ChmodHook = HookName("chmod")
-	// A CreateSymlinksHook is used to create symlinks in the container.
-	CreateSymlinksHook = HookName("create-symlinks")
-	// DisableDeviceNodeModificationHook refers to the hook used to ensure that
-	// device nodes are not created by libnvidia-ml.so or nvidia-smi in a
-	// container.
-	// Added in v1.17.8
-	DisableDeviceNodeModificationHook = HookName("disable-device-node-modification")
-	// An EnableCudaCompatHook is used to enabled CUDA Forward Compatibility.
-	// Added in v1.17.5
-	EnableCudaCompatHook = HookName("enable-cuda-compat")
-	// An UpdateLDCacheHook is the hook used to update the ldcache in the
-	// container. This allows injected libraries to be discoverable.
-	UpdateLDCacheHook = HookName("update-ldcache")
-	// A CreateSonameSymlinksHook is the hook used to ensure that soname symlinks
-	// for injected libraries exist in the container.
-	CreateSonameSymlinksHook = HookName("create-soname-symlinks")
-
-	defaultNvidiaCDIHookPath = "/usr/bin/nvidia-cdi-hook"
-)
-
 var _ Discover = (*Hook)(nil)
 
 // Devices returns an empty list of devices for a Hook discoverer.
@@ -60,11 +30,6 @@ func (h *Hook) Devices() ([]Device, error) {
 	return nil, nil
 }
 
-// EnvVars returns an empty list of envs for a Hook discoverer.
-func (h *Hook) EnvVars() ([]EnvVar, error) {
-	return nil, nil
-}
-
 // Mounts returns an empty list of mounts for a Hook discoverer.
 func (h *Hook) Mounts() ([]Mount, error) {
 	return nil, nil
@@ -80,130 +45,52 @@ func (h *Hook) Hooks() ([]Hook, error) {
 	return []Hook{*h}, nil
 }
 
-type Option func(*cdiHookCreator)
+// Option is a function that configures the nvcdilib
+type Option func(*CDIHook)
 
-type cdiHookCreator struct {
+type CDIHook struct {
 	nvidiaCDIHookPath string
-	disabledHooks     map[HookName]bool
-
-	fixedArgs    []string
-	debugLogging bool
+	debugLogging      bool
 }
 
-// An allDisabledHookCreator is a HookCreator that does not create any hooks.
-type allDisabledHookCreator struct{}
-
-// Create returns nil for all hooks for an allDisabledHookCreator.
-func (a *allDisabledHookCreator) Create(name HookName, args ...string) *Hook {
-	return nil
-}
-
-// A HookCreator defines an interface for creating discover hooks.
 type HookCreator interface {
-	Create(HookName, ...string) *Hook
+	Create(string, ...string) *Hook
 }
 
-// WithDisabledHooks sets the set of hooks that are disabled for the CDI hook creator.
-// This can be specified multiple times.
-func WithDisabledHooks(hooks ...HookName) Option {
-	return func(c *cdiHookCreator) {
-		for _, hook := range hooks {
-			c.disabledHooks[hook] = true
+func NewHookCreator(nvidiaCDIHookPath string, debugLogging bool) HookCreator {
+	CDIHook := &CDIHook{
+		nvidiaCDIHookPath: nvidiaCDIHookPath,
+		debugLogging:      debugLogging,
+	}
+
+	return CDIHook
+}
+
+func (c CDIHook) Create(name string, args ...string) *Hook {
+	if name == "create-symlinks" {
+		if len(args) == 0 {
+			return nil
 		}
-	}
-}
 
-// WithNVIDIACDIHookPath sets the path to the nvidia-cdi-hook binary.
-func WithNVIDIACDIHookPath(nvidiaCDIHookPath string) Option {
-	return func(c *cdiHookCreator) {
-		c.nvidiaCDIHookPath = nvidiaCDIHookPath
-	}
-}
-
-func NewHookCreator(opts ...Option) HookCreator {
-	cdiHookCreator := &cdiHookCreator{
-		nvidiaCDIHookPath: defaultNvidiaCDIHookPath,
-		disabledHooks:     make(map[HookName]bool),
-	}
-	for _, opt := range opts {
-		opt(cdiHookCreator)
-	}
-
-	if cdiHookCreator.disabledHooks[AllHooks] {
-		return &allDisabledHookCreator{}
-	}
-
-	cdiHookCreator.fixedArgs = getFixedArgsForCDIHookCLI(cdiHookCreator.nvidiaCDIHookPath)
-
-	return cdiHookCreator
-}
-
-// Create creates a new hook with the given name and arguments.
-// If a hook is disabled, a nil hook is returned.
-func (c cdiHookCreator) Create(name HookName, args ...string) *Hook {
-	if c.isDisabled(name, args...) {
-		return nil
+		links := []string{}
+		for _, arg := range args {
+			links = append(links, "--link", arg)
+		}
+		args = links
 	}
 
