What's Changed
NOTE: This release is a unified release of the NVIDIA Container Toolkit that consists of the following packages:
The packages for this release are published to the libnvidia-container package repositories.
Fixes and Features
- CDI specifications can now include an application-profile hook that limits EGL and Vulkan visibility to the GPUs assigned to the container. Graphics applications no longer see unassigned host GPUs through these APIs. For more information, refer to issue #1899 and PR #1939.
- CUDA compatibility handling now uses libcuda.so ELF metadata whenever it is available. This improves CUDA minor-version compatibility by selecting the container’s compatibility libraries only when they are appropriate for the installed driver.
- Driver file discovery now supports libraries spread across multiple directories, as occurs on distributions such as Debian, and matches graphics libraries against the exact installed driver version. This fix avoids both missing required libraries and injecting libraries from another installed driver version. For information about multiple-directory discovery, refer to issue #1559 and PR #1820. For information about exact-version matching, refer to PR #1948.
- CDI specifications now include the NVIDIA OpenCL ICD file and the legacy libnvidia-nvvm70.so library when present. OpenCL loaders can locate the NVIDIA implementation, and workloads that depend on the legacy NVVM library receive it automatically. For information about OpenCL support, refer to issue #682 and PR #1893. For information about legacy NVVM support, refer to issue #1875 and PR #1876.
- On WSL2, CDI discovery now includes additional .so, .bin, and .dll files from the NVIDIA driver store instead of relying only on a fixed file list. This fix enables containers to receive driver components introduced by newer Windows driver releases without waiting for a toolkit-specific allowlist update. For more information, refer to issue #1864 and PR #1890.
- IMEX channel requests in CDI and JIT-CDI mode are now validated for both the supported ID range and the presence of the corresponding host device. Invalid requests fail with a clear error. For more information, refer to issue #1309 and PR #1913.
- JIT-CDI mode now honors the nvidia-container-runtime.modes.jit-cdi.nvcdi-disable-hooks configuration option. You can disable individual CDI hooks for environments where a generated hook is unnecessary or incompatible.
- Updating config.toml no longer reverts previously modified options to their defaults.
- CDI generation no longer adds an update-ldcache hook when it discovers no driver libraries. This fix prevents containers from running an unnecessary hook and avoids failures on systems or modes that do not inject libraries. For more information, refer to issue #373 and PR #1894.
- Fixed an issue where NVIDIA runtime handlers in a generated containerd drop-in configuration could omit runtime_type when the base configuration did not define it. The affected containers failed to start with a container.Runtime.Name must be set error. The toolkit now sets the default runtime type when the field is missing or empty. For more information, refer to issue #1956 and PR #1969.
Packaging Changes
- RPMs rebuilt by the toolkit packaging image now use XZ payload compression instead of zstd. The resulting packages can be installed on older Linux distributions that do not support zstd compression, such as Amazon Linux 2.
- Source package builds can use Podman by setting DOCKER=podman. The build handles Podman’s local image naming, SELinux volume labeling, and artifact-directory creation automatically.
Enhancements to container-toolkit Container Image
- The container-toolkit image now uses the non-development distroless base and includes a static BusyBox shell. Init-container wrappers and lifecycle hooks retain the shell commands they need without depending on the development image.
- The NRI plugin can inject ordinary workload CDI devices outside the toolkit namespace. For management devices, you can authorize additional namespaces with the --nri-management-cdi-device-namespaces option or the NRI_MANAGEMENT_CDI_DEVICE_NAMESPACES environment variable, enabling centralized management workloads without granting access cluster-wide.
- The toolkit installer now installs nvidia-cdi-hook instead of wrapping it with a shell script. NRI-based deployments can invoke the hook on hosts that do not provide a shell.
Full Changelog: v1.19.1...v1.20.0