mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-26 07:30:19 +00:00
f4b0e1a88c
Replace the broad libnv*/libcuda.so.* globs in chisseled_compute() with nvidia_driver_capabilities(), a jq-based helper that queries the driver-authoritative sandboxutils-filelist.json shipped at usr/share/nvidia/files.d/ in every NVIDIA driver install. The function accepts a file type (LIB, BINARY, ICD, FIRMWARE, ...) and a list of capability categories, so the same filelist drives selection of libs, binaries, and ICD registration files consistently. Categories selected for LIB: cuda, opencl, nvml, nvpd, video, nvsandboxutils. Graphics categories (egl*, glx, vulkan, ngx, optix, gbm, utils, xdriver) are excluded, kata runs headless workloads only. libnvidia-allocator is trusted to be graphics-only as the filelist declares: no compute library (libcuda, libnvidia-ml, libnvidia-gpucomp, libnvidia-opencl) references it, only libnvidia-eglcore and libnvidia-glcore do, and its gbm backend role is display buffer allocation. No compute-side override is carried. Also fixes two gaps the old explicit copy list had missed: nvidia-cuda-mps-control/server missing despite being cuda category nvidia.icd missing, needed for OpenCL discovery Saves ~208 MB in usr/lib before strip/UPX: libnvoptix.so 46.8 MB OptiX ray tracing libnvidia-rtcore.so 40.1 MB ray tracing libnvidia-glcore.so 38.0 MB OpenGL libnvidia-eglcore.so 36.1 MB EGL libnvperf_dcgm_host.so 17.9 MB Nsight profiling SDK libnvidia-vksc-core.so 10.6 MB Vulkan SC libnvidia-glvkspirv.so 9.9 MB Vulkan SPIR-V libnvidia-pkcs11* is copied unconditionally: the gpu extension is built without a type tag, so any confidential-only gate strips the TEE attestation libs from extension images. The old explicit conditional also used the wrong libdir (lib/ instead of usr/lib/) and was dead code; it is removed. The libs cost a few hundred KB and the monolith split will make the distinction moot anyway. The capability arrays are validated to be non-empty after extraction: failures inside the mapfile process substitutions do not propagate under set -e, and an empty selection must fail the build instead of producing a rootfs with no NVIDIA userspace. Assisted-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>