 	return &Hook{
 		Lifecycle: cdi.CreateContainerHook,
 		Path:      c.nvidiaCDIHookPath,
-		Args:      append(c.requiredArgs(name), c.transformArgs(name, args...)...),
+		Args:      append(c.requiredArgs(name), args...),
 		Env:       []string{fmt.Sprintf("NVIDIA_CTK_DEBUG=%v", c.debugLogging)},
 	}
 }
 
-// isDisabled checks if the specified hook name is disabled.
-func (c cdiHookCreator) isDisabled(name HookName, args ...string) bool {
-	if c.disabledHooks[name] {
-		return true
-	}
-
-	switch name {
-	case CreateSymlinksHook:
-		if len(args) == 0 {
-			return true
-		}
-	case ChmodHook:
-		if len(args) == 0 {
-			return true
-		}
-	}
-	return false
-}
-
-func (c cdiHookCreator) requiredArgs(name HookName) []string {
-	return append(c.fixedArgs, string(name))
-}
-
-func (c cdiHookCreator) transformArgs(name HookName, args ...string) []string {
-	switch name {
-	case CreateSymlinksHook:
-		var transformedArgs []string
-		for _, arg := range args {
-			transformedArgs = append(transformedArgs, "--link", arg)
-		}
-		return transformedArgs
-	case ChmodHook:
-		var transformedArgs = []string{"--mode", "755"}
-		for _, arg := range args {
-			transformedArgs = append(transformedArgs, "--path", arg)
-		}
-		return transformedArgs
-	default:
-		return args
-	}
-}
-
-// getFixedArgsForCDIHookCLI returns the fixed arguments for the hook CLI.
-// If the nvidia-ctk binary is used, hooks are implemented under the hook
-// subcommand.
-// For the nvidia-cdi-hook binary, the hooks are implemented as subcommands of
-// the top-level CLI.
-func getFixedArgsForCDIHookCLI(nvidiaCDIHookPath string) []string {
-	base := filepath.Base(nvidiaCDIHookPath)
+func (c CDIHook) requiredArgs(name string) []string {
+	base := filepath.Base(c.nvidiaCDIHookPath)
 	if base == "nvidia-ctk" {
-		return []string{base, "hook"}
+		return []string{base, "hook", name}
 	}
-	return []string{base}
+	return []string{base, name}
 }

internal/discover/ldconfig.go

@@ -51,24 +51,30 @@ func (d ldconfig) Hooks() ([]Hook, error) {
 		return nil, fmt.Errorf("failed to discover mounts for ldcache update: %v", err)
 	}
 
-	var args []string
-
-	if d.ldconfigPath != "" {
-		args = append(args, "--ldconfig-path", d.ldconfigPath)
-	}
-
-	for _, f := range uniqueFolders(getLibraryPaths(mounts)) {
-		args = append(args, "--folder", f)
-	}
-
-	h := Merge(
-		d.hookCreator.Create(CreateSonameSymlinksHook, args...),
-		d.hookCreator.Create(UpdateLDCacheHook, args...),
+	h := createLDCacheUpdateHook(
+		d.hookCreator,
+		d.ldconfigPath,
+		getLibraryPaths(mounts),
 	)
 
 	return h.Hooks()
 }
 
+// createLDCacheUpdateHook locates the NVIDIA Container Toolkit CLI and creates a hook for updating the LD Cache
+func createLDCacheUpdateHook(hookCreator HookCreator, ldconfig string, libraries []string) *Hook {
+	var args []string
+
+	if ldconfig != "" {
+		args = append(args, "--ldconfig-path", ldconfig)
+	}
+
+	for _, f := range uniqueFolders(libraries) {
+		args = append(args, "--folder", f)
+	}
+
+	return hookCreator.Create("update-ldcache", args...)
+}
+
 // getLibraryPaths extracts the library dirs from the specified mounts
 func getLibraryPaths(mounts []Mount) []string {
 	var paths []string

internal/discover/ldconfig_test.go

@@ -31,7 +31,7 @@ const (
 
 func TestLDCacheUpdateHook(t *testing.T) {
 	logger, _ := testlog.NewNullLogger()
-	hookCreator := NewHookCreator(WithNVIDIACDIHookPath(testNvidiaCDIHookPath))
+	hookCreator := NewHookCreator(testNvidiaCDIHookPath, false)
 
