diff --git a/Cargo.lock b/Cargo.lock index 53a3654ebf..55e2fea321 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -63,6 +63,7 @@ dependencies = [ "cfg-if", "getrandom 0.3.4", "once_cell", + "serde", "version_check", "zerocopy", ] @@ -764,6 +765,21 @@ dependencies = [ "sha2 0.11.0", ] +[[package]] +name = "bit-set" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3" +dependencies = [ + "bit-vec", +] + +[[package]] +name = "bit-vec" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" + [[package]] name = "bitflags" version = "1.3.2" @@ -870,6 +886,12 @@ dependencies = [ "serde_repr", ] +[[package]] +name = "borrow-or-share" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c" + [[package]] name = "bstr" version = "1.12.1" @@ -886,6 +908,12 @@ version = "3.20.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb" +[[package]] +name = "bytecount" +version = "0.6.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e" + [[package]] name = "byteorder" version = "1.5.0" @@ -1178,6 +1206,26 @@ version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b" +[[package]] +name = "container-device-interface" +version = "1.2.0" +source = "git+https://github.com/cncf-tags/container-device-interface-rs?rev=b8a056e92dbd159423c129cd306c93e410651b18#b8a056e92dbd159423c129cd306c93e410651b18" +dependencies = [ + "anyhow", + "const_format", + "jsonschema", + "lazy_static", + "libc", + "oci-spec 0.10.0", + "once_cell", + "path-clean", + "regex", + "semver", + "serde", + "serde_json", + "serde_yaml", +] + [[package]] name = "core-foundation" version = "0.10.1" @@ -1836,6 +1884,15 @@ dependencies = [ "zeroize", ] +[[package]] +name = "email_address" +version = "0.2.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449" +dependencies = [ + "serde", +] + [[package]] name = "encode_unicode" version = "1.0.0" @@ -1941,6 +1998,17 @@ dependencies = [ "pin-project-lite", ] +[[package]] +name = "fancy-regex" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e1e1dacd0d2082dfcf1351c4bdd566bbe89a2b263235a2b50058f1e130a47277" +dependencies = [ + "bit-set", + "regex-automata", + "regex-syntax", +] + [[package]] name = "fastrand" version = "2.4.1" @@ -2013,6 +2081,17 @@ dependencies = [ "zlib-rs", ] +[[package]] +name = "fluent-uri" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bc74ac4d8359ae70623506d512209619e5cf8f347124910440dbc221714b328e" +dependencies = [ + "borrow-or-share", + "ref-cast", + "serde", +] + [[package]] name = "flume" version = "0.12.0" @@ -2051,6 +2130,16 @@ dependencies = [ "percent-encoding", ] +[[package]] +name = "fraction" +version = "0.15.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e076045bb43dac435333ed5f04caf35c7463631d0dae2deb2638d94dd0a5b872" +dependencies = [ + "lazy_static", + "num", +] + [[package]] name = "fs_extra" version = "1.3.0" @@ -2207,9 +2296,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", + "js-sys", "libc", "r-efi 5.3.0", "wasip2", + "wasm-bindgen", ] [[package]] @@ -3153,6 +3244,42 @@ dependencies = [ "serde_json", ] +[[package]] +name = "jsonschema" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0a699d3e77675e6aa4bfffe3b907c8b5f7ed3241f9965bffb25475ad4b08d05" +dependencies = [ + "ahash", + "bytecount", + "data-encoding", + "email_address", + "fancy-regex", + "fraction", + "getrandom 0.3.4", + "idna", + "itoa", + "jsonschema-regex", + "num-cmp", + "num-traits", + "percent-encoding", + "referencing", + "regex", + "serde", + "serde_json", + "unicode-general-category", + "uuid-simd", +] + +[[package]] +name = "jsonschema-regex" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6dbd1086b01b9349fd4ef9a07433965af64c8ce8159abe633a189e4ff817bd13" +dependencies = [ + "regex-syntax", +] + [[package]] name = "jsonwebtoken" version = "10.3.0" @@ -3572,6 +3699,12 @@ dependencies = [ "sketches-ddsketch", ] +[[package]] +name = "micromap" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2a86d3146ed3995b5913c414f6664344b9617457320782e64f0bb44afd49d74" + [[package]] name = "miette" version = "7.6.0" @@ -3774,6 +3907,20 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "num" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23" +dependencies = [ + "num-bigint", + "num-complex", + "num-integer", + "num-iter", + "num-rational", + "num-traits", +] + [[package]] name = "num-bigint" version = "0.4.6" @@ -3800,6 +3947,21 @@ dependencies = [ "zeroize", ] +[[package]] +name = "num-cmp" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63335b2e2c34fae2fb0aa2cecfd9f0832a1e24b3b32ecec612c3426d46dc8aaa" + +[[package]] +name = "num-complex" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495" +dependencies = [ + "num-traits", +] + [[package]] name = "num-conv" version = "0.2.1" @@ -3826,6 +3988,17 @@ dependencies = [ "num-traits", ] +[[package]] +name = "num-rational" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824" +dependencies = [ + "num-bigint", + "num-integer", + "num-traits", +] + [[package]] name = "num-traits" version = "0.2.19" @@ -3894,7 +4067,7 @@ dependencies = [ "http-auth", "jsonwebtoken", "lazy_static", - "oci-spec", + "oci-spec 0.9.0", "olpc-cjson", "regex", "reqwest 0.13.2", @@ -3924,6 +4097,23 @@ dependencies = [ "thiserror 2.0.20", ] +[[package]] +name = "oci-spec" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3df6f876ad774d6a676f7e968f5c3edacc32f90e65fe680a8b686235396556fb" +dependencies = [ + "const_format", + "derive_builder", + "getset", + "regex", + "serde", + "serde_json", + "strum 0.27.2", + "strum_macros 0.27.2", + "thiserror 2.0.20", +] + [[package]] name = "oid-registry" version = "0.7.1" @@ -4067,6 +4257,7 @@ dependencies = [ "async-trait", "base64", "chrono", + "container-device-interface", "glob", "ipnet", "jsonwebtoken", @@ -5153,6 +5344,12 @@ version = "1.0.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a" +[[package]] +name = "path-clean" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17359afc20d7ab31fdb42bb844c8b3bb1dabd7dcf7e68428492da7f16966fcef" + [[package]] name = "pbkdf2" version = "0.13.0" @@ -5747,7 +5944,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.60.2", + "windows-sys 0.59.0", ] [[package]] @@ -5926,6 +6123,43 @@ dependencies = [ "bitflags 2.13.2", ] +[[package]] +name = "ref-cast" +version = "1.0.26" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d" +dependencies = [ + "ref-cast-impl", +] + +[[package]] +name = "ref-cast-impl" +version = "1.0.26" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c" +dependencies = [ + "proc-macro2", + "quote", + "syn 3.0.5", +] + +[[package]] +name = "referencing" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fbf332a2f81899f6836f22c03da73dae8a664c32e3016b84692c23cddadc95d" +dependencies = [ + "ahash", + "fluent-uri", + "getrandom 0.3.4", + "hashbrown 0.16.1", + "itoa", + "micromap", + "parking_lot", + "percent-encoding", + "serde_json", +] + [[package]] name = "regex" version = "1.12.3" @@ -8013,6 +8247,12 @@ version = "0.3.18" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5" +[[package]] +name = "unicode-general-category" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f" + [[package]] name = "unicode-ident" version = "1.0.24" @@ -8151,6 +8391,16 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "uuid-simd" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23b082222b4f6619906941c17eb2297fff4c2fb96cb60164170522942a200bd8" +dependencies = [ + "outref", + "vsimd", +] + [[package]] name = "valuable" version = "0.1.1" diff --git a/Cargo.toml b/Cargo.toml index 2e7237190f..d66d48e697 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -83,6 +83,7 @@ rustix = { version = "1.1", features = ["process"] } socket2 = "0.6" # Serialization +container-device-interface = { git = "https://github.com/cncf-tags/container-device-interface-rs", rev = "b8a056e92dbd159423c129cd306c93e410651b18" } serde = { version = "1", features = ["derive"] } serde_json = "1" serde_yml = { package = "noyalib", version = "0.0.28", default-features = false, features = ["std", "compat-serde-yaml"] } diff --git a/crates/openshell-core/Cargo.toml b/crates/openshell-core/Cargo.toml index a246a40442..6f487f60ed 100644 --- a/crates/openshell-core/Cargo.toml +++ b/crates/openshell-core/Cargo.toml @@ -45,6 +45,9 @@ tempfile = { version = "3", optional = true } nix = { workspace = true } rustix = { workspace = true } +[target.'cfg(target_os = "linux")'.dependencies] +container-device-interface = { workspace = true } + [features] default = ["telemetry"] ## Compile in anonymous telemetry emission support. On by default; disable with diff --git a/crates/openshell-core/src/cdi.rs b/crates/openshell-core/src/cdi.rs new file mode 100644 index 0000000000..2c1d03b9d7 --- /dev/null +++ b/crates/openshell-core/src/cdi.rs @@ -0,0 +1,181 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! Shared CDI context schema and resolver helpers. + +use std::path::{Path, PathBuf}; + +use serde::{Deserialize, Serialize}; + +pub const CDI_CONTEXT_VERSION: u32 = 1; + +/// Base workload-runtime path under which compute drivers mount CDI specification directories. +pub const CDI_SPEC_DIR_BASE: &str = "/run/openshell/boundary/cdi-specs"; + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct CdiContext { + pub version: u32, + pub selected_devices: Vec, + pub spec_dirs: Vec, +} + +impl CdiContext { + #[must_use] + pub fn new(selected_devices: Vec, spec_dirs: Vec) -> Self { + Self { + version: CDI_CONTEXT_VERSION, + selected_devices, + spec_dirs, + } + } +} + +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct CdiSpecDirectory { + pub path: String, + pub source: String, +} + +impl CdiSpecDirectory { + #[must_use] + pub fn new(path: impl Into, source: impl Into) -> Self { + Self { + path: path.into(), + source: source.into(), + } + } +} + +#[derive(Debug, Clone, Default, PartialEq, Eq)] +pub struct CdiDerivedRequirements { + pub device_node_paths: Vec, + /// Derived read-only policy paths. Shared-library mounts contribute their + /// parent directory; other read-only mounts contribute their exact path. + pub read_only_paths: Vec, + pub read_write_mount_paths: Vec, + pub additional_gids: Vec, +} + +#[derive(Debug, thiserror::Error)] +pub enum CdiError { + #[error("CDI policy resolution is unavailable on this platform")] + UnsupportedPlatform, + #[error("failed to read CDI context '{}': {source}", path.display())] + ContextRead { + path: PathBuf, + source: std::io::Error, + }, + #[error("failed to parse CDI context '{}': {source}", path.display())] + ContextParse { + path: PathBuf, + source: serde_json::Error, + }, + #[error("unsupported CDI context version {0}")] + UnsupportedContextVersion(u32), + #[error("CDI spec dir '{path}' from source '{diagnostic_source}' is unsafe: {reason}")] + UnsafeSpecDir { + path: String, + diagnostic_source: String, + reason: &'static str, + }, + #[error("selected CDI device '{0}' was not found in mounted CDI specs")] + MissingDevice(String), + #[error( + "selected CDI device '{device}' was not found in mounted CDI specs after CDI spec refresh reported: {refresh_error}" + )] + MissingDeviceAfterRefresh { + device: String, + refresh_error: String, + }, + #[error("failed to merge CDI edits for '{device}': {error}")] + EditMerge { device: String, error: String }, + #[error("failed to encode resolved CDI edits: {source}")] + EditEncode { source: serde_json::Error }, + #[error("failed to decode resolved CDI edits: {source}")] + EditDecode { source: serde_json::Error }, + #[error("CDI-derived path '{path}' is unsafe: {reason}")] + UnsafePolicyPath { path: String, reason: &'static str }, + #[error("CDI path '{path}' requested conflicting access modes")] + ConflictingAccess { path: String }, + #[error( + "CDI writable mount '{path}' is not explicitly listed in the sandbox policy read_write paths" + )] + WritableMountNotAllowed { path: String }, + #[error("CDI writable mount '{path}' must target a single file, found {kind}")] + WritableMountNotFile { path: String, kind: String }, + #[error("CDI device node '{path}' must target a character or block device, found {kind}")] + DeviceNodeNotDevice { path: String, kind: String }, + #[error("CDI additionalGids must not contain root GID 0")] + RootAdditionalGid, + #[error("CDI mount '{path}' has conflicting ro/rw options")] + ConflictingMountOptions { path: String }, +} + +pub fn read_context(path: impl AsRef) -> Result { + let path = path.as_ref(); + let json = std::fs::read_to_string(path).map_err(|source| CdiError::ContextRead { + path: path.to_path_buf(), + source, + })?; + serde_json::from_str(&json).map_err(|source| CdiError::ContextParse { + path: path.to_path_buf(), + source, + }) +} + +#[cfg(any(target_os = "linux", test))] +fn shared_library_parent(path: &str) -> Option { + let path = Path::new(path); + let name = path.file_name()?.to_str()?; + let versioned_library = name.rsplit_once(".so.").is_some_and(|(_, version)| { + version.split('.').all(|component| { + !component.is_empty() && component.bytes().all(|byte| byte.is_ascii_digit()) + }) + }); + let unversioned_library = name + .rsplit_once('.') + .is_some_and(|(_, extension)| extension == "so"); + if !unversioned_library && !versioned_library { + return None; + } + path.parent()?.to_str().map(ToOwned::to_owned) +} + +#[cfg(test)] +mod tests { + use super::shared_library_parent; + + #[test] + fn identifies_shared_library_parent_directories() { + for path in [ + "/opt/nvidia/lib/libcuda.so", + "/opt/nvidia/lib/libnvidia-ml.so.1", + "/opt/nvidia/lib/libnvidia-eglcore.so.540.5.0", + ] { + assert_eq!( + shared_library_parent(path).as_deref(), + Some("/opt/nvidia/lib") + ); + } + for path in [ + "/etc/ld.so.conf", + "/opt/nvidia/lib/libcuda.so.debug", + "/opt/nvidia/lib/libcuda.so.1beta", + "/usr/bin/nvidia-smi", + ] { + assert_eq!(shared_library_parent(path), None); + } + } +} + +#[cfg(target_os = "linux")] +#[path = "cdi_linux.rs"] +mod cdi_linux; +#[cfg(target_os = "linux")] +pub use cdi_linux::{resolve_cdi_context, validate_cdi_requirements}; + +#[cfg(not(target_os = "linux"))] +#[path = "cdi_stub.rs"] +mod cdi_stub; +#[cfg(not(target_os = "linux"))] +pub use cdi_stub::{resolve_cdi_context, validate_cdi_requirements}; diff --git a/crates/openshell-core/src/cdi_linux.rs b/crates/openshell-core/src/cdi_linux.rs new file mode 100644 index 0000000000..b10e98167b --- /dev/null +++ b/crates/openshell-core/src/cdi_linux.rs @@ -0,0 +1,977 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! Linux implementation of CDI policy resolution. + +use super::{ + CDI_CONTEXT_VERSION, CdiContext, CdiDerivedRequirements, CdiError, CdiSpecDirectory, + shared_library_parent, +}; +use crate::paths::normalize_path; +use container_device_interface::{ + cache::{Cache, with_auto_refresh}, + container_edits::ContainerEdits as UpstreamContainerEdits, + spec_dirs::with_spec_dirs, +}; +use serde::Deserialize; +use std::collections::{BTreeMap, BTreeSet, HashSet}; +use std::fmt; +use std::hash::BuildHasher; +use std::os::unix::fs::FileTypeExt; +use std::path::{Component, Path}; + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum CdiPathKind { + File, + Directory, + CharacterDevice, + BlockDevice, + Other, +} + +impl fmt::Display for CdiPathKind { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + match self { + Self::File => f.write_str("file"), + Self::Directory => f.write_str("directory"), + Self::CharacterDevice => f.write_str("character device"), + Self::BlockDevice => f.write_str("block device"), + Self::Other => f.write_str("other"), + } + } +} + +// Temporary view over upstream-resolved CDI edits. The Rust CDI crate currently +// keeps some spec-model fields crate-private even though they are serialized and +// public in specs-go, so OpenShell serializes the merged upstream model and +// decodes only the policy-relevant fields here. +#[derive(Debug, Default, Deserialize)] +struct CdiContainerEdits { + #[serde(default, rename = "deviceNodes")] + device_nodes: Vec, + #[serde(default)] + mounts: Vec, + #[serde(default, rename = "additionalGids")] + additional_gids: Vec, +} + +#[derive(Debug, Deserialize)] +struct CdiDeviceNode { + path: String, +} + +#[derive(Debug, Deserialize)] +struct CdiMount { + #[serde(rename = "containerPath")] + container_path: String, + #[serde(default)] + options: Vec, +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum CdiAccess { + ReadOnly, + ReadWrite, +} + +#[derive(Debug, Default)] +struct RequirementAccumulator { + device_node_paths: BTreeSet, + mount_paths: BTreeMap, + additional_gids: BTreeSet, +} + +impl RequirementAccumulator { + fn add_device_node(&mut self, path: String) -> Result<(), CdiError> { + match self.mount_paths.get(&path).copied() { + Some(CdiAccess::ReadOnly) => Err(CdiError::ConflictingAccess { path }), + Some(CdiAccess::ReadWrite) | None => { + self.device_node_paths.insert(path); + Ok(()) + } + } + } + + fn add_mount(&mut self, path: String, access: CdiAccess) -> Result<(), CdiError> { + if access == CdiAccess::ReadOnly && self.device_node_paths.contains(&path) { + return Err(CdiError::ConflictingAccess { path }); + } + match self.mount_paths.get(&path).copied() { + Some(existing) if existing != access => Err(CdiError::ConflictingAccess { path }), + Some(_) => Ok(()), + None => { + self.mount_paths.insert(path, access); + Ok(()) + } + } + } + + fn add_gid(&mut self, gid: u32) -> Result<(), CdiError> { + if gid == 0 { + return Err(CdiError::RootAdditionalGid); + } + self.additional_gids.insert(gid); + Ok(()) + } + + fn build(self) -> CdiDerivedRequirements { + let mut read_only_paths = BTreeSet::new(); + let mut read_write_mount_paths = Vec::new(); + for (path, access) in self.mount_paths { + match access { + CdiAccess::ReadOnly => { + read_only_paths.insert(shared_library_parent(&path).unwrap_or(path)); + } + CdiAccess::ReadWrite => read_write_mount_paths.push(path), + } + } + CdiDerivedRequirements { + device_node_paths: self.device_node_paths.into_iter().collect(), + read_only_paths: read_only_paths.into_iter().collect(), + read_write_mount_paths, + additional_gids: self.additional_gids.into_iter().collect(), + } + } +} + +pub fn resolve_cdi_context(context: &CdiContext) -> Result { + validate_context(context)?; + let selected_devices = selected_cdi_devices(&context.selected_devices); + if selected_devices.is_empty() || context.spec_dirs.is_empty() { + return Ok(CdiDerivedRequirements::default()); + } + + let edits = resolve_container_edits(context, &selected_devices)?; + let mut accumulator = RequirementAccumulator::default(); + accumulate_requirements(&edits, &mut accumulator)?; + Ok(accumulator.build()) +} + +pub fn validate_cdi_requirements( + requirements: &CdiDerivedRequirements, + writable_file_allowlist: &HashSet, +) -> Result<(), CdiError> { + validate_cdi_requirements_with_path_kind( + requirements, + writable_file_allowlist, + filesystem_path_kind, + ) +} + +fn validate_cdi_requirements_with_path_kind( + requirements: &CdiDerivedRequirements, + writable_file_allowlist: &HashSet, + path_kind: F, +) -> Result<(), CdiError> +where + F: Fn(&str) -> Option, + S: BuildHasher, +{ + let normalized_allowlist = writable_file_allowlist + .iter() + .map(|path| normalize_path(path)) + .collect::>(); + for path in &requirements.device_node_paths { + let kind = path_kind(path); + if !matches!