What's Changed
NOTE: This release is a unified release of the NVIDIA Container Toolkit that consists of the following packages:
The packages for this release are published to the libnvidia-container package repositories.
Fixes and Features
- CDI specifications and JIT-CDI mode now inject MIG management capability devices into containers. Set the NVIDIA_MIG_CONFIG_DEVICES or NVIDIA_MIG_MONITOR_DEVICES environment variable to all in a container with CAP_SYS_ADMIN to inject the /dev/nvidia-caps/ device nodes for MIG partition management. For supported values and constraints, refer to MIG Management Devices. For more information, refer to issue #1740 and PR #1947.
- Containers can now enforce soft and hard per-GPU CUDA memory limits. Set the NVIDIA_GPU_MEMORY_REQUEST and NVIDIA_GPU_MEMORY_LIMIT environment variables in MiB to control the limits. This feature requires an R615 or later driver. For more information, refer to PR #2075.
- Containers running with an R615 or later driver now receive the GPU firmware files that the driver requires at runtime. CDI specifications include the ucode_*.bin files automatically. For more information, refer to PR #2095.
- The nvidia-ctk runtime configure command now preserves existing Docker feature flags when enabling CDI. Previously, running the command could overwrite flags such as containerd-snapshotter. For more information, refer to PR #2049.
- Fixed an intermittent EBADF error in the create-symlinks hook that caused container creation to fail on busy hosts. The error occurred when the garbage collector closed a file descriptor while a system call was in progress. For more information, refer to PR #2082.
- Fixed a regression in the update-ldcache hook that caused container creation to fail under gVisor. The hook now uses a sealed memfd to execute ldconfig, which avoids mounting /proc inside the container root. For more information, refer to PR #2059.
- On WSL2, setting NVIDIA_VISIBLE_DEVICES=none now correctly prevents GPU device injection. For more information, refer to PR #2025.
- Fixed NVIDIA X.Org driver module mount paths so that containers render correctly when the host uses a custom ModulePath in xorg.conf.d. For more information, refer to PR #1980.
- GPU devices are now available in the CDI specification on first boot. The nvidia-cdi-refresh systemd service creates NVIDIA control device nodes before generating the specification. For more information, refer to PR #1979.
- GPU containers that start at boot no longer fail due to missing device nodes. The nvidia-cdi-refresh service is now ordered before Docker, containerd, and CRI-O. For more information, refer to PR #2019.
- Containers on read-only filesystems no longer fail to start when the application profile cannot be updated. The update-application-profile hook now ignores read-only filesystem errors. For more information, refer to PR #2028.
- Fixed malformed hook scratch directory names that could prevent hooks from running correctly. For more information, refer to PR #2042.
- Containers running under crun with user namespaces no longer encounter permission errors when resolving the rootfs path. The OCI state parser now uses the non-standard root field from crun. For more information, refer to PR #1971.
Full Changelog: v1.20.0...v1.20.1