 	testCases := []struct {
 		description   string
@@ -39,24 +39,11 @@ func TestLDCacheUpdateHook(t *testing.T) {
 		mounts        []Mount
 		mountError    error
 		expectedError error
-		expectedHooks []Hook
+		expectedArgs  []string
 	}{
 		{
-			description: "empty mounts",
-			expectedHooks: []Hook{
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "create-soname-symlinks"},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "update-ldcache"},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-			},
+			description:  "empty mounts",
+			expectedArgs: []string{"nvidia-cdi-hook", "update-ldcache"},
 		},
 		{
 			description:   "mount error",
@@ -79,20 +66,7 @@ func TestLDCacheUpdateHook(t *testing.T) {
 					Path: "/usr/local/lib/libbar.so",
 				},
 			},
-			expectedHooks: []Hook{
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "create-soname-symlinks", "--folder", "/usr/local/lib", "--folder", "/usr/local/libother"},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "update-ldcache", "--folder", "/usr/local/lib", "--folder", "/usr/local/libother"},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-			},
+			expectedArgs: []string{"nvidia-cdi-hook", "update-ldcache", "--folder", "/usr/local/lib", "--folder", "/usr/local/libother"},
 		},
 		{
 			description: "host paths are ignored",
@@ -102,38 +76,12 @@ func TestLDCacheUpdateHook(t *testing.T) {
 					Path:     "/usr/local/lib/libfoo.so",
 				},
 			},
-			expectedHooks: []Hook{
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "create-soname-symlinks", "--folder", "/usr/local/lib"},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "update-ldcache", "--folder", "/usr/local/lib"},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-			},
+			expectedArgs: []string{"nvidia-cdi-hook", "update-ldcache", "--folder", "/usr/local/lib"},
 		},
 		{
 			description:  "explicit ldconfig path is passed",
 			ldconfigPath: testLdconfigPath,
-			expectedHooks: []Hook{
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "create-soname-symlinks", "--ldconfig-path", testLdconfigPath},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-				{
-					Lifecycle: "createContainer",
-					Path:      testNvidiaCDIHookPath,
-					Args:      []string{"nvidia-cdi-hook", "update-ldcache", "--ldconfig-path", testLdconfigPath},
-					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
-				},
-			},
+			expectedArgs: []string{"nvidia-cdi-hook", "update-ldcache", "--ldconfig-path", testLdconfigPath},
 		},
 	}
 
@@ -144,6 +92,13 @@ func TestLDCacheUpdateHook(t *testing.T) {
 					return tc.mounts, tc.mountError
 				},
 			}
+			expectedHook := Hook{
+				Path:      testNvidiaCDIHookPath,
+				Args:      tc.expectedArgs,
+				Lifecycle: "createContainer",
+				Env:       []string{"NVIDIA_CTK_DEBUG=false"},
+			}
+
 			d, err := NewLDCacheUpdateHook(logger, mountMock, hookCreator, tc.ldconfigPath)
 			require.NoError(t, err)
 
@@ -157,7 +112,9 @@ func TestLDCacheUpdateHook(t *testing.T) {
 			}
 
 			require.NoError(t, err)
-			require.EqualValues(t, tc.expectedHooks, hooks)
+			require.Len(t, hooks, 1)
+
+			require.EqualValues(t, hooks[0], expectedHook)
 
 			devices, err := d.Devices()
 			require.NoError(t, err)

internal/discover/list.go

@@ -53,21 +53,6 @@ func (d list) Devices() ([]Device, error) {
 	return allDevices, nil
 }
 
-// EnvVars returns all environment variables from the included discoverers.
-func (d list) EnvVars() ([]EnvVar, error) {
-	var allEnvs []EnvVar
-
-	for i, di := range d {
-		envs, err := di.EnvVars()
-		if err != nil {
-			return nil, fmt.Errorf("error discovering envs for discoverer %v: %w", i, err)
-		}
-		allEnvs = append(allEnvs, envs...)
-	}
-
-	return allEnvs, nil
-}
-
 // Mounts returns all mounts from the included discoverers
 func (d list) Mounts() ([]Mount, error) {
 	var allMounts []Mount

internal/discover/none.go

@@ -27,11 +27,6 @@ func (e None) Devices() ([]Device, error) {
 	return nil, nil
 }
 