( + kind, + Some(CdiPathKind::CharacterDevice | CdiPathKind::BlockDevice) + ) { + return Err(CdiError::DeviceNodeNotDevice { + path: path.clone(), + kind: kind.map_or_else(|| "missing".to_string(), |kind| kind.to_string()), + }); + } + } + for path in &requirements.read_write_mount_paths { + if !normalized_allowlist.contains(path) { + return Err(CdiError::WritableMountNotAllowed { path: path.clone() }); + } + let kind = path_kind(path); + if kind != Some(CdiPathKind::File) { + return Err(CdiError::WritableMountNotFile { + path: path.clone(), + kind: kind.map_or_else(|| "missing".to_string(), |kind| kind.to_string()), + }); + } + } + Ok(()) +} + +fn validate_context(context: &CdiContext) -> Result<(), CdiError> { + if context.version != CDI_CONTEXT_VERSION { + return Err(CdiError::UnsupportedContextVersion(context.version)); + } + for spec_dir in &context.spec_dirs { + validate_absolute_no_parent(&spec_dir.path).map_err(|reason| CdiError::UnsafeSpecDir { + path: spec_dir.path.clone(), + diagnostic_source: spec_dir.source.clone(), + reason, + })?; + } + Ok(()) +} + +fn selected_cdi_devices(device_ids: &[String]) -> Vec { + let mut seen = HashSet::new(); + let mut parsed = Vec::new(); + for raw in device_ids { + let raw = raw.trim(); + if raw.is_empty() { + continue; + } + if seen.insert(raw.to_string()) { + parsed.push(raw.to_string()); + } + } + parsed +} + +fn resolve_container_edits( + context: &CdiContext, + selected_devices: &[String], +) -> Result { + let (mut cache, refresh_error) = build_cache(&context.spec_dirs); + let mut merged = UpstreamContainerEdits::new(); + let mut applied_specs = BTreeSet::new(); + + for device_id in selected_devices { + let device = cache + .get_device(device_id) + .cloned() + .ok_or_else(|| missing_device_error(device_id, refresh_error.as_deref()))?; + let mut spec = device.get_spec(); + let spec_path = spec.get_path(); + if applied_specs.insert(spec_path) + && let Some(spec_edits) = spec.edits() + { + merged + .append(spec_edits) + .map_err(|err| CdiError::EditMerge { + device: device_id.clone(), + error: err.to_string(), + })?; + } + merged + .append(device.edits()) + .map_err(|err| CdiError::EditMerge { + device: device_id.clone(), + error: err.to_string(), + })?; + } + + let value = serde_json::to_value(&merged.container_edits) + .map_err(|source| CdiError::EditEncode { source })?; + serde_json::from_value(value).map_err(|source| CdiError::EditDecode { source }) +} + +fn missing_device_error(device: &str, refresh_error: Option<&str>) -> CdiError { + refresh_error.map_or_else( + || CdiError::MissingDevice(device.to_string()), + |refresh_error| CdiError::MissingDeviceAfterRefresh { + device: device.to_string(), + refresh_error: refresh_error.to_string(), + }, + ) +} + +fn build_cache(spec_dirs: &[CdiSpecDirectory]) -> (Cache, Option) { + let spec_dir_paths = spec_dirs + .iter() + .map(|spec_dir| spec_dir.path.as_str()) + .collect::>(); + let mut cache = Cache::default(); + cache.configure(vec![ + with_spec_dirs(&spec_dir_paths), + with_auto_refresh(false), + ]); + let refresh_error = cache.refresh().err().map(|err| { + tracing::debug!( + error = %err, + "Ignoring CDI cache refresh error; requested device lookup will determine availability" + ); + err.to_string() + }); + (cache, refresh_error) +} + +fn accumulate_requirements( + edits: &CdiContainerEdits, + accumulator: &mut RequirementAccumulator, +) -> Result<(), CdiError> { + for device_node in &edits.device_nodes { + let path = normalize_policy_path(&device_node.path)?; + accumulator.add_device_node(path)?; + } + + for mount in &edits.mounts { + let path = normalize_policy_path(&mount.container_path)?; + let access = mount_access(&path, &mount.options)?; + accumulator.add_mount(path, access)?; + } + + for gid in &edits.additional_gids { + accumulator.add_gid(*gid)?; + } + + Ok(()) +} + +fn mount_access(path: &str, options: &[String]) -> Result { + let read_only_requested = options + .iter() + .any(|option| option.eq_ignore_ascii_case("ro")); + let read_write_requested = options + .iter() + .any(|option| option.eq_ignore_ascii_case("rw")); + // CDI mount options are stringly typed and runtime-specific normalization + // can differ. Treat simultaneous ro/rw as malformed instead of guessing + // which option a later mount syscall would effectively apply. + if read_only_requested && read_write_requested { + return Err(CdiError::ConflictingMountOptions { + path: path.to_string(), + }); + } + if read_write_requested { + Ok(CdiAccess::ReadWrite) + } else { + Ok(CdiAccess::ReadOnly) + } +} + +fn normalize_policy_path(path: &str) -> Result { + validate_absolute_no_parent(path).map_err(|reason| CdiError::UnsafePolicyPath { + path: path.to_string(), + reason, + })?; + let normalized = normalize_path(path); + if matches!( + normalized.as_str(), + "/" | "/dev" | "/proc" | "/sys" | "/run" | "/usr" + ) { + return Err(CdiError::UnsafePolicyPath { + path: path.to_string(), + reason: "broad root path is not allowed", + }); + } + Ok(normalized) +} + +fn validate_absolute_no_parent(path: &str) -> Result<(), &'static str> { + let path = Path::new(path); + if !path.is_absolute() { + return Err("path must be absolute"); + } + for component in path.components() { + match component { + Component::ParentDir => return Err("path must not contain '..'"), + Component::Prefix(_) => return Err("path must be a Unix-style absolute path"), + Component::CurDir => return Err("path must be normalized"), + Component::RootDir | Component::Normal(_) => {} + } + } + Ok(()) +} + +fn filesystem_path_kind(path: &str) -> Option { + let metadata = std::fs::metadata(path).ok()?; + let file_type = metadata.file_type(); + if file_type.is_char_device() { + return Some(CdiPathKind::CharacterDevice); + } + if file_type.is_block_device() { + return Some(CdiPathKind::BlockDevice); + } + if file_type.is_file() { + Some(CdiPathKind::File) + } else if file_type.is_dir() { + Some(CdiPathKind::Directory) + } else { + Some(CdiPathKind::Other) + } +} + +#[cfg(test)] +mod tests { + use super::*; + + fn write_spec(dir: &Path, name: &str, yaml: &str) { + std::fs::write(dir.join(name), yaml).unwrap(); + } + + fn context(dir: &Path, selected_devices: &[&str]) -> CdiContext { + CdiContext::new( + selected_devices + .iter() + .map(|device| (*device).to_string()) + .collect(), + vec![CdiSpecDirectory::new( + dir.to_string_lossy().into_owned(), + "/host/cdi", + )], + ) + } + + fn resolve_with_kind( + context: &CdiContext, + writable: &[&str], + kind: impl Fn(&str) -> Option, + ) -> Result { + let writable_file_allowlist: HashSet = + writable.iter().map(|path| (*path).to_string()).collect(); + let requirements = resolve_cdi_context(context)?; + validate_cdi_requirements_with_path_kind(&requirements, &writable_file_allowlist, kind)?; + Ok(requirements) + } + + fn always_missing(_: &str) -> Option { + None + } + + fn fake_device_node(path: &str) -> Option { + path.starts_with("/dev/") + .then_some(CdiPathKind::CharacterDevice) + } + + #[derive(serde::Serialize)] + struct CdiRequirementsBaseline<'a> { + device_node_paths: &'a [String], + read_only_paths: &'a [String], + read_write_mount_paths: &'a [String], + additional_gids: &'a [u32], + } + + fn assert_cdi_spec_matches_derived_requirements_baseline(spec: &str, expected: &str) { + let dir = tempfile::tempdir().unwrap(); + write_spec(dir.path(), "nvidia.yaml", spec); + + let requirements = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=all"]), + &[], + fake_device_node, + ) + .unwrap(); + let baseline = CdiRequirementsBaseline { + device_node_paths: &requirements.device_node_paths, + read_only_paths: &requirements.read_only_paths, + read_write_mount_paths: &requirements.read_write_mount_paths, + additional_gids: &requirements.additional_gids, + }; + let generated = serde_json::to_string_pretty(&baseline).unwrap() + "\n"; + + assert_eq!(generated, expected); + } + + #[test] + fn orin_cdi_spec_matches_derived_requirements_baseline() { + assert_cdi_spec_matches_derived_requirements_baseline( + include_str!("../testdata/orin-nvidia.yaml"), + include_str!("../testdata/orin-nvidia-policy-baseline.json"), + ); + } + + #[test] + fn spark_cdi_spec_matches_derived_requirements_baseline() { + assert_cdi_spec_matches_derived_requirements_baseline( + include_str!("../testdata/spark-nvidia.yaml"), + include_str!("../testdata/spark-nvidia-policy-baseline.json"), + ); + } + + #[test] + fn multi_gpu_cdi_spec_matches_derived_requirements_baseline() { + assert_cdi_spec_matches_derived_requirements_baseline( + include_str!("../testdata/multi-gpu-nvidia.yaml"), + include_str!("../testdata/multi-gpu-nvidia-policy-baseline.json"), + ); + } + + #[test] + fn resolves_native_single_device_requirements() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "nvidia.yaml", + r#" +cdiVersion: 0.6.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: /dev/nvidiactl + - path: /dev/nvidia0 + mounts: + - hostPath: /host/libcuda.so.1 + containerPath: /usr/local/cuda/lib64/libcuda.so.1 +"#, + ); + + let requirements = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + fake_device_node, + ) + .unwrap(); + + assert_eq!( + requirements.device_node_paths, + vec!["/dev/nvidia0", "/dev/nvidiactl"] + ); + assert_eq!(requirements.read_only_paths, vec!["/usr/local/cuda/lib64"]); + } + + #[test] + fn resolves_native_all_device_requirements() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "nvidia.yaml", + r" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: all + containerEdits: + deviceNodes: + - path: /dev/nvidiactl + - path: /dev/nvidia0 + - path: /dev/nvidia1 +", + ); + + let requirements = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=all"]), + &[], + fake_device_node, + ) + .unwrap(); + + assert_eq!( + requirements.device_node_paths, + vec!["/dev/nvidia0", "/dev/nvidia1", "/dev/nvidiactl"] + ); + } + + #[test] + fn resolves_wsl_shape_requirements() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "wsl.yaml", + r" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: all + containerEdits: + deviceNodes: + - path: /dev/dxg + mounts: + - hostPath: /host/wsl/lib/libcuda.so.1 + containerPath: /usr/lib/wsl/lib/libcuda.so.1 +", + ); + + let requirements = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=all"]), + &[], + fake_device_node, + ) + .unwrap(); + + assert_eq!(requirements.device_node_paths, vec!["/dev/dxg"]); + assert_eq!(requirements.read_only_paths, vec!["/usr/lib/wsl/lib"]); + } + + #[test] + fn resolves_supported_shared_library_parent_directories() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "libraries.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + mounts: + - hostPath: /host/lib/libcuda.so + containerPath: /opt/nvidia/lib/libcuda.so + - hostPath: /host/lib/libnvidia-ml.so.1 + containerPath: /opt/nvidia/lib/libnvidia-ml.so.1 + - hostPath: /host/lib/libnvidia-encode.so.9 + containerPath: /opt/nvidia/encode/libnvidia-encode.so.9 + - hostPath: /host/lib/libnvidia-eglcore.so.540.5.0 + containerPath: /opt/nvidia/versioned/libnvidia-eglcore.so.540.5.0 + - hostPath: /host/lib/libunsupported.so.debug + containerPath: /opt/nvidia/debug/libunsupported.so.debug + - hostPath: /host/lib/libunsupported.so.1beta + containerPath: /opt/nvidia/debug/libunsupported.so.1beta + - hostPath: /host/config/ld.so.conf + containerPath: /etc/nvidia/ld.so.conf + - hostPath: /host/bin/nvidia-smi + containerPath: /usr/bin/nvidia-smi + - hostPath: /host/config/runtime.json + containerPath: /etc/nvidia/runtime.json +"#, + ); + + let requirements = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + always_missing, + ) + .unwrap(); + + assert_eq!( + requirements.read_only_paths, + vec![ + "/etc/nvidia/ld.so.conf", + "/etc/nvidia/runtime.json", + "/opt/nvidia/debug/libunsupported.so.1beta", + "/opt/nvidia/debug/libunsupported.so.debug", + "/opt/nvidia/encode", + "/opt/nvidia/lib", + "/opt/nvidia/versioned", + "/usr/bin/nvidia-smi", + ] + ); + } + + #[test] + fn resolves_tegra_shape_requirements_and_gids() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "tegra.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +containerEdits: + additionalGids: [44] +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: /dev/nvmap + - path: /dev/nvhost-gpu +"#, + ); + + let requirements = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + fake_device_node, + ) + .unwrap(); + + assert_eq!(requirements.additional_gids, vec![44]); + assert_eq!( + requirements.device_node_paths, + vec!["/dev/nvhost-gpu", "/dev/nvmap"] + ); + } + + #[test] + fn accepts_writable_single_file_mount_with_explicit_policy_opt_in() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "rw-file.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + mounts: + - hostPath: /host/nvidia/cache.db + containerPath: /opt/nvidia/cache.db + options: [rw] +"#, + ); + + let requirements = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &["/opt/nvidia/cache.db"], + |path| (path == "/opt/nvidia/cache.db").then_some(CdiPathKind::File), + ) + .unwrap(); + + assert_eq!( + requirements.read_write_mount_paths, + vec!["/opt/nvidia/cache.db"] + ); + } + + #[test] + fn rejects_writable_directory_mount() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "rw-dir.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + mounts: + - hostPath: /host/nvidia/cache + containerPath: /opt/nvidia/cache + options: [rw] +"#, + ); + + let err = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &["/opt/nvidia/cache"], + |path| (path == "/opt/nvidia/cache").then_some(CdiPathKind::Directory), + ) + .unwrap_err(); + + assert!(matches!(err, CdiError::WritableMountNotFile { .. })); + } + + #[test] + fn rejects_missing_selected_device() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "nvidia.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + env: + - OPEN_SHELL_TEST=1 +"#, + ); + + let err = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=1"]), + &[], + always_missing, + ) + .unwrap_err(); + + assert!(matches!(err, CdiError::MissingDevice(device) if device == "nvidia.com/gpu=1")); + } + + #[test] + fn reports_refresh_errors_when_requested_device_is_missing() { + let dir = tempfile::tempdir().unwrap(); + write_spec(dir.path(), "broken.yaml", "kind: ["); + + let err = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + fake_device_node, + ) + .unwrap_err(); + + assert!( + matches!(err, CdiError::MissingDeviceAfterRefresh { device, refresh_error } + if device == "nvidia.com/gpu=0" && !refresh_error.is_empty()) + ); + } + + #[test] + fn rejects_duplicate_cdi_device_names() { + let dir = tempfile::tempdir().unwrap(); + for (name, value) in [("first.yaml", "FIRST"), ("second.yaml", "SECOND")] { + write_spec( + dir.path(), + name, + &format!( + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + env: + - OPEN_SHELL_TEST={value} +"# + ), + ); + } + + let err = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + always_missing, + ) + .unwrap_err(); + + assert!( + matches!(err, CdiError::MissingDeviceAfterRefresh { device, refresh_error } + if device == "nvidia.com/gpu=0" + && refresh_error.contains("conflicting device nvidia.com/gpu=0")) + ); + } + + #[test] + fn empty_selection_is_noop() { + let dir = tempfile::tempdir().unwrap(); + let requirements = resolve_with_kind(&context(dir.path(), &[]), &[], always_missing) + .expect("empty selection should resolve to empty requirements"); + + assert_eq!(requirements, CdiDerivedRequirements::default()); + } + + #[test] + fn empty_spec_dirs_are_noop() { + let context = CdiContext::new(vec!["nvidia.com/gpu=0".to_string()], Vec::new()); + + let requirements = resolve_with_kind(&context, &[], always_missing) + .expect("empty spec dirs should resolve to empty requirements"); + + assert_eq!(requirements, CdiDerivedRequirements::default()); + } + + #[test] + fn defers_device_id_shape_to_upstream_resolution() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "nvidia.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + env: + - OPEN_SHELL_TEST=1 +"#, + ); + + let err = resolve_with_kind(&context(dir.path(), &["not-a-cdi-id"]), &[], always_missing) + .unwrap_err(); + + assert!(matches!(err, CdiError::MissingDevice(device) if device == "not-a-cdi-id")); + } + + #[test] + fn rejects_unsafe_policy_paths() { + for path in [ + "relative", "/dev", "/proc", "/sys", "/run", "/usr", "/a/../b", + ] { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "unsafe.yaml", + &format!( + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: {path} +"# + ), + ); + + let err = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + always_missing, + ) + .unwrap_err(); + + assert!( + matches!(err, CdiError::UnsafePolicyPath { .. }), + "expected unsafe path error for {path}, got {err:?}" + ); + } + } + + #[test] + fn rejects_duplicate_access_conflicts() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "conflict.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: /dev/nvidia0 + mounts: + - hostPath: /host/dev/nvidia0 + containerPath: /dev/nvidia0 + options: [ro] +"#, + ); + + let err = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + fake_device_node, + ) + .unwrap_err(); + + assert!(matches!(err, CdiError::ConflictingAccess { .. })); + } + + #[test] + fn rejects_root_additional_gid() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "root-gid.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + additionalGids: [0, 44] +"#, + ); + + let err = resolve_with_kind( + &context(dir.path(), &["nvidia.com/gpu=0"]), + &[], + always_missing, + ) + .unwrap_err(); + + assert!(matches!(err, CdiError::RootAdditionalGid)); + } + + #[test] + fn rejects_device_node_that_is_not_device() { + let dir = tempfile::tempdir().unwrap(); + write_spec( + dir.path(), + "regular-file-node.yaml", + r#" +cdiVersion: 1.1.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: /opt/nvidia/not-a-device +"#, + ); + + let err = resolve_with_kind(&context(dir.path(), &["nvidia.com/gpu=0"]), &[], |path| { + (path == "/opt/nvidia/not-a-device").then_some(CdiPathKind::File) + }) + .unwrap_err(); + + assert!(matches!