github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-10 07:05:51 +00:00
Code Issues Projects Releases Wiki Activity

fixup! build: split NVIDIA rootfs into base-nvidia image + gpu addon

Browse Source
This commit is contained in:
Fabiano Fidêncio
2026-06-11 13:25:31 +02:00
parent a80d9152d2
commit 331af65a9d
1 changed files with 33 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh
View File

@@ -521,6 +521,38 @@ partition_base() {
mkdir -p lib/modules
}
# NVRC opens every cold-plugged addon (the gpu addon always, and the coco addon
# on confidential guests) as a dm-verity device by exec'ing /usr/sbin/veritysetup
# before mounting it. The base-nvidia image is the one that boots and runs NVRC,
# so it must carry veritysetup and its shared-library closure unconditionally -
# regardless of whether the guest is confidential (copy_cdh_runtime_deps only
# ships cryptsetup, and only on confidential builds). Runs inside ${ROOTFS_DIR}.
chisseled_veritysetup() {
echo "nvidia: chisseling veritysetup"
local libdir="lib/${machine_arch}-linux-gnu"
# NVRC execs the absolute path /usr/sbin/veritysetup; cryptsetup-bin is
# installed in the (usr-merged) stage-one, so /sbin/veritysetup resolves to
# the real binary there.
mkdir -p usr/sbin
cp -a "${stage_one}/sbin/veritysetup" usr/sbin/.
# veritysetup -> libcryptsetup runtime closure (same set cryptsetup links).
cp -a "${stage_one}/${libdir}"/libcryptsetup.so.12* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libpopt.so.0* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libuuid.so.1* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libblkid.so.1* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libdevmapper.so.1.02.1* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libcrypto.so.3* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libargon2.so.1* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libjson-c.so.5* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libselinux.so.1* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libudev.so.1* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libpcre2-8.so.0* "${libdir}/."
cp -a "${stage_one}/${libdir}"/libcap.so.2* "${libdir}/."
}
setup_nvidia_gpu_rootfs_stage_two() {
readonly stage_two="${ROOTFS_DIR:?}"
readonly stack="${NVIDIA_GPU_STACK:?}"
@@ -585,7 +617,7 @@ setup_nvidia_gpu_rootfs_stage_two() {
# Carve the freshly chiseled (monolith) tree into the requested layout.
# The monolith path is left untouched.
case "${layout}" in
base) partition_base ;;
base) partition_base; chisseled_veritysetup ;;
gpu-addon) partition_gpu_addon ;;
esac
fi