-// EnvVars returns an empty list of devices
-func (e None) EnvVars() ([]EnvVar, error) {
-	return nil, nil
-}
-
 // Mounts returns an empty list of mounts
 func (e None) Mounts() ([]Mount, error) {
 	return nil, nil

internal/discover/symlinks_test.go

@@ -113,7 +113,7 @@ func TestWithWithDriverDotSoSymlinks(t *testing.T) {
 			expectedHooks: []Hook{
 				{
 					Lifecycle: "createContainer",
-					Path:      "/usr/bin/nvidia-cdi-hook",
+					Path:      "/path/to/nvidia-cdi-hook",
 					Args:      []string{"nvidia-cdi-hook", "create-symlinks", "--link", "libcuda.so.1::/usr/lib/libcuda.so"},
 					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
 				},
@@ -146,7 +146,7 @@ func TestWithWithDriverDotSoSymlinks(t *testing.T) {
 			expectedHooks: []Hook{
 				{
 					Lifecycle: "createContainer",
-					Path:      "/usr/bin/nvidia-cdi-hook",
+					Path:      "/path/to/nvidia-cdi-hook",
 					Args:      []string{"nvidia-cdi-hook", "create-symlinks", "--link", "libcuda.so.1::/usr/lib/libcuda.so"},
 					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
 				},
@@ -178,7 +178,7 @@ func TestWithWithDriverDotSoSymlinks(t *testing.T) {
 			expectedHooks: []Hook{
 				{
 					Lifecycle: "createContainer",
-					Path:      "/usr/bin/nvidia-cdi-hook",
+					Path:      "/path/to/nvidia-cdi-hook",
 					Args:      []string{"nvidia-cdi-hook", "create-symlinks", "--link", "libcuda.so.1::/usr/lib/libcuda.so"},
 					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
 				},
@@ -248,7 +248,7 @@ func TestWithWithDriverDotSoSymlinks(t *testing.T) {
 				},
 				{
 					Lifecycle: "createContainer",
-					Path:      "/usr/bin/nvidia-cdi-hook",
+					Path:      "/path/to/nvidia-cdi-hook",
 					Args:      []string{"nvidia-cdi-hook", "create-symlinks", "--link", "libcuda.so.1::/usr/lib/libcuda.so"},
 					Env:       []string{"NVIDIA_CTK_DEBUG=false"},
 				},
@@ -298,7 +298,7 @@ func TestWithWithDriverDotSoSymlinks(t *testing.T) {
 			expectedHooks: []Hook{
 				{
 					Lifecycle: "createContainer",
-					Path:      "/usr/bin/nvidia-cdi-hook",
+					Path:      "/path/to/nvidia-cdi-hook",
 					Args: []string{
 						"nvidia-cdi-hook", "create-symlinks",
 						"--link", "libcuda.so.1::/usr/lib/libcuda.so",
@@ -311,7 +311,7 @@ func TestWithWithDriverDotSoSymlinks(t *testing.T) {
 		},
 	}
 
-	hookCreator := NewHookCreator()
+	hookCreator := NewHookCreator("/path/to/nvidia-cdi-hook", false)
 	for _, tc := range testCases {
 		t.Run(tc.description, func(t *testing.T) {
 			d := WithDriverDotSoSymlinks(

internal/edits/edits.go

@@ -55,11 +55,6 @@ func FromDiscoverer(d discover.Discover) (*cdi.ContainerEdits, error) {
 		return nil, fmt.Errorf("failed to discover devices: %v", err)
 	}
 
-	envs, err := d.EnvVars()
-	if err != nil {
-		return nil, fmt.Errorf("failed to discover environment variables: %w", err)
-	}
-
 	mounts, err := d.Mounts()
 	if err != nil {
 		return nil, fmt.Errorf("failed to discover mounts: %v", err)
@@ -79,10 +74,6 @@ func FromDiscoverer(d discover.Discover) (*cdi.ContainerEdits, error) {
 		c.Append(edits)
 	}
 
-	for _, e := range envs {
-		c.Append(envvar(e).toEdits())
-	}
-
 	for _, m := range mounts {
 		c.Append(mount(m).toEdits())
 	}

internal/edits/envvar.go

@@ -1,39 +0,0 @@
-/**
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-**/
-
-package edits
-
-import (
-	"fmt"
-
-	"tags.cncf.io/container-device-interface/pkg/cdi"
-	"tags.cncf.io/container-device-interface/specs-go"
-
-	"github.com/NVIDIA/nvidia-container-toolkit/internal/discover"
-)
-
-type envvar discover.EnvVar
-
-// toEdits converts a discovered envvar to CDI Container Edits.
-func (d envvar) toEdits() *cdi.ContainerEdits {
-	e := cdi.ContainerEdits{
-		ContainerEdits: &specs.ContainerEdits{
-			Env: []string{fmt.Sprintf("%s=%s", d.Name, d.Value)},
-		},
-	}
-	return &e
-}