(err, CdiError::DeviceNodeNotDevice { .. })); + } +} diff --git a/crates/openshell-core/src/cdi_stub.rs b/crates/openshell-core/src/cdi_stub.rs new file mode 100644 index 0000000000..63675abd52 --- /dev/null +++ b/crates/openshell-core/src/cdi_stub.rs @@ -0,0 +1,20 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! Fail-closed CDI policy resolution for platforms other than Linux. + +use std::collections::HashSet; +use std::hash::BuildHasher; + +use super::{CdiContext, CdiDerivedRequirements, CdiError}; + +pub fn resolve_cdi_context(_context: &CdiContext) -> Result { + Err(CdiError::UnsupportedPlatform) +} + +pub fn validate_cdi_requirements( + _requirements: &CdiDerivedRequirements, + _writable_file_allowlist: &HashSet, +) -> Result<(), CdiError> { + Err(CdiError::UnsupportedPlatform) +} diff --git a/crates/openshell-core/src/lib.rs b/crates/openshell-core/src/lib.rs index 472175f511..a71686e01f 100644 --- a/crates/openshell-core/src/lib.rs +++ b/crates/openshell-core/src/lib.rs @@ -11,6 +11,7 @@ pub mod activity; pub mod auth; +pub mod cdi; pub mod config; pub mod container_paths; pub mod denial; diff --git a/crates/openshell-core/testdata/multi-gpu-nvidia-policy-baseline.json b/crates/openshell-core/testdata/multi-gpu-nvidia-policy-baseline.json new file mode 100644 index 0000000000..e3e9e76bf6 --- /dev/null +++ b/crates/openshell-core/testdata/multi-gpu-nvidia-policy-baseline.json @@ -0,0 +1,39 @@ +{ + "device_node_paths": [ + "/dev/nvidia-modeset", + "/dev/nvidia-uvm", + "/dev/nvidia-uvm-tools", + "/dev/nvidia0", + "/dev/nvidia1", + "/dev/nvidiactl" + ], + "read_only_paths": [ + "/etc/OpenCL/vendors/nvidia.icd", + "/etc/vulkan/icd.d/nvidia_icd.json", + "/etc/vulkan/implicit_layer.d/nvidia_layers.json", + "/lib/firmware/nvidia/615.71.09/gsp_ga10x.bin", + "/lib/firmware/nvidia/615.71.09/gsp_tu10x.bin", + "/run/nvidia-persistenced/socket", + "/run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_ga10x.bin", + "/run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_tu10x.bin", + "/usr/bin/nvidia-cuda-mps-control", + "/usr/bin/nvidia-cuda-mps-server", + "/usr/bin/nvidia-debugdump", + "/usr/bin/nvidia-imex", + "/usr/bin/nvidia-imex-ctl", + "/usr/bin/nvidia-persistenced", + "/usr/bin/nvidia-smi", + "/usr/bin/nvidia-xconfig", + "/usr/lib/x86_64-linux-gnu", + "/usr/lib/x86_64-linux-gnu/vdpau", + "/usr/share/egl/egl_external_platform.d/09_nvidia_wayland2.json", + "/usr/share/egl/egl_external_platform.d/10_nvidia_wayland.json", + "/usr/share/egl/egl_external_platform.d/15_nvidia_gbm.json", + "/usr/share/egl/egl_external_platform.d/20_nvidia_xcb.json", + "/usr/share/egl/egl_external_platform.d/20_nvidia_xlib.json", + "/usr/share/glvnd/egl_vendor.d/10_nvidia.json", + "/usr/share/nvidia/nvoptix.bin" + ], + "read_write_mount_paths": [], + "additional_gids": [] +} diff --git a/crates/openshell-core/testdata/multi-gpu-nvidia.yaml b/crates/openshell-core/testdata/multi-gpu-nvidia.yaml new file mode 100644 index 0000000000..e6576987e1 --- /dev/null +++ b/crates/openshell-core/testdata/multi-gpu-nvidia.yaml @@ -0,0 +1,817 @@ +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Copied from ~/Downloads/nvidia.yaml on 2026-09-17 as a multi-GPU fixture. +# SHA-256: 51e2c048894654bf1dba558b9cdaff8586ffb2bbb472f75855c1eb5f8bc5ad71 +--- +cdiVersion: 0.5.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: /dev/nvidia0 + hostPath: /run/nvidia/driver/dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + hooks: + - hookName: createRuntime + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - apply-cuda-memory-limits + - --driver-root + - /run/nvidia/driver + - --gpu-id + - GPU-ebd34bdf-1083-eaac-2aff-4b71a022f9bd + env: + - NVIDIA_CTK_DEBUG=false + - name: "1" + containerEdits: + deviceNodes: + - path: /dev/nvidia1 + hostPath: /run/nvidia/driver/dev/nvidia1 + major: 195 + minor: 1 + fileMode: 438 + permissions: rwm + hooks: + - hookName: createRuntime + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - apply-cuda-memory-limits + - --driver-root + - /run/nvidia/driver + - --gpu-id + - GPU-1795e88b-3395-b27b-dad8-0488474eec0c + env: + - NVIDIA_CTK_DEBUG=false + - name: GPU-1795e88b-3395-b27b-dad8-0488474eec0c + containerEdits: + deviceNodes: + - path: /dev/nvidia1 + hostPath: /run/nvidia/driver/dev/nvidia1 + major: 195 + minor: 1 + fileMode: 438 + permissions: rwm + hooks: + - hookName: createRuntime + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - apply-cuda-memory-limits + - --driver-root + - /run/nvidia/driver + - --gpu-id + - GPU-1795e88b-3395-b27b-dad8-0488474eec0c + env: + - NVIDIA_CTK_DEBUG=false + - name: GPU-ebd34bdf-1083-eaac-2aff-4b71a022f9bd + containerEdits: + deviceNodes: + - path: /dev/nvidia0 + hostPath: /run/nvidia/driver/dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + hooks: + - hookName: createRuntime + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - apply-cuda-memory-limits + - --driver-root + - /run/nvidia/driver + - --gpu-id + - GPU-ebd34bdf-1083-eaac-2aff-4b71a022f9bd + env: + - NVIDIA_CTK_DEBUG=false + - name: all + containerEdits: + deviceNodes: + - path: /dev/nvidia0 + hostPath: /run/nvidia/driver/dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + - path: /dev/nvidia1 + hostPath: /run/nvidia/driver/dev/nvidia1 + major: 195 + minor: 1 + fileMode: 438 + permissions: rwm + hooks: + - hookName: createRuntime + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - apply-cuda-memory-limits + - --driver-root + - /run/nvidia/driver + - --gpu-id + - GPU-ebd34bdf-1083-eaac-2aff-4b71a022f9bd + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createRuntime + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - apply-cuda-memory-limits + - --driver-root + - /run/nvidia/driver + - --gpu-id + - GPU-1795e88b-3395-b27b-dad8-0488474eec0c + env: + - NVIDIA_CTK_DEBUG=false +containerEdits: + env: + - NVIDIA_CTK_LIBCUDA_DIR=/usr/lib/x86_64-linux-gnu + - NVIDIA_VISIBLE_DEVICES=void + deviceNodes: + - path: /dev/nvidia-modeset + hostPath: /run/nvidia/driver/dev/nvidia-modeset + major: 195 + minor: 254 + fileMode: 438 + permissions: rwm + - path: /dev/nvidia-uvm + hostPath: /run/nvidia/driver/dev/nvidia-uvm + major: 511 + fileMode: 438 + permissions: rwm + - path: /dev/nvidia-uvm-tools + hostPath: /run/nvidia/driver/dev/nvidia-uvm-tools + major: 511 + minor: 1 + fileMode: 438 + permissions: rwm + - path: /dev/nvidiactl + hostPath: /run/nvidia/driver/dev/nvidiactl + major: 195 + minor: 255 + fileMode: 438 + permissions: rwm + hooks: + - hookName: createContainer + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - ../libnvidia-allocator.so.1::/usr/lib/x86_64-linux-gnu/gbm/nvidia-drm_gbm.so + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - libEGL_nvidia.so.615.71.09::/usr/lib/x86_64-linux-gnu/libEGL_nvidia.so.0 + - --link + - libGLESv1_CM_nvidia.so.615.71.09::/usr/lib/x86_64-linux-gnu/libGLESv1_CM_nvidia.so.1 + - --link + - libGLESv2_nvidia.so.615.71.09::/usr/lib/x86_64-linux-gnu/libGLESv2_nvidia.so.2 + - --link + - libGLX_nvidia.so.615.71.09::/usr/lib/x86_64-linux-gnu/libGLX_indirect.so.0 + - --link + - libGLX_nvidia.so.615.71.09::/usr/lib/x86_64-linux-gnu/libGLX_nvidia.so.0 + - --link + - libcuda.so.1::/usr/lib/x86_64-linux-gnu/libcuda.so + - --link + - libcuda.so.615.71.09::/usr/lib/x86_64-linux-gnu/libcuda.so.1 + - --link + - libcudadebugger.so.615.71.09::/usr/lib/x86_64-linux-gnu/libcudadebugger.so.1 + - --link + - libnvcuvid.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvcuvid.so.1 + - --link + - libnvcuvid.so.1::/usr/lib/x86_64-linux-gnu/libnvcuvid.so + - --link + - libnvidia-allocator.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-allocator.so.1 + - --link + - libnvidia-allocator.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-allocator.so + - --link + - libnvidia-cfg.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-cfg.so.1 + - --link + - libnvidia-cfg.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-cfg.so + - --link + - libnvidia-encode.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-encode.so.1 + - --link + - libnvidia-encode.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-encode.so + - --link + - libnvidia-fbc.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-fbc.so.1 + - --link + - libnvidia-fbc.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-fbc.so + - --link + - libnvidia-fmdrv.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-fmdrv.so.1 + - --link + - libnvidia-imex.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-imex.so.1 + - --link + - libnvidia-ml.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.1 + - --link + - libnvidia-ml.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-ml.so + - --link + - libnvidia-ngx.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-ngx.so.1 + - --link + - libnvidia-nscq.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-nscq.so.2 + - --link + - libnvidia-nscq.so.2::/usr/lib/x86_64-linux-gnu/libnvidia-nscq.so + - --link + - libnvidia-nvvm.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so.4 + - --link + - libnvidia-nvvm.so.4::/usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so + - --link + - libnvidia-opencl.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-opencl.so.1 + - --link + - libnvidia-opticalflow.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-opticalflow.so + - --link + - libnvidia-opticalflow.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-opticalflow.so.1 + - --link + - libnvidia-ptxjitcompiler.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so.1 + - --link + - libnvidia-ptxjitcompiler.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so + - --link + - libnvidia-sandboxutils.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-sandboxutils.so.1 + - --link + - libnvidia-sandboxutils.so.1::/usr/lib/x86_64-linux-gnu/libnvidia-sandboxutils.so + - --link + - libnvidia-vksc-core.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvidia-vksc-core.so.1 + - --link + - libnvoptix.so.615.71.09::/usr/lib/x86_64-linux-gnu/libnvoptix.so.1 + - --link + - libvdpau_nvidia.so.615.71.09::/usr/lib/x86_64-linux-gnu/vdpau/libvdpau_nvidia.so.1 + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - enable-cuda-compat + - --host-driver-version=615.71.09 + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - update-ldcache + - --folder + - /usr/lib/x86_64-linux-gnu + - --folder + - /usr/lib/x86_64-linux-gnu/vdpau + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - disable-device-node-modification + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/local/nvidia/toolkit/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - update-application-profile + env: + - NVIDIA_CTK_DEBUG=false + mounts: + - hostPath: /run/nvidia/driver/run/nvidia-persistenced/socket + containerPath: /run/nvidia-persistenced/socket + options: + - nosuid + - nodev + - rbind + - rprivate + - noexec + - hostPath: /run/nvidia/driver/usr/bin/nvidia-cuda-mps-control + containerPath: /usr/bin/nvidia-cuda-mps-control + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/bin/nvidia-cuda-mps-server + containerPath: /usr/bin/nvidia-cuda-mps-server + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/bin/nvidia-debugdump + containerPath: /usr/bin/nvidia-debugdump + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/bin/nvidia-imex + containerPath: /usr/bin/nvidia-imex + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/bin/nvidia-imex-ctl + containerPath: /usr/bin/nvidia-imex-ctl + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/bin/nvidia-persistenced + containerPath: /usr/bin/nvidia-persistenced + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/bin/nvidia-smi + containerPath: /usr/bin/nvidia-smi + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/bin/nvidia-xconfig + containerPath: /usr/bin/nvidia-xconfig + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/etc/OpenCL/vendors/nvidia.icd + containerPath: /etc/OpenCL/vendors/nvidia.icd + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/etc/vulkan/icd.d/nvidia_icd.json + containerPath: /etc/vulkan/icd.d/nvidia_icd.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/etc/vulkan/implicit_layer.d/nvidia_layers.json + containerPath: /etc/vulkan/implicit_layer.d/nvidia_layers.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libEGL_nvidia.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libEGL_nvidia.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libGLESv1_CM_nvidia.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libGLESv1_CM_nvidia.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libGLESv2_nvidia.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libGLESv2_nvidia.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libGLX_nvidia.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libGLX_nvidia.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libcuda.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libcuda.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libcudadebugger.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libcudadebugger.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvcuvid.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvcuvid.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-allocator.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-allocator.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-cfg.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-cfg.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-egl-gbm.so.1.1.3 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-egl-gbm.so.1.1.3 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-egl-wayland.so.1.1.20 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-egl-wayland.so.1.1.20 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-egl-wayland2.so.1.0.2 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-egl-wayland2.so.1.0.2 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-egl-xcb.so.1.0.6 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-egl-xcb.so.1.0.6 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-egl-xlib.so.1.0.6 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-egl-xlib.so.1.0.6 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-eglcore.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-eglcore.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-encode.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-encode.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-fbc.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-fbc.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-fmdrv.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-fmdrv.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-glcore.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-glcore.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-glsi.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-glsi.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-glvkspirv.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-glvkspirv.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-gpucomp.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-gpucomp.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-gtk2.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-gtk2.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-gtk3.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-gtk3.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-imex.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-imex.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-ml.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-ngx.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-ngx.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-nscq.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-nscq.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-nvvm70.so.4 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-nvvm70.so.4 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-opencl.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-opencl.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-opticalflow.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-opticalflow.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11-openssl3.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-pkcs11-openssl3.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-pkcs11.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-present.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-present.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-rtcore.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-rtcore.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-sandboxutils.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-sandboxutils.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-tileiras.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-tileiras.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-tls.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-tls.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-vksc-core.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-vksc-core.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvidia-wayland-client.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvidia-wayland-client.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/libnvoptix.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/libnvoptix.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/share/nvidia/nvoptix.bin + containerPath: /usr/share/nvidia/nvoptix.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_ga10x.bin + containerPath: /lib/firmware/nvidia/615.71.09/gsp_ga10x.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_tu10x.bin + containerPath: /lib/firmware/nvidia/615.71.09/gsp_tu10x.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/lib/x86_64-linux-gnu/vdpau/libvdpau_nvidia.so.615.71.09 + containerPath: /usr/lib/x86_64-linux-gnu/vdpau/libvdpau_nvidia.so.615.71.09 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/share/egl/egl_external_platform.d/09_nvidia_wayland2.json + containerPath: /usr/share/egl/egl_external_platform.d/09_nvidia_wayland2.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/share/egl/egl_external_platform.d/10_nvidia_wayland.json + containerPath: /usr/share/egl/egl_external_platform.d/10_nvidia_wayland.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/share/egl/egl_external_platform.d/15_nvidia_gbm.json + containerPath: /usr/share/egl/egl_external_platform.d/15_nvidia_gbm.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/share/egl/egl_external_platform.d/20_nvidia_xcb.json + containerPath: /usr/share/egl/egl_external_platform.d/20_nvidia_xcb.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/share/egl/egl_external_platform.d/20_nvidia_xlib.json + containerPath: /usr/share/egl/egl_external_platform.d/20_nvidia_xlib.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/usr/share/glvnd/egl_vendor.d/10_nvidia.json + containerPath: /usr/share/glvnd/egl_vendor.d/10_nvidia.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_ga10x.bin + containerPath: /run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_ga10x.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /run/nvidia/driver/run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_tu10x.bin + containerPath: /run/nvidia/driver/lib/firmware/nvidia/615.71.09/gsp_tu10x.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate diff --git a/crates/openshell-core/testdata/orin-nvidia-policy-baseline.json b/crates/openshell-core/testdata/orin-nvidia-policy-baseline.json new file mode 100644 index 0000000000..279b93629c --- /dev/null +++ b/crates/openshell-core/testdata/orin-nvidia-policy-baseline.json @@ -0,0 +1,97 @@ +{ + "device_node_paths": [ + "/dev/dri/card0", + "/dev/dri/renderD128", + "/dev/host1x-fence", + "/dev/nvgpu/igpu0/as", + "/dev/nvgpu/igpu0/channel", + "/dev/nvgpu/igpu0/ctrl", + "/dev/nvgpu/igpu0/ctxsw", + "/dev/nvgpu/igpu0/dbg", + "/dev/nvgpu/igpu0/nvsched", + "/dev/nvgpu/igpu0/power", + "/dev/nvgpu/igpu0/prof", + "/dev/nvgpu/igpu0/prof-ctx", + "/dev/nvgpu/igpu0/prof-dev", + "/dev/nvgpu/igpu0/sched", + "/dev/nvgpu/igpu0/tsg", + "/dev/nvhost-as-gpu", + "/dev/nvhost-ctrl-gpu", + "/dev/nvhost-ctxsw-gpu", + "/dev/nvhost-dbg-gpu", + "/dev/nvhost-gpu", + "/dev/nvhost-nvsched-gpu", + "/dev/nvhost-power-gpu", + "/dev/nvhost-prof-ctx-gpu", + "/dev/nvhost-prof-dev-gpu", + "/dev/nvhost-prof-gpu", + "/dev/nvhost-sched-gpu", + "/dev/nvhost-tsg-gpu", + "/dev/nvidia0", + "/dev/nvidiactl", + "/dev/nvmap", + "/dev/nvsciipc", + "/dev/v4l2-nvdec" + ], + "read_only_paths": [ + "/dev/dri/by-path", + "/etc/nv_tegra_release", + "/etc/vulkansc/icd.d/nvidia_icd_vksc.json", + "/usr/bin/nvidia-cuda-mps-control", + "/usr/bin/nvidia-cuda-mps-server", + "/usr/lib/aarch64-linux-gnu/nvidia", + "/usr/lib/aarch64-linux-gnu/nvidia/ld.so.conf", + "/usr/lib/aarch64-linux-gnu/nvidia/nvidia_icd.json", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLInputEventExample", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLMockNavigation", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/LayerManagerControl", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/simple-weston-client", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/spring-tool", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-calibrator", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-clickdot", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-cliptest", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-content-protection", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-debug", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-desktop-shell", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-dnd", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-eventdemo", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-flower", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-fullscreen", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-image", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-ivi-shell-user-interface", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-keyboard", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-multi-resource", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-presentation-shm", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-resizor", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-scaler", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-screenshooter", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-damage", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egl", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egldevice", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-feedback", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-egl", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-im", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-shm", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-touch", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-smoke", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-stacking", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-subsurfaces", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-tablet", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-terminal", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-touch-calibrator", + "/usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-transformed", + "/usr/lib/aarch64-linux-gnu/tegra-egl", + "/usr/lib/aarch64-linux-gnu/tegra-egl/ld.so.conf", + "/usr/lib/aarch64-linux-gnu/tegra-egl/nvidia.json", + "/usr/lib/firmware/tegra23x/nvhost_nvdec050_desc_prod.bin", + "/usr/sbin/nvidia-smi" + ], + "read_write_mount_paths": [], + "additional_gids": [ + 44, + 104, + 995 + ] +} diff --git a/crates/openshell-core/testdata/orin-nvidia.yaml b/crates/openshell-core/testdata/orin-nvidia.yaml new file mode 100644 index 0000000000..1fdc0aaeaa --- /dev/null +++ b/crates/openshell-core/testdata/orin-nvidia.yaml @@ -0,0 +1,2219 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Captured from orin-dev:/var/run/cdi/nvidia.yaml on 2026-09-17. +# Original SHA-256: 52d0de5622e816351b256213e21f72d32b3ea4e4dbb2de68ce1afe7e13e80b36 +--- +cdiVersion: 0.7.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: /dev/host1x-fence + major: 492 + fileMode: 438 + permissions: rwm + - path: /dev/nvhost-as-gpu + major: 505 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-ctrl-gpu + major: 505 + minor: 2 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-ctxsw-gpu + major: 505 + minor: 3 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-dbg-gpu + major: 505 + minor: 4 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-gpu + major: 505 + minor: 1 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-nvsched-gpu + major: 505 + minor: 9 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-power-gpu + major: 506 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-prof-ctx-gpu + major: 505 + minor: 6 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-prof-dev-gpu + major: 505 + minor: 7 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-prof-gpu + major: 505 + minor: 5 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-sched-gpu + major: 505 + minor: 8 + fileMode: 432 + permissions: rwm + - path: /dev/nvhost-tsg-gpu + major: 505 + minor: 11 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + - path: /dev/nvidiactl + major: 195 + minor: 255 + fileMode: 438 + permissions: rwm + - path: /dev/nvmap + major: 10 + minor: 124 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvsciipc + major: 507 + fileMode: 438 + permissions: rwm + - path: /dev/v4l2-nvdec + major: 1 + minor: 3 + fileMode: 438 + permissions: rwm + - path: /dev/dri/card0 + major: 226 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/dri/renderD128 + major: 226 + minor: 128 + fileMode: 432 + permissions: rwm + gid: 104 + - path: /dev/nvgpu/igpu0/as + major: 505 + minor: 12 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/channel + major: 505 + minor: 13 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/ctrl + major: 505 + minor: 14 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/ctxsw + major: 505 + minor: 15 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/dbg + major: 505 + minor: 16 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/nvsched + major: 505 + minor: 21 + fileMode: 416 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/power + major: 506 + minor: 1 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/prof + major: 505 + minor: 17 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/prof-ctx + major: 505 + minor: 18 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/prof-dev + major: 505 + minor: 19 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/sched + major: 505 + minor: 20 + fileMode: 432 + permissions: rwm + - path: /dev/nvgpu/igpu0/tsg + major: 505 + minor: 23 + fileMode: 432 + permissions: rwm + gid: 44 + additionalGids: + - 44 + - 104 + - 995 + - name: all + containerEdits: + deviceNodes: + - path: /dev/host1x-fence + major: 492 + fileMode: 438 + permissions: rwm + - path: /dev/nvhost-as-gpu + major: 505 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-ctrl-gpu + major: 505 + minor: 2 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-ctxsw-gpu + major: 505 + minor: 3 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-dbg-gpu + major: 505 + minor: 4 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-gpu + major: 505 + minor: 1 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-nvsched-gpu + major: 505 + minor: 9 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-power-gpu + major: 506 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvhost-prof-ctx-gpu + major: 505 + minor: 6 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-prof-dev-gpu + major: 505 + minor: 7 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-prof-gpu + major: 505 + minor: 5 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvhost-sched-gpu + major: 505 + minor: 8 + fileMode: 432 + permissions: rwm + - path: /dev/nvhost-tsg-gpu + major: 505 + minor: 11 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + - path: /dev/nvidiactl + major: 195 + minor: 255 + fileMode: 438 + permissions: rwm + - path: /dev/nvmap + major: 10 + minor: 124 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvsciipc + major: 507 + fileMode: 438 + permissions: rwm + - path: /dev/v4l2-nvdec + major: 1 + minor: 3 + fileMode: 438 + permissions: rwm + - path: /dev/dri/card0 + major: 226 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/dri/renderD128 + major: 226 + minor: 128 + fileMode: 432 + permissions: rwm + gid: 104 + - path: /dev/nvgpu/igpu0/as + major: 505 + minor: 12 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/channel + major: 505 + minor: 13 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/ctrl + major: 505 + minor: 14 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/ctxsw + major: 505 + minor: 15 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/dbg + major: 505 + minor: 16 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/nvsched + major: 505 + minor: 21 + fileMode: 416 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/power + major: 506 + minor: 1 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/nvgpu/igpu0/prof + major: 505 + minor: 17 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/prof-ctx + major: 505 + minor: 18 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/prof-dev + major: 505 + minor: 19 + fileMode: 432 + permissions: rwm + gid: 995 + - path: /dev/nvgpu/igpu0/sched + major: 505 + minor: 20 + fileMode: 432 + permissions: rwm + - path: /dev/nvgpu/igpu0/tsg + major: 505 + minor: 23 + fileMode: 432 + permissions: rwm + gid: 44 + additionalGids: + - 44 + - 104 + - 995 +containerEdits: + env: + - NVIDIA_VISIBLE_DEVICES=void + hooks: + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - libcuda.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libcuda.so + - --link + - libcuda.so.1.1::/usr/lib/aarch64-linux-gnu/nvidia/libcuda.so.1 + - --link + - libnvbufsurface.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurface.so + - --link + - libnvbufsurftransform.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurftransform.so + - --link + - libnvdsbufferpool.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvdsbufferpool.so + - --link + - libnvidia-allocator.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-allocator.so + - --link + - libnvidia-egl-gbm.so.1.1.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-gbm.so.1 + - --link + - libnvidia-egl-wayland.so.1.1.11::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-wayland.so.1 + - --link + - libnvidia-kms.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-kms.so + - --link + - libnvidia-nvvm.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-nvvm.so.4 + - --link + - libnvidia-ptxjitcompiler.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ptxjitcompiler.so.1 + - --link + - libnvidia-vksc-core.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-vksc-core.so + - --link + - libnvid_mapper.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvid_mapper.so + - --link + - libnvscibuf.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscibuf.so + - --link + - libnvscicommon.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscicommon.so + - --link + - libnvscistream.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscistream.so + - --link + - libnvscisync.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscisync.so + - --link + - libvulkansc.so.1.0.10::/usr/lib/aarch64-linux-gnu/nvidia/libvulkansc.so.1 + - --link + - libvulkansc.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libvulkansc.so + - --link + - libwayland-client.so.0.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-client.so.0 + - --link + - libwayland-client.so.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-client.so + - --link + - libwayland-cursor.so.0.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-cursor.so.0 + - --link + - libwayland-cursor.so.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-cursor.so + - --link + - libwayland-egl.so.1.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-egl.so.1 + - --link + - libwayland-egl.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-egl.so + - --link + - libwayland-server.so.0.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-server.so.0 + - --link + - libwayland-server.so.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-server.so + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - /usr/lib/aarch64-linux-gnu/nvidia/nvidia_icd.json::/etc/vulkan/icd.d/nvidia_icd.json + - --link + - ../nvidia/libnvidia-allocator.so::/usr/lib/aarch64-linux-gnu/gbm/nvidia-drm_gbm.so + - --link + - libnvidia-allocator.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-allocator.so + - --link + - ../nvidia/libnvidia-allocator.so::/usr/lib/aarch64-linux-gnu/gbm/tegra_gbm.so + - --link + - ../nvidia/libnvidia-allocator.so::/usr/lib/aarch64-linux-gnu/gbm/tegra-udrm_gbm.so + - --link + - nvidia/libcuda.so::/usr/lib/aarch64-linux-gnu/libcuda.so + - --link + - libcuda.so.1.1::/usr/lib/aarch64-linux-gnu/nvidia/libcuda.so + - --link + - nvidia/libnvcucompat.so::/usr/lib/aarch64-linux-gnu/libnvcucompat.so + - --link + - nvidia/libnvcudla.so::/usr/lib/aarch64-linux-gnu/libnvcudla.so + - --link + - nvidia/libnvv4l2.so::/usr/lib/aarch64-linux-gnu/libv4l2.so.0.0.999999 + - --link + - nvidia/libnvv4lconvert.so::/usr/lib/aarch64-linux-gnu/libv4lconvert.so.0.0.999999 + - --link + - ../../../nvidia/libv4l2_nvargus.so::/usr/lib/aarch64-linux-gnu/libv4l/plugins/nv/libv4l2_nvargus.so + - --link + - ../../../nvidia/libv4l2_nvcuvidvideocodec.so::/usr/lib/aarch64-linux-gnu/libv4l/plugins/nv/libv4l2_nvcuvidvideocodec.so + - --link + - ../../../nvidia/libv4l2_nvvideocodec.so::/usr/lib/aarch64-linux-gnu/libv4l/plugins/nv/libv4l2_nvvideocodec.so + - --link + - libcuda.so.1.1::/usr/lib/aarch64-linux-gnu/nvidia/libcuda.so.1 + - --link + - libnvbufsurface.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurface.so + - --link + - libnvbufsurftransform.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurftransform.so + - --link + - libnvdsbufferpool.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvdsbufferpool.so + - --link + - libnvidia-egl-gbm.so.1.1.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-gbm.so.1 + - --link + - libnvidia-egl-wayland.so.1.1.11::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-wayland.so.1 + - --link + - libnvidia-kms.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-kms.so + - --link + - libnvidia-nvvm.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-nvvm.so.4 + - --link + - libnvidia-ptxjitcompiler.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ptxjitcompiler.so.1 + - --link + - libnvidia-vksc-core.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-vksc-core.so + - --link + - libnvidia-vksc-core.so.540.5.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvidia-vksc-core.so.1 + - --link + - libnvid_mapper.so.1.0.0::/usr/lib/aarch64-linux-gnu/nvidia/libnvid_mapper.so + - --link + - libnvscibuf.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscibuf.so + - --link + - libnvscicommon.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscicommon.so + - --link + - libnvscistream.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscistream.so + - --link + - libnvscisync.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libnvscisync.so + - --link + - libnvv4l2.so::/usr/lib/aarch64-linux-gnu/nvidia/libv4l2.so.0 + - --link + - libnvv4lconvert.so::/usr/lib/aarch64-linux-gnu/nvidia/libv4lconvert.so.0 + - --link + - libvulkansc.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libvulkansc.so + - --link + - libvulkansc.so.1.0.10::/usr/lib/aarch64-linux-gnu/nvidia/libvulkansc.so.1 + - --link + - libwayland-client.so.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-client.so + - --link + - libwayland-client.so.0.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-client.so.0 + - --link + - libwayland-cursor.so.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-cursor.so + - --link + - libwayland-cursor.so.0.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-cursor.so.0 + - --link + - libwayland-egl.so.1::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-egl.so + - --link + - libwayland-egl.so.1.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-egl.so.1 + - --link + - libwayland-server.so.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-server.so + - --link + - libwayland-server.so.0.22.0::/usr/lib/aarch64-linux-gnu/nvidia/libwayland-server.so.0 + - --link + - ../../../lib/aarch64-linux-gnu/tegra-egl/nvidia.json::/usr/share/glvnd/egl_vendor.d/10_nvidia.json + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - enable-cuda-compat + - --host-cuda-version=12.6 + - --cuda-compat-container-root=/dev/null + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - update-ldcache + - --folder + - /usr/lib/aarch64-linux-gnu/nvidia + - --folder + - /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0 + - --folder + - /usr/lib/aarch64-linux-gnu/tegra-egl + env: + - NVIDIA_CTK_DEBUG=false + mounts: + - hostPath: /etc/nv_tegra_release + containerPath: /etc/nv_tegra_release + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /dev/dri/by-path + containerPath: /dev/dri/by-path + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/bin/nvidia-cuda-mps-control + containerPath: /usr/bin/nvidia-cuda-mps-control + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/bin/nvidia-cuda-mps-server + containerPath: /usr/bin/nvidia-cuda-mps-server + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/sbin/nvidia-smi + containerPath: /usr/sbin/nvidia-smi + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /etc/vulkansc/icd.d/nvidia_icd_vksc.json + containerPath: /etc/vulkansc/icd.d/nvidia_icd_vksc.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/ld.so.conf + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/ld.so.conf + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libGLX_nvidia.so.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libGLX_nvidia.so.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libVkLayer_json_gen.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libVkLayer_json_gen.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libVkSCLayer_khronos_validation.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libVkSCLayer_khronos_validation.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libcuda.so.1.1 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libcuda.so.1.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libjetsonpower.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libjetsonpower.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvargus.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvargus.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvargus_socketclient.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvargus_socketclient.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvargus_socketserver.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvargus_socketserver.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvbuf_fdmap.so.1.0.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvbuf_fdmap.so.1.0.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurface.so.1.0.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurface.so.1.0.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurftransform.so.1.0.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvbufsurftransform.so.1.0.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcam_imageencoder.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcam_imageencoder.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcameratools.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcameratools.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcamerautils.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcamerautils.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcamlog.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcamlog.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcamv4l2.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcamv4l2.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcapture.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcapture.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcolorutil.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcolorutil.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcucompat.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcucompat.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcudla.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcudla.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcuvidv4l2.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvcuvidv4l2.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdc.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdc.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvddk_2d_v2.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvddk_2d_v2.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvddk_vic.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvddk_vic.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdecode2eglimage.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdecode2eglimage.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdla_runtime.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdla_runtime.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdsbufferpool.so.1.0.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvdsbufferpool.so.1.0.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnveventlib.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnveventlib.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvexif.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvexif.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfnet.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfnet.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfnetstoredefog.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfnetstoredefog.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfnetstorehdfx.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfnetstorehdfx.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfusacap.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfusacap.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfusacapinterface.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvfusacapinterface.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_boot.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_boot.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_camera.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_camera.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_force.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_force.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_generic.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_generic.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_gpucompute.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_gpucompute.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_graphics.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_graphics.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_il.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_il.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_spincircle.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_spincircle.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_tbc.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_tbc.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_ui.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvgov_ui.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvid_mapper.so.1.0.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvid_mapper.so.1.0.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-allocator.so.1 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-allocator.so.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-gbm.so.1.1.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-gbm.so.1.1.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-wayland.so.1.1.11 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-egl-wayland.so.1.1.11 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-eglcore.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-eglcore.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glcore.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glcore.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glsi.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glsi.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glvkspirv.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-glvkspirv.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-gpucomp.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-gpucomp.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-kms.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-kms.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ml.so.1 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ml.so.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-nvvm.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-nvvm.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ptxjitcompiler.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-ptxjitcompiler.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-rmapi-tegra.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-rmapi-tegra.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-rtcore.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-rtcore.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-tls.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-tls.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-vksc-core.so.540.5.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvidia-vksc-core.so.540.5.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvimp.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvimp.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvisp.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvisp.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvisp_utils.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvisp_utils.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvisppg.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvisppg.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvjpeg.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvjpeg.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia2d.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia2d.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_2d.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_2d.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_dla.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_dla.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_eglstream.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_eglstream.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ide_parser.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ide_parser.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ide_sci.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ide_sci.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_iep_sci.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_iep_sci.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ijpd_sci.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ijpd_sci.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ijpe_sci.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_ijpe_sci.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_iofa_sci.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_iofa_sci.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_isp_ext.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_isp_ext.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_tensor.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedia_tensor.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedialdc.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmedialdc.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm_contentpipe.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm_contentpipe.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm_parser.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm_parser.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm_utils.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmm_utils.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_image.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_image.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_utils.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_utils.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_video.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvmmlite_video.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvodm_imager.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvodm_imager.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvofsdk.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvofsdk.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvomx.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvomx.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvomxilclient.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvomxilclient.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvos.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvos.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvosd.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvosd.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvparser.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvparser.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvphs.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvphs.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvphsd.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvphsd.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvplayfair.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvplayfair.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpva.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpva.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpva_algorithms.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpva_algorithms.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpvaintf.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpvaintf.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpvaumd.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvpvaumd.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_chip.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_chip.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_gpu.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_gpu.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_host1x.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_host1x.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_mem.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_mem.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_stream.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_stream.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_surface.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_surface.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_sync.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvrm_sync.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscf.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscf.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscibuf.so.1 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscibuf.so.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscicommon.so.1 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscicommon.so.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscievent.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscievent.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvsciipc.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvsciipc.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscistream.so.1 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscistream.so.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscisync.so.1 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvscisync.so.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvsocsys.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvsocsys.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtegrahv.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtegrahv.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtracebuf.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtracebuf.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtvmr.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtvmr.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtvmr_2d.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvtvmr_2d.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvv4l2.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvv4l2.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvv4lconvert.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvv4lconvert.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvvic.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvvic.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvvideo.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvvideo.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvvideoencode_ppe.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libnvvideoencode_ppe.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libsensors.hal-client.nvs.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libsensors.hal-client.nvs.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libsensors.l4t.no_fusion.nvs.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libsensors.l4t.no_fusion.nvs.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libsensors_hal.nvs.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libsensors_hal.nvs.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libtegrav4l2.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libtegrav4l2.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libtegrawfd.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libtegrawfd.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvargus.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvargus.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvcuvidvideocodec.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvcuvidvideocodec.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvvideocodec.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libv4l2_nvvideocodec.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libvulkansc.so.1.0.10 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libvulkansc.so.1.0.10 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-client.so.0.22.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-client.so.0.22.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-cursor.so.0.22.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-cursor.so.0.22.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-egl.so.1.22.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-egl.so.1.22.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-server.so.0.22.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/libwayland-server.so.0.22.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/nvidia_icd.json + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/nvidia_icd.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/tegra-egl/ld.so.conf + containerPath: /usr/lib/aarch64-linux-gnu/tegra-egl/ld.so.conf + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/tegra-egl/libEGL_nvidia.so.0 + containerPath: /usr/lib/aarch64-linux-gnu/tegra-egl/libEGL_nvidia.so.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/tegra-egl/libGLESv1_CM_nvidia.so.1 + containerPath: /usr/lib/aarch64-linux-gnu/tegra-egl/libGLESv1_CM_nvidia.so.1 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/tegra-egl/libGLESv2_nvidia.so.2 + containerPath: /usr/lib/aarch64-linux-gnu/tegra-egl/libGLESv2_nvidia.so.2 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/tegra-egl/nvidia.json + containerPath: /usr/lib/aarch64-linux-gnu/tegra-egl/nvidia.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/firmware/tegra23x/nvhost_nvdec050_desc_prod.bin + containerPath: /usr/lib/firmware/tegra23x/nvhost_nvdec050_desc_prod.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLInputEventExample + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLInputEventExample + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLMockNavigation + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/EGLWLMockNavigation + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/LayerManagerControl + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/LayerManagerControl + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/color-lcms.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/color-lcms.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/desktop-shell.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/desktop-shell.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/drm-backend.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/drm-backend.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/fullscreen-shell.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/fullscreen-shell.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/gl-renderer.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/gl-renderer.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/headless-backend.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/headless-backend.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/hmi-controller.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/hmi-controller.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/ivi-controller.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/ivi-controller.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/ivi-shell.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/ivi-shell.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmClient.so.2.3.2 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmClient.so.2.3.2 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmCommon.so.2.3.2 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmCommon.so.2.3.2 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmControl.so.2.3.2 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmControl.so.2.3.2 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmInput.so.2.3.2 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libilmInput.so.2.3.2 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libweston-13.so.0 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/libweston-13.so.0 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/simple-weston-client + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/simple-weston-client + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/spring-tool + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/spring-tool + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/wayland-backend.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/wayland-backend.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-calibrator + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-calibrator + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-clickdot + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-clickdot + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-cliptest + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-cliptest + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-content-protection + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-content-protection + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-debug + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-debug + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-desktop-shell + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-desktop-shell + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-dnd + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-dnd + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-eventdemo + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-eventdemo + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-flower + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-flower + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-fullscreen + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-fullscreen + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-image + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-image + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-ivi-shell-user-interface + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-ivi-shell-user-interface + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-keyboard + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-keyboard + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-multi-resource + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-multi-resource + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-presentation-shm + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-presentation-shm + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-resizor + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-resizor + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-scaler + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-scaler + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-screenshooter + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-screenshooter + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-damage + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-damage + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egl + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egl + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egldevice + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-egldevice + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-feedback + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-dmabuf-feedback + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-egl + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-egl + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-im + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-im + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-shm + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-shm + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-touch + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-simple-touch + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-smoke + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-smoke + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-stacking + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-stacking + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-subsurfaces + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-subsurfaces + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-tablet + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-tablet + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-terminal + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-terminal + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-touch-calibrator + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-touch-calibrator + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-transformed + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/weston-13.0/weston-transformed + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + diff --git a/crates/openshell-core/testdata/spark-nvidia-policy-baseline.json b/crates/openshell-core/testdata/spark-nvidia-policy-baseline.json new file mode 100644 index 0000000000..fe9cf9637a --- /dev/null +++ b/crates/openshell-core/testdata/spark-nvidia-policy-baseline.json @@ -0,0 +1,36 @@ +{ + "device_node_paths": [ + "/dev/dri/card0", + "/dev/dri/renderD128", + "/dev/nvidia-modeset", + "/dev/nvidia-uvm", + "/dev/nvidia-uvm-tools", + "/dev/nvidia0", + "/dev/nvidiactl" + ], + "read_only_paths": [ + "/etc/vulkan/icd.d/nvidia_icd.json", + "/etc/vulkan/implicit_layer.d/nvidia_layers.json", + "/lib/firmware/nvidia/580.142/gsp_ga10x.bin", + "/lib/firmware/nvidia/580.142/gsp_tu10x.bin", + "/run/nvidia-persistenced/socket", + "/usr/bin/nvidia-cuda-mps-control", + "/usr/bin/nvidia-cuda-mps-server", + "/usr/bin/nvidia-debugdump", + "/usr/bin/nvidia-persistenced", + "/usr/bin/nvidia-smi", + "/usr/lib/aarch64-linux-gnu", + "/usr/lib/aarch64-linux-gnu/nvidia/xorg", + "/usr/lib/aarch64-linux-gnu/vdpau", + "/usr/share/X11/xorg.conf.d/10-nvidia.conf", + "/usr/share/egl/egl_external_platform.d/10_nvidia_wayland.json", + "/usr/share/egl/egl_external_platform.d/15_nvidia_gbm.json", + "/usr/share/glvnd/egl_vendor.d/10_nvidia.json", + "/usr/share/nvidia/nvoptix.bin" + ], + "read_write_mount_paths": [], + "additional_gids": [ + 44, + 993 + ] +} diff --git a/crates/openshell-core/testdata/spark-nvidia.yaml b/crates/openshell-core/testdata/spark-nvidia.yaml new file mode 100644 index 0000000000..e026124d9b --- /dev/null +++ b/crates/openshell-core/testdata/spark-nvidia.yaml @@ -0,0 +1,600 @@ +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Captured from spark-dev:/var/run/cdi/nvidia.yaml on 2026-09-17. +# SHA-256: 86913dad81e83b8314dbae9eebd5279b606d701b712180a7c390277932cf287e +--- +cdiVersion: 0.7.0 +kind: nvidia.com/gpu +devices: + - name: "0" + containerEdits: + deviceNodes: + - path: /dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + - path: /dev/dri/card0 + major: 226 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/dri/renderD128 + major: 226 + minor: 128 + fileMode: 432 + permissions: rwm + gid: 993 + hooks: + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - ../card0::/dev/dri/by-path/pci-000f:01:00.0-card + - --link + - ../renderD128::/dev/dri/by-path/pci-000f:01:00.0-render + env: + - NVIDIA_CTK_DEBUG=false + additionalGids: + - 44 + - 993 + - name: GPU-017980a8-44ff-7f9c-320d-a7f9fa4d808c + containerEdits: + deviceNodes: + - path: /dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + - path: /dev/dri/card0 + major: 226 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/dri/renderD128 + major: 226 + minor: 128 + fileMode: 432 + permissions: rwm + gid: 993 + hooks: + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - ../card0::/dev/dri/by-path/pci-000f:01:00.0-card + - --link + - ../renderD128::/dev/dri/by-path/pci-000f:01:00.0-render + env: + - NVIDIA_CTK_DEBUG=false + additionalGids: + - 44 + - 993 + - name: all + containerEdits: + deviceNodes: + - path: /dev/nvidia0 + major: 195 + fileMode: 438 + permissions: rwm + - path: /dev/dri/card0 + major: 226 + fileMode: 432 + permissions: rwm + gid: 44 + - path: /dev/dri/renderD128 + major: 226 + minor: 128 + fileMode: 432 + permissions: rwm + gid: 993 + hooks: + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - ../card0::/dev/dri/by-path/pci-000f:01:00.0-card + - --link + - ../renderD128::/dev/dri/by-path/pci-000f:01:00.0-render + env: + - NVIDIA_CTK_DEBUG=false + additionalGids: + - 44 + - 993 +containerEdits: + env: + - NVIDIA_CTK_LIBCUDA_DIR=/usr/lib/aarch64-linux-gnu + - NVIDIA_VISIBLE_DEVICES=void + deviceNodes: + - path: /dev/nvidia-modeset + major: 195 + minor: 254 + fileMode: 438 + permissions: rwm + - path: /dev/nvidia-uvm + major: 498 + fileMode: 438 + permissions: rwm + - path: /dev/nvidia-uvm-tools + major: 498 + minor: 1 + fileMode: 438 + permissions: rwm + - path: /dev/nvidiactl + major: 195 + minor: 255 + fileMode: 438 + permissions: rwm + hooks: + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - ../libnvidia-allocator.so.1::/usr/lib/aarch64-linux-gnu/gbm/nvidia-drm_gbm.so + - --link + - libglxserver_nvidia.so.580.142::/usr/lib/aarch64-linux-gnu/nvidia/xorg/libglxserver_nvidia.so + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - create-symlinks + - --link + - libEGL_nvidia.so.580.142::/usr/lib/aarch64-linux-gnu/libEGL_nvidia.so.0 + - --link + - libGLESv1_CM_nvidia.so.580.142::/usr/lib/aarch64-linux-gnu/libGLESv1_CM_nvidia.so.1 + - --link + - libGLESv2_nvidia.so.580.142::/usr/lib/aarch64-linux-gnu/libGLESv2_nvidia.so.2 + - --link + - libGLX_nvidia.so.580.142::/usr/lib/aarch64-linux-gnu/libGLX_indirect.so.0 + - --link + - libGLX_nvidia.so.580.142::/usr/lib/aarch64-linux-gnu/libGLX_nvidia.so.0 + - --link + - libcuda.so.1::/usr/lib/aarch64-linux-gnu/libcuda.so + - --link + - libcuda.so.580.142::/usr/lib/aarch64-linux-gnu/libcuda.so.1 + - --link + - libcudadebugger.so.580.142::/usr/lib/aarch64-linux-gnu/libcudadebugger.so.1 + - --link + - libnvcuvid.so.580.142::/usr/lib/aarch64-linux-gnu/libnvcuvid.so.1 + - --link + - libnvcuvid.so.1::/usr/lib/aarch64-linux-gnu/libnvcuvid.so + - --link + - libnvidia-allocator.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-allocator.so.1 + - --link + - libnvidia-allocator.so.1::/usr/lib/aarch64-linux-gnu/libnvidia-allocator.so + - --link + - libnvidia-cfg.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-cfg.so.1 + - --link + - libnvidia-cfg.so.1::/usr/lib/aarch64-linux-gnu/libnvidia-cfg.so + - --link + - libnvidia-encode.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-encode.so.1 + - --link + - libnvidia-encode.so.1::/usr/lib/aarch64-linux-gnu/libnvidia-encode.so + - --link + - libnvidia-fbc.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-fbc.so.1 + - --link + - libnvidia-fbc.so.1::/usr/lib/aarch64-linux-gnu/libnvidia-fbc.so + - --link + - libnvidia-ml.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-ml.so.1 + - --link + - libnvidia-ml.so.1::/usr/lib/aarch64-linux-gnu/libnvidia-ml.so + - --link + - libnvidia-ngx.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-ngx.so.1 + - --link + - libnvidia-nvvm.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-nvvm.so.4 + - --link + - libnvidia-nvvm.so.4::/usr/lib/aarch64-linux-gnu/libnvidia-nvvm.so + - --link + - libnvidia-opencl.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-opencl.so.1 + - --link + - libnvidia-opticalflow.so.1::/usr/lib/aarch64-linux-gnu/libnvidia-opticalflow.so + - --link + - libnvidia-opticalflow.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-opticalflow.so.1 + - --link + - libnvidia-ptxjitcompiler.so.580.142::/usr/lib/aarch64-linux-gnu/libnvidia-ptxjitcompiler.so.1 + - --link + - libnvidia-ptxjitcompiler.so.1::/usr/lib/aarch64-linux-gnu/libnvidia-ptxjitcompiler.so + - --link + - libnvoptix.so.580.142::/usr/lib/aarch64-linux-gnu/libnvoptix.so.1 + - --link + - libvdpau_nvidia.so.580.142::/usr/lib/aarch64-linux-gnu/vdpau/libvdpau_nvidia.so.1 + - --link + - libvdpau_nvidia.so.1::/usr/lib/aarch64-linux-gnu/vdpau/libvdpau_nvidia.so + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - enable-cuda-compat + - --host-driver-version=580.142 + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - update-ldcache + - --folder + - /usr/lib/aarch64-linux-gnu + - --folder + - /usr/lib/aarch64-linux-gnu/vdpau + env: + - NVIDIA_CTK_DEBUG=false + - hookName: createContainer + path: /usr/bin/nvidia-cdi-hook + args: + - nvidia-cdi-hook + - disable-device-node-modification + env: + - NVIDIA_CTK_DEBUG=false + mounts: + - hostPath: /run/nvidia-persistenced/socket + containerPath: /run/nvidia-persistenced/socket + options: + - nosuid + - nodev + - rbind + - rprivate + - noexec + - hostPath: /usr/bin/nvidia-cuda-mps-control + containerPath: /usr/bin/nvidia-cuda-mps-control + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/bin/nvidia-cuda-mps-server + containerPath: /usr/bin/nvidia-cuda-mps-server + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/bin/nvidia-debugdump + containerPath: /usr/bin/nvidia-debugdump + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/bin/nvidia-persistenced + containerPath: /usr/bin/nvidia-persistenced + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/bin/nvidia-smi + containerPath: /usr/bin/nvidia-smi + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/share/vulkan/icd.d/nvidia_icd.json + containerPath: /etc/vulkan/icd.d/nvidia_icd.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/share/vulkan/implicit_layer.d/nvidia_layers.json + containerPath: /etc/vulkan/implicit_layer.d/nvidia_layers.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libEGL_nvidia.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libEGL_nvidia.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libGLESv1_CM_nvidia.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libGLESv1_CM_nvidia.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libGLESv2_nvidia.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libGLESv2_nvidia.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libGLX_nvidia.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libGLX_nvidia.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libcuda.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libcuda.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libcudadebugger.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libcudadebugger.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvcuvid.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvcuvid.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-allocator.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-allocator.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-cfg.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-cfg.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-egl-gbm.so.1.1.3 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-egl-gbm.so.1.1.3 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-egl-wayland.so.1.1.21 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-egl-wayland.so.1.1.21 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-eglcore.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-eglcore.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-encode.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-encode.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-fbc.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-fbc.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-glcore.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-glcore.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-glsi.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-glsi.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-glvkspirv.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-glvkspirv.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-gpucomp.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-gpucomp.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-ml.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-ml.