Skip to content

feat(gpu): derive sandbox requirements from CDI specs#2265

Draft
elezar wants to merge 8 commits into
mainfrom
feat/1606-derive-cdi-sandbox-requirements/elezar
Draft

feat(gpu): derive sandbox requirements from CDI specs#2265
elezar wants to merge 8 commits into
mainfrom
feat/1606-derive-cdi-sandbox-requirements/elezar

Conversation

@elezar

@elezar elezar commented Jul 14, 2026

Copy link
Copy Markdown
Member

Summary

Derive sandbox filesystem and process requirements from resolved CDI GPU specs so Docker GPU sandboxes can carry the effective device, mount, and group policy into the supervisor.

Related Issue

Related: #1606

Changes

  • Add shared CDI context and resolver helpers for policy-relevant device nodes, mounts, and additional GIDs.
  • Upload Docker CDI context/spec mounts when GPU CDI devices are selected.
  • Enrich sandbox policies with CDI-derived paths and supplemental process groups.
  • Apply CDI-derived additional GIDs before dropping supervisor privileges.
  • Add architecture and user-facing documentation for CDI-derived GPU sandbox policy behavior.

Testing

  • mise run pre-commit passes
  • Unit tests added/updated
  • E2E tests added/updated (if applicable)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

@copy-pr-bot

copy-pr-bot Bot commented Jul 14, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

elezar added 3 commits July 14, 2026 15:13
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
@elezar elezar force-pushed the feat/1606-derive-cdi-sandbox-requirements/elezar branch from 61d751d to c8ebad0 Compare July 14, 2026 13:18
@github-actions

Copy link
Copy Markdown

Signed-off-by: Evan Lezar <elezar@nvidia.com>
@elezar elezar force-pushed the feat/1606-derive-cdi-sandbox-requirements/elezar branch from c8ebad0 to c0b537b Compare July 14, 2026 13:22
elezar added 4 commits July 14, 2026 16:04
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant