]> git.proxmox.com Git - mirror_lxc.git/blobdiff - hooks/nvidia
spelling: timeout
[mirror_lxc.git] / hooks / nvidia
index 614c9e191faac9a804d9eaa9455e7d3386b641a8..d0bdbf51e3f7ca5cd1924ba6a640f3af0bc1ee22 100755 (executable)
@@ -1,14 +1,49 @@
 #! /bin/bash
-
-# Copyright (c) 2017, NVIDIA CORPORATION. All rights reserved.
+#
+# Copyright (c) 2017, 2018 NVIDIA CORPORATION.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 set -eu
 
-if [ -z "${CUDA_VERSION+x}" ] && [ -z "${NVIDIA_VISIBLE_DEVICES+x}" ]; then
-    # Not a GPU container, nothing to do, exit early.
+# NVIDIA_VISIBLE_DEVICES="" *or* NVIDIA_VISIBLE_DEVICES="void"
+# GPU support was explicitly disabled, exit early.
+if [ -z "${NVIDIA_VISIBLE_DEVICES-x}" ] || [ "${NVIDIA_VISIBLE_DEVICES:-}" = "void" ]; then
     exit 0
 fi
 
+# https://github.com/nvidia/nvidia-container-runtime#cuda_version
+if [ -n "${CUDA_VERSION:-}" ] && [ -z "${NVIDIA_REQUIRE_CUDA:-}" ]; then
+    # Legacy CUDA image: default to all devices and all driver capabilities.
+    if [ -z "${NVIDIA_VISIBLE_DEVICES+x}" ]; then
+       NVIDIA_VISIBLE_DEVICES="all"
+    fi
+    if [ -z "${NVIDIA_DRIVER_CAPABILITIES:-}" ]; then
+       NVIDIA_DRIVER_CAPABILITIES="all"
+    fi
+    if [[ "${CUDA_VERSION}" =~ ^[0-9]+\.[0-9]+ ]]; then
+        NVIDIA_REQUIRE_CUDA="cuda>=${BASH_REMATCH[0]}"
+    fi
+else
+    # NVIDIA_VISIBLE_DEVICES unset and it's not a legacy CUDA image.
+    # This is not a GPU image, exit early.
+    if [ -z "${NVIDIA_VISIBLE_DEVICES+x}" ]; then
+       exit 0
+    fi
+fi
+
 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
 if ! which nvidia-container-cli >/dev/null; then
     echo "ERROR: Missing tool nvidia-container-cli, see https://github.com/NVIDIA/libnvidia-container" >&2
@@ -37,6 +72,7 @@ capability_to_cli() {
     case "$1" in
         compute)  echo "--compute";;
         compat32) echo "--compat32";;
+        display)  echo "--display";;
         graphics) echo "--graphics";;
         utility)  echo "--utility";;
         video)    echo "--video";;
@@ -66,12 +102,14 @@ Optional arguments:
 [ --no-load-kmods ]: Do not try to load the NVIDIA kernel modules.
 [ --disable-require ]: Disable all the constraints of the form NVIDIA_REQUIRE_*.
 [ --debug <path> ]: The path to the log file.
+[ --ldcache <path> ]: The path to the host system's DSO cache.
+[ --root <path> ]: The path to the driver root directory.
 [ --ldconfig <path> ]: The path to the ldconfig binary, use a '@' prefix for a host path.
 EOF
     return 0
 }
 
-options=$(getopt -o h -l help,no-load-kmods,disable-require,debug:,ldconfig: -- "$@")
+options=$(getopt -o h -l help,no-load-kmods,disable-require,debug:,ldcache:,root:,ldconfig: -- "$@")
 if [ $? -ne 0 ]; then
     usage
     exit 1
@@ -81,6 +119,8 @@ eval set -- "$options"
 CLI_LOAD_KMODS="true"
 CLI_DISABLE_REQUIRE="false"
 CLI_DEBUG=
+CLI_LDCACHE=
+CLI_ROOT=
 CLI_LDCONFIG=
 
 while :; do
@@ -89,6 +129,8 @@ while :; do
         --no-load-kmods)    CLI_LOAD_KMODS="false"; shift 1;;
         --disable-require)  CLI_DISABLE_REQUIRE="true"; shift 1;;
         --debug)            CLI_DEBUG=$2; shift 2;;
+        --ldcache)          CLI_LDCACHE=$2; shift 2;;
+        --root)             CLI_ROOT=$2; shift 2;;
         --ldconfig)         CLI_LDCONFIG=$2; shift 2;;
         --)                 shift 1; break;;
         *)                  break;;
@@ -128,7 +170,7 @@ if [ "${USERNS}" = "yes" ]; then
 fi
 
 # https://github.com/nvidia/nvidia-container-runtime#nvidia_disable_require
-if [ -n "${NVIDIA_DISABLE_REQUIRE+x}" ]; then
+if [ -n "${NVIDIA_DISABLE_REQUIRE:-}" ]; then
     if [ "$(parse_bool "${NVIDIA_DISABLE_REQUIRE}")" = "true" ]; then
         CLI_DISABLE_REQUIRE="true"
     fi
@@ -152,15 +194,12 @@ if [ -z "${CLI_LDCONFIG}" ]; then
 fi
 
 # https://github.com/nvidia/nvidia-container-runtime#nvidia_visible_devices
-CLI_DEVICES=
-if [ -n "${NVIDIA_VISIBLE_DEVICES+x}" ]; then
-    CLI_DEVICES="${NVIDIA_VISIBLE_DEVICES}"
-fi
+CLI_DEVICES="${NVIDIA_VISIBLE_DEVICES}"
 
 # https://github.com/nvidia/nvidia-container-runtime#nvidia_driver_capabilities
 CLI_CAPABILITIES=
-if [ -n "${NVIDIA_DRIVER_CAPABILITIES+x}" ]; then
-    CLI_CAPABILITIES="${NVIDIA_DRIVER_CAPABILITIES//,/ }"
+if [ -n "${NVIDIA_DRIVER_CAPABILITIES:-}" ]; then
+     CLI_CAPABILITIES="${NVIDIA_DRIVER_CAPABILITIES//,/ }"
 fi
 
 # https://github.com/nvidia/nvidia-container-runtime#nvidia_require_
@@ -169,25 +208,8 @@ for req in $(compgen -e "NVIDIA_REQUIRE_"); do
     CLI_REQUIREMENTS="${CLI_REQUIREMENTS} ${!req}"
 done
 
-# https://github.com/nvidia/nvidia-container-runtime#cuda_version
-if [ -n "${CUDA_VERSION+x}" ] && [ -z "${NVIDIA_REQUIRE_CUDA+x}" ]; then
-    # Legacy CUDA image detected, default to all devices and all driver capabilities.
-    if [ -z "${CLI_DEVICES}" ]; then
-        CLI_DEVICES="all"
-    fi
-
-    if [ -z "${CLI_CAPABILITIES}" ]; then
-        CLI_CAPABILITIES="all"
-    fi
-
-    # Transform CUDA_VERSION=X.Y to a "cuda>=X.Y" constraint for nvidia-container-cli.
-    if [[ "${CUDA_VERSION}" =~ ^[0-9]+\.[0-9]+ ]]; then
-        CLI_REQUIREMENTS="${CLI_REQUIREMENTS} cuda>=${BASH_REMATCH[0]}"
-    fi
-fi
-
 if [ "${CLI_CAPABILITIES}" = "all" ]; then
-    CLI_CAPABILITIES="compute compat32 graphics utility video"
+    CLI_CAPABILITIES="compute compat32 display graphics utility video"
 fi
 
 if [ -z "${CLI_CAPABILITIES}" ]; then
@@ -211,6 +233,14 @@ if [ "${USERNS}" = "yes" ]; then
     configure_args+=(--no-cgroups)
 fi
 
+if [ -n "${CLI_LDCACHE}" ]; then
+    global_args+=(--ldcache="${CLI_LDCACHE}")
+fi
+
+if [ -n "${CLI_ROOT}" ]; then
+    global_args+=(--root="${CLI_ROOT}")
+fi
+
 if [ -n "${CLI_LDCONFIG}" ]; then
     configure_args+=(--ldconfig="${CLI_LDCONFIG}")
 fi
@@ -234,5 +264,10 @@ if [ "${CLI_DISABLE_REQUIRE}" = "false" ]; then
     done
 fi
 
+if [ -d "/sys/kernel/security/apparmor" ]; then
+    # Try to transition to the unconfined AppArmor profile.
+    echo "changeprofile unconfined" > /proc/self/attr/current || true
+fi
+
 set -x
 exec nvidia-container-cli ${global_args[@]} configure ${configure_args[@]} "${LXC_ROOTFS_MOUNT}"