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-ngx.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-ngx.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-nvvm.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-nvvm.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-opencl.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-opencl.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-opticalflow.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-opticalflow.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-ptxjitcompiler.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-ptxjitcompiler.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-rtcore.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-rtcore.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvidia-tls.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvidia-tls.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/libnvoptix.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/libnvoptix.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/share/nvidia/nvoptix.bin + containerPath: /usr/share/nvidia/nvoptix.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /lib/firmware/nvidia/580.142/gsp_ga10x.bin + containerPath: /lib/firmware/nvidia/580.142/gsp_ga10x.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /lib/firmware/nvidia/580.142/gsp_tu10x.bin + containerPath: /lib/firmware/nvidia/580.142/gsp_tu10x.bin + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/vdpau/libvdpau_nvidia.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/vdpau/libvdpau_nvidia.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/share/X11/xorg.conf.d/10-nvidia.conf + containerPath: /usr/share/X11/xorg.conf.d/10-nvidia.conf + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/share/egl/egl_external_platform.d/10_nvidia_wayland.json + containerPath: /usr/share/egl/egl_external_platform.d/10_nvidia_wayland.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/share/egl/egl_external_platform.d/15_nvidia_gbm.json + containerPath: /usr/share/egl/egl_external_platform.d/15_nvidia_gbm.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/share/glvnd/egl_vendor.d/10_nvidia.json + containerPath: /usr/share/glvnd/egl_vendor.d/10_nvidia.json + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/xorg/libglxserver_nvidia.so.580.142 + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/xorg/libglxserver_nvidia.so.580.142 + options: + - ro + - nosuid + - nodev + - rbind + - rprivate + - hostPath: /usr/lib/aarch64-linux-gnu/nvidia/xorg/nvidia_drv.so + containerPath: /usr/lib/aarch64-linux-gnu/nvidia/xorg/nvidia_drv.so + options: + - ro + - nosuid + - nodev + - rbind + - rprivate diff --git a/deny.toml b/deny.toml index 62ce9a909f..0ecd37519a 100644 --- a/deny.toml +++ b/deny.toml @@ -69,4 +69,4 @@ external-default-features = "allow" unknown-registry = "deny" unknown-git = "deny" allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] +allow-git = ["https://github.com/cncf-tags/container-device-interface-rs"] diff --git a/examples/governance-interceptor/Cargo.lock b/examples/governance-interceptor/Cargo.lock index 9aeef0fec9..108450f27f 100644 --- a/examples/governance-interceptor/Cargo.lock +++ b/examples/governance-interceptor/Cargo.lock @@ -17,6 +17,20 @@ version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" +[[package]] +name = "ahash" +version = "0.8.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75" +dependencies = [ + "cfg-if", + "getrandom 0.3.4", + "once_cell", + "serde", + "version_check", + "zerocopy", +] + [[package]] name = "aho-corasick" version = "1.1.5" @@ -26,6 +40,12 @@ dependencies = [ "memchr", ] +[[package]] +name = "allocator-api2" +version = "0.2.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923" + [[package]] name = "anyhow" version = "1.0.104" @@ -40,7 +60,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -152,6 +172,21 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "bit-set" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3" +dependencies = [ + "bit-vec", +] + +[[package]] +name = "bit-vec" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" + [[package]] name = "bitflags" version = "2.13.2" @@ -167,12 +202,24 @@ dependencies = [ "generic-array", ] +[[package]] +name = "borrow-or-share" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c" + [[package]] name = "bumpalo" version = "3.20.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649" +[[package]] +name = "bytecount" +version = "0.6.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e" + [[package]] name = "bytes" version = "1.12.1" @@ -193,9 +240,9 @@ dependencies = [ [[package]] name = "cfg-if" -version = "1.0.4" +version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" +checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" [[package]] name = "cfg_aliases" @@ -205,12 +252,12 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures 0.3.1", "rand_core 0.10.1", ] @@ -225,14 +272,55 @@ dependencies = [ [[package]] name = "combine" -version = "4.6.7" +version = "4.6.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd" +checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e" dependencies = [ "bytes", "memchr", ] +[[package]] +name = "const_format" +version = "0.2.36" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e" +dependencies = [ + "const_format_proc_macros", + "konst", +] + +[[package]] +name = "const_format_proc_macros" +version = "0.2.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1d57c2eccfb16dbac1f4e61e206105db5820c9d26c3c472bc17c774259ef7744" +dependencies = [ + "proc-macro2", + "quote", + "unicode-xid", +] + +[[package]] +name = "container-device-interface" +version = "1.2.0" +source = "git+https://github.com/cncf-tags/container-device-interface-rs?rev=b8a056e92dbd159423c129cd306c93e410651b18#b8a056e92dbd159423c129cd306c93e410651b18" +dependencies = [ + "anyhow", + "const_format", + "jsonschema", + "lazy_static", + "libc", + "oci-spec", + "once_cell", + "path-clean", + "regex", + "semver", + "serde", + "serde_json", + "serde_yaml", +] + [[package]] name = "core-foundation" version = "0.10.1" @@ -260,9 +348,9 @@ dependencies = [ [[package]] name = "cpufeatures" -version = "0.3.0" +version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566" dependencies = [ "libc", ] @@ -283,6 +371,41 @@ dependencies = [ "typenum", ] +[[package]] +name = "darling" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee" +dependencies = [ + "darling_core", + "darling_macro", +] + +[[package]] +name = "darling_core" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e" +dependencies = [ + "fnv", + "ident_case", + "proc-macro2", + "quote", + "strsim", + "syn 2.0.119", +] + +[[package]] +name = "darling_macro" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead" +dependencies = [ + "darling_core", + "quote", + "syn 2.0.119", +] + [[package]] name = "data-encoding" version = "2.11.1" @@ -295,6 +418,37 @@ version = "0.5.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" +[[package]] +name = "derive_builder" +version = "0.20.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947" +dependencies = [ + "derive_builder_macro", +] + +[[package]] +name = "derive_builder_core" +version = "0.20.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8" +dependencies = [ + "darling", + "proc-macro2", + "quote", + "syn 2.0.119", +] + +[[package]] +name = "derive_builder_macro" +version = "0.20.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c" +dependencies = [ + "derive_builder_core", + "syn 2.0.119", +] + [[package]] name = "digest" version = "0.10.7" @@ -313,7 +467,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -328,6 +482,15 @@ version = "1.18.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34" +[[package]] +name = "email_address" +version = "0.2.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449" +dependencies = [ + "serde", +] + [[package]] name = "equivalent" version = "1.0.2" @@ -344,6 +507,17 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "fancy-regex" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e1e1dacd0d2082dfcf1351c4bdd566bbe89a2b263235a2b50058f1e130a47277" +dependencies = [ + "bit-set", + "regex-automata", + "regex-syntax", +] + [[package]] name = "fastrand" version = "2.5.0" @@ -362,6 +536,17 @@ version = "0.5.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99" +[[package]] +name = "fluent-uri" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bc74ac4d8359ae70623506d512209619e5cf8f347124910440dbc221714b328e" +dependencies = [ + "borrow-or-share", + "ref-cast", + "serde", +] + [[package]] name = "fnv" version = "1.0.7" @@ -374,6 +559,12 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" +[[package]] +name = "foldhash" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" + [[package]] name = "form_urlencoded" version = "1.2.2" @@ -383,6 +574,16 @@ dependencies = [ "percent-encoding", ] +[[package]] +name = "fraction" +version = "0.15.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e076045bb43dac435333ed5f04caf35c7463631d0dae2deb2638d94dd0a5b872" +dependencies = [ + "lazy_static", + "num", +] + [[package]] name = "fs_extra" version = "1.3.0" @@ -449,6 +650,20 @@ dependencies = [ "wasi", ] +[[package]] +name = "getrandom" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +dependencies = [ + "cfg-if", + "js-sys", + "libc", + "r-efi 5.3.0", + "wasip2", + "wasm-bindgen", +] + [[package]] name = "getrandom" version = "0.4.3" @@ -457,10 +672,21 @@ checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", "libc", - "r-efi", + "r-efi 6.0.0", "rand_core 0.10.1", ] +[[package]] +name = "getset" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6cf442baaabe4213ce7d1239afc26c039180b6456da2cededa316ae2c8a77a77" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "gimli" version = "0.32.3" @@ -469,9 +695,9 @@ checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7" [[package]] name = "glob" -version = "0.3.3" +version = "0.3.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280" +checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b" [[package]] name = "h2" @@ -498,7 +724,18 @@ version = "0.15.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" dependencies = [ - "foldhash", + "foldhash 0.1.5", +] + +[[package]] +name = "hashbrown" +version = "0.16.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" +dependencies = [ + "allocator-api2", + "equivalent", + "foldhash 0.2.0", ] [[package]] @@ -515,9 +752,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" [[package]] name = "hickory-proto" -version = "0.26.1" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643" +checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d" dependencies = [ "data-encoding", "idna", @@ -634,9 +871,9 @@ dependencies = [ [[package]] name = "icu_collections" -version = "2.2.0" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c" +checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513" dependencies = [ "displaydoc", "potential_utf", @@ -648,22 +885,43 @@ dependencies = [ [[package]] name = "icu_locale_core" -version = "2.2.0" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29" +checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb" dependencies = [ "displaydoc", "litemap", + "serde", "tinystr", "writeable", "zerovec", ] +[[package]] +name = "icu_locale_fallback" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9" +dependencies = [ + "icu_locale_core", + "icu_locale_fallback_data", + "icu_provider", + "potential_utf", + "tinystr", + "zerovec", +] + +[[package]] +name = "icu_locale_fallback_data" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8" + [[package]] name = "icu_normalizer" -version = "2.2.0" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4" +checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f" dependencies = [ "icu_collections", "icu_normalizer_data", @@ -675,16 +933,17 @@ dependencies = [ [[package]] name = "icu_normalizer_data" -version = "2.2.0" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38" +checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0" [[package]] name = "icu_properties" -version = "2.2.0" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de" +checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148" dependencies = [ + "displaydoc", "icu_collections", "icu_locale_core", "icu_properties_data", @@ -695,18 +954,20 @@ dependencies = [ [[package]] name = "icu_properties_data" -version = "2.2.0" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14" +checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa" [[package]] name = "icu_provider" -version = "2.2.0" +version = "2.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421" +checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73" dependencies = [ "displaydoc", "icu_locale_core", + "serde", + "stable_deref_trait", "writeable", "yoke", "zerofrom", @@ -714,6 +975,34 @@ dependencies = [ "zerovec", ] +[[package]] +name = "icu_segmenter" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "82d07aafccd67af15d02512a6adf5896fbc5ed00f2e99b471d2efa14016db3db" +dependencies = [ + "icu_collections", + "icu_locale_fallback", + "icu_provider", + "icu_segmenter_data", + "potential_utf", + "smallvec", + "utf8_iter", + "zerovec", +] + +[[package]] +name = "icu_segmenter_data" +version = "2.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad" + +[[package]] +name = "ident_case" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39" + [[package]] name = "idna" version = "1.1.0" @@ -749,9 +1038,9 @@ dependencies = [ [[package]] name = "ipnet" -version = "2.12.0" +version = "2.12.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2" +checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0" [[package]] name = "is_ci" @@ -835,15 +1124,51 @@ dependencies = [ [[package]] name = "js-sys" -version = "0.3.103" +version = "0.3.105" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102" +checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e" dependencies = [ "cfg-if", "futures-util", "wasm-bindgen", ] +[[package]] +name = "jsonschema" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0a699d3e77675e6aa4bfffe3b907c8b5f7ed3241f9965bffb25475ad4b08d05" +dependencies = [ + "ahash", + "bytecount", + "data-encoding", + "email_address", + "fancy-regex", + "fraction", + "getrandom 0.3.4", + "idna", + "itoa", + "jsonschema-regex", + "num-cmp", + "num-traits", + "percent-encoding", + "referencing", + "regex", + "serde", + "serde_json", + "unicode-general-category", + "uuid-simd", +] + +[[package]] +name = "jsonschema-regex" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6dbd1086b01b9349fd4ef9a07433965af64c8ce8159abe633a189e4ff817bd13" +dependencies = [ + "regex-syntax", +] + [[package]] name = "jsonwebtoken" version = "10.4.0" @@ -862,6 +1187,27 @@ dependencies = [ "zeroize", ] +[[package]] +name = "konst" +version = "0.2.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "128133ed7824fcd73d6e7b17957c5eb7bacb885649bd8c69708b2331a10bcefb" +dependencies = [ + "konst_macro_rules", +] + +[[package]] +name = "konst_macro_rules" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37" + +[[package]] +name = "lazy_static" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" + [[package]] name = "libc" version = "0.2.189" @@ -882,9 +1228,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53" [[package]] name = "litemap" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0" +checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae" [[package]] name = "lock_api" @@ -913,6 +1259,12 @@ version = "2.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98" +[[package]] +name = "micromap" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2a86d3146ed3995b5913c414f6664344b9617457320782e64f0bb44afd49d74" + [[package]] name = "miette" version = "7.6.0" @@ -1003,6 +1355,20 @@ dependencies = [ "smallvec", ] +[[package]] +name = "num" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23" +dependencies = [ + "num-bigint", + "num-complex", + "num-integer", + "num-iter", + "num-rational", + "num-traits", +] + [[package]] name = "num-bigint" version = "0.4.8" @@ -1013,6 +1379,21 @@ dependencies = [ "num-traits", ] +[[package]] +name = "num-cmp" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63335b2e2c34fae2fb0aa2cecfd9f0832a1e24b3b32ecec612c3426d46dc8aaa" + +[[package]] +name = "num-complex" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495" +dependencies = [ + "num-traits", +] + [[package]] name = "num-conv" version = "0.2.2" @@ -1028,6 +1409,27 @@ dependencies = [ "num-traits", ] +[[package]] +name = "num-iter" +version = "0.1.46" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b" +dependencies = [ + "num-integer", + "num-traits", +] + +[[package]] +name = "num-rational" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824" +dependencies = [ + "num-bigint", + "num-integer", + "num-traits", +] + [[package]] name = "num-traits" version = "0.2.19" @@ -1046,6 +1448,23 @@ dependencies = [ "memchr", ] +[[package]] +name = "oci-spec" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3df6f876ad774d6a676f7e968f5c3edacc32f90e65fe680a8b686235396556fb" +dependencies = [ + "const_format", + "derive_builder", + "getset", + "regex", + "serde", + "serde_json", + "strum", + "strum_macros", + "thiserror", +] + [[package]] name = "once_cell" version = "1.21.4" @@ -1062,6 +1481,7 @@ version = "0.0.0" dependencies = [ "async-trait", "base64", + "container-device-interface", "glob", "ipnet", "miette", @@ -1174,11 +1594,17 @@ dependencies = [ "num-traits", ] +[[package]] +name = "outref" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e" + [[package]] name = "owo-colors" -version = "4.3.0" +version = "4.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d" +checksum = "13c45bb4a6ae1280ec0803b1ef9d3455eb50f01efbbe1447ab020f1d54fba9d8" [[package]] name = "parking_lot" @@ -1203,6 +1629,12 @@ dependencies = [ "windows-link", ] +[[package]] +name = "path-clean" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17359afc20d7ab31fdb42bb844c8b3bb1dabd7dcf7e68428492da7f16966fcef" + [[package]] name = "pem" version = "3.0.6" @@ -1270,10 +1702,12 @@ checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85" [[package]] name = "potential_utf" -version = "0.1.5" +version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564" +checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661" dependencies = [ + "serde_core", + "writeable", "zerovec", ] @@ -1461,6 +1895,12 @@ dependencies = [ "proc-macro2", ] +[[package]] +name = "r-efi" +version = "5.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" + [[package]] name = "r-efi" version = "6.0.0" @@ -1515,6 +1955,43 @@ dependencies = [ "bitflags", ] +[[package]] +name = "ref-cast" +version = "1.0.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3" +dependencies = [ + "ref-cast-impl", +] + +[[package]] +name = "ref-cast-impl" +version = "1.0.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a" +dependencies = [ + "proc-macro2", + "quote", + "syn 3.0.6", +] + +[[package]] +name = "referencing" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fbf332a2f81899f6836f22c03da73dae8a664c32e3016b84692c23cddadc95d" +dependencies = [ + "ahash", + "fluent-uri", + "getrandom 0.3.4", + "hashbrown 0.16.1", + "itoa", + "micromap", + "parking_lot", + "percent-encoding", + "serde_json", +] + [[package]] name = "regex" version = "1.13.1" @@ -1560,9 +2037,9 @@ dependencies = [ [[package]] name = "rustc-demangle" -version = "0.1.27" +version = "0.1.28" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d" +checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb" [[package]] name = "rustc-hash" @@ -1581,9 +2058,9 @@ dependencies = [ [[package]] name = "rustix" -version = "1.1.4" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190" +checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d" dependencies = [ "bitflags", "errno", @@ -1655,6 +2132,12 @@ version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f" +[[package]] +name = "ryu" +version = "1.0.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f" + [[package]] name = "same-file" version = "1.0.6" @@ -1745,7 +2228,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -1761,6 +2244,19 @@ dependencies = [ "zmij", ] +[[package]] +name = "serde_yaml" +version = "0.9.34+deprecated" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47" +dependencies = [ + "indexmap", + "itoa", + "ryu", + "serde", + "unsafe-libyaml", +] + [[package]] name = "sha2" version = "0.10.9" @@ -1853,6 +2349,30 @@ version = "1.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" +[[package]] +name = "strsim" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" + +[[package]] +name = "strum" +version = "0.27.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf" + +[[package]] +name = "strum_macros" +version = "0.27.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7" +dependencies = [ + "heck", + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "subtle" version = "2.6.1" @@ -1893,9 +2413,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.5" +version = "3.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9" +checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" dependencies = [ "proc-macro2", "quote", @@ -1910,13 +2430,13 @@ checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263" [[package]] name = "synstructure" -version = "0.13.2" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" +checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.6", ] [[package]] @@ -1944,11 +2464,11 @@ dependencies = [ [[package]] name = "textwrap" -version = "0.16.2" +version = "0.16.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057" +checksum = "6ecfad6c3abc80a577f2b91c1e412ee57e7a060d430b553c1b0c940974ebcd49" dependencies = [ - "unicode-linebreak", + "icu_segmenter", "unicode-width 0.2.2", ] @@ -1969,7 +2489,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -2004,28 +2524,20 @@ dependencies = [ [[package]] name = "tinystr" -version = "0.8.3" +version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d" +checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643" dependencies = [ "displaydoc", + "serde_core", "zerovec", ] [[package]] name = "tinyvec" -version = "1.12.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f" -dependencies = [ - "tinyvec_macros", -] - -[[package]] -name = "tinyvec_macros" -version = "0.1.1" +version = "1.13.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" +checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" [[package]] name = "tokio" @@ -2052,7 +2564,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -2252,16 +2764,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142" [[package]] -name = "unicode-ident" -version = "1.0.24" +name = "unicode-general-category" +version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" +checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f" [[package]] -name = "unicode-linebreak" -version = "0.1.5" +name = "unicode-ident" +version = "1.0.26" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f" +checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954" [[package]] name = "unicode-width" @@ -2275,6 +2787,18 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" +[[package]] +name = "unicode-xid" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" + +[[package]] +name = "unsafe-libyaml" +version = "0.2.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" + [[package]] name = "untrusted" version = "0.7.1" @@ -2316,12 +2840,28 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "uuid-simd" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23b082222b4f6619906941c17eb2297fff4c2fb96cb60164170522942a200bd8" +dependencies = [ + "outref", + "vsimd", +] + [[package]] name = "version_check" version = "0.9.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" +[[package]] +name = "vsimd" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64" + [[package]] name = "walkdir" version = "2.5.0" @@ -2347,11 +2887,20 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasip2" +version = "1.0.4+wasi-0.2.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487" +dependencies = [ + "wit-bindgen", +] + [[package]] name = "wasm-bindgen" -version = "0.2.126" +version = "0.2.128" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4" +checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf" dependencies = [ "cfg-if", "once_cell", @@ -2362,9 +2911,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro" -version = "0.2.126" +version = "0.2.128" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1" +checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed" dependencies = [ "quote", "wasm-bindgen-macro-support", @@ -2372,22 +2921,22 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro-support" -version = "0.2.126" +version = "0.2.128" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e" +checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a" dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.6", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-shared" -version = "0.2.126" +version = "0.2.128" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24" +checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e" dependencies = [ "unicode-ident", ] @@ -2489,11 +3038,17 @@ version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" +[[package]] +name = "wit-bindgen" +version = "0.57.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" + [[package]] name = "writeable" -version = "0.6.3" +version = "0.6.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" +checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc" [[package]] name = "yasna" @@ -2517,16 +3072,36 @@ dependencies = [ [[package]] name = "yoke-derive" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" +checksum = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.6", "synstructure", ] +[[package]] +name = "zerocopy" +version = "0.8.57" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873" +dependencies = [ + "zerocopy-derive", +] + +[[package]] +name = "zerocopy-derive" +version = "0.8.57" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "zerofrom" version = "0.1.8" @@ -2538,13 +3113,13 @@ dependencies = [ [[package]] name = "zerofrom-derive" -version = "0.1.7" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" +checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.6", "synstructure", ] @@ -2570,21 +3145,23 @@ dependencies = [ [[package]] name = "zerotrie" -version = "0.2.4" +version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf" +checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f" dependencies = [ "displaydoc", "yoke", "zerofrom", + "zerovec", ] [[package]] name = "zerovec" -version = "0.11.6" +version = "0.11.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239" +checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8" dependencies = [ + "serde", "yoke", "zerofrom", "zerovec-derive", @@ -2592,13 +3169,13 @@ dependencies = [ [[package]] name = "zerovec-derive" -version = "0.11.3" +version = "0.11.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" +checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.6", ] [[package]] diff --git a/examples/supervisor-middleware-content-guard/Cargo.lock b/examples/supervisor-middleware-content-guard/Cargo.lock index 381cb63c40..5abcc16e9a 100644 --- a/examples/supervisor-middleware-content-guard/Cargo.lock +++ b/examples/supervisor-middleware-content-guard/Cargo.lock @@ -17,6 +17,20 @@ version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" +[[package]] +name = "ahash" +version = "0.8.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75" +dependencies = [ + "cfg-if", + "getrandom 0.3.4", + "once_cell", + "serde", + "version_check", + "zerocopy", +] + [[package]] name = "aho-corasick" version = "1.1.5" @@ -26,6 +40,12 @@ dependencies = [ "memchr", ] +[[package]] +name = "allocator-api2" +version = "0.2.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923" + [[package]] name = "anstream" version = "1.0.0" @@ -90,7 +110,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -99,6 +119,12 @@ version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0" +[[package]] +name = "autocfg" +version = "1.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" + [[package]] name = "aws-lc-rs" version = "1.18.1" @@ -195,6 +221,21 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "bit-set" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3" +dependencies = [ + "bit-vec", +] + +[[package]] +name = "bit-vec" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" + [[package]] name = "bitflags" version = "2.13.2" @@ -210,12 +251,24 @@ dependencies = [ "generic-array", ] +[[package]] +name = "borrow-or-share" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c" + [[package]] name = "bumpalo" version = "3.20.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649" +[[package]] +name = "bytecount" +version = "0.6.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e" + [[package]] name = "bytes" version = "1.12.1" @@ -236,9 +289,9 @@ dependencies = [ [[package]] name = "cfg-if" -version = "1.0.4" +version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" +checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" [[package]] name = "cfg_aliases" @@ -288,7 +341,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -322,6 +375,47 @@ dependencies = [ "memchr", ] +[[package]] +name = "const_format" +version = "0.2.36" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e" +dependencies = [ + "const_format_proc_macros", + "konst", +] + +[[package]] +name = "const_format_proc_macros" +version = "0.2.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1d57c2eccfb16dbac1f4e61e206105db5820c9d26c3c472bc17c774259ef7744" +dependencies = [ + "proc-macro2", + "quote", + "unicode-xid", +] + +[[package]] +name = "container-device-interface" +version = "1.2.0" +source = "git+https://github.com/cncf-tags/container-device-interface-rs?rev=b8a056e92dbd159423c129cd306c93e410651b18#b8a056e92dbd159423c129cd306c93e410651b18" +dependencies = [ + "anyhow", + "const_format", + "jsonschema", + "lazy_static", + "libc", + "oci-spec", + "once_cell", + "path-clean", + "regex", + "semver", + "serde", + "serde_json", + "serde_yaml", +] + [[package]] name = "core-foundation" version = "0.10.1" @@ -372,12 +466,78 @@ dependencies = [ "typenum", ] +[[package]] +name = "darling" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee" +dependencies = [ + "darling_core", + "darling_macro", +] + +[[package]] +name = "darling_core" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e" +dependencies = [ + "fnv", + "ident_case", + "proc-macro2", + "quote", + "strsim", + "syn 2.0.119", +] + +[[package]] +name = "darling_macro" +version = "0.20.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead" +dependencies = [ + "darling_core", + "quote", + "syn 2.0.119", +] + [[package]] name = "data-encoding" version = "2.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06" +[[package]] +name = "derive_builder" +version = "0.20.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947" +dependencies = [ + "derive_builder_macro", +] + +[[package]] +name = "derive_builder_core" +version = "0.20.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8" +dependencies = [ + "darling", + "proc-macro2", + "quote", + "syn 2.0.119", +] + +[[package]] +name = "derive_builder_macro" +version = "0.20.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c" +dependencies = [ + "derive_builder_core", + "syn 2.0.119", +] + [[package]] name = "digest" version = "0.10.7" @@ -396,7 +556,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -411,6 +571,15 @@ version = "1.18.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34" +[[package]] +name = "email_address" +version = "0.2.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449" +dependencies = [ + "serde", +] + [[package]] name = "equivalent" version = "1.0.2" @@ -427,6 +596,17 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "fancy-regex" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e1e1dacd0d2082dfcf1351c4bdd566bbe89a2b263235a2b50058f1e130a47277" +dependencies = [ + "bit-set", + "regex-automata", + "regex-syntax", +] + [[package]] name = "fastrand" version = "2.5.0" @@ -445,6 +625,17 @@ version = "0.5.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99" +[[package]] +name = "fluent-uri" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bc74ac4d8359ae70623506d512209619e5cf8f347124910440dbc221714b328e" +dependencies = [ + "borrow-or-share", + "ref-cast", + "serde", +] + [[package]] name = "fnv" version = "1.0.7" @@ -457,6 +648,12 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" +[[package]] +name = "foldhash" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" + [[package]] name = "form_urlencoded" version = "1.2.2" @@ -466,6 +663,16 @@ dependencies = [ "percent-encoding", ] +[[package]] +name = "fraction" +version = "0.15.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e076045bb43dac435333ed5f04caf35c7463631d0dae2deb2638d94dd0a5b872" +dependencies = [ + "lazy_static", + "num", +] + [[package]] name = "fs_extra" version = "1.3.0" @@ -532,6 +739,20 @@ dependencies = [ "wasi", ] +[[package]] +name = "getrandom" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +dependencies = [ + "cfg-if", + "js-sys", + "libc", + "r-efi 5.3.0", + "wasip2", + "wasm-bindgen", +] + [[package]] name = "getrandom" version = "0.4.3" @@ -540,10 +761,21 @@ checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", "libc", - "r-efi", + "r-efi 6.0.0", "rand_core", ] +[[package]] +name = "getset" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6cf442baaabe4213ce7d1239afc26c039180b6456da2cededa316ae2c8a77a77" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "gimli" version = "0.32.3" @@ -581,7 +813,18 @@ version = "0.15.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" dependencies = [ - "foldhash", + "foldhash 0.1.5", +] + +[[package]] +name = "hashbrown" +version = "0.16.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" +dependencies = [ + "allocator-api2", + "equivalent", + "foldhash 0.2.0", ] [[package]] @@ -843,6 +1086,12 @@ version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad" +[[package]] +name = "ident_case" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39" + [[package]] name = "idna" version = "1.1.0" @@ -979,6 +1228,63 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "jsonschema" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0a699d3e77675e6aa4bfffe3b907c8b5f7ed3241f9965bffb25475ad4b08d05" +dependencies = [ + "ahash", + "bytecount", + "data-encoding", + "email_address", + "fancy-regex", + "fraction", + "getrandom 0.3.4", + "idna", + "itoa", + "jsonschema-regex", + "num-cmp", + "num-traits", + "percent-encoding", + "referencing", + "regex", + "serde", + "serde_json", + "unicode-general-category", + "uuid-simd", +] + +[[package]] +name = "jsonschema-regex" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6dbd1086b01b9349fd4ef9a07433965af64c8ce8159abe633a189e4ff817bd13" +dependencies = [ + "regex-syntax", +] + +[[package]] +name = "konst" +version = "0.2.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "128133ed7824fcd73d6e7b17957c5eb7bacb885649bd8c69708b2331a10bcefb" +dependencies = [ + "konst_macro_rules", +] + +[[package]] +name = "konst_macro_rules" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37" + +[[package]] +name = "lazy_static" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" + [[package]] name = "libc" version = "0.2.189" @@ -1030,6 +1336,12 @@ version = "2.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98" +[[package]] +name = "micromap" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2a86d3146ed3995b5913c414f6664344b9617457320782e64f0bb44afd49d74" + [[package]] name = "miette" version = "7.6.0" @@ -1120,6 +1432,84 @@ dependencies = [ "smallvec", ] +[[package]] +name = "num" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23" +dependencies = [ + "num-bigint", + "num-complex", + "num-integer", + "num-iter", + "num-rational", + "num-traits", +] + +[[package]] +name = "num-bigint" +version = "0.4.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367" +dependencies = [ + "num-integer", + "num-traits", +] + +[[package]] +name = "num-cmp" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63335b2e2c34fae2fb0aa2cecfd9f0832a1e24b3b32ecec612c3426d46dc8aaa" + +[[package]] +name = "num-complex" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495" +dependencies = [ + "num-traits", +] + +[[package]] +name = "num-integer" +version = "0.1.47" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b" +dependencies = [ + "num-traits", +] + +[[package]] +name = "num-iter" +version = "0.1.46" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b" +dependencies = [ + "num-integer", + "num-traits", +] + +[[package]] +name = "num-rational" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824" +dependencies = [ + "num-bigint", + "num-integer", + "num-traits", +] + +[[package]] +name = "num-traits" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" +dependencies = [ + "autocfg", +] + [[package]] name = "object" version = "0.37.3" @@ -1129,6 +1519,23 @@ dependencies = [ "memchr", ] +[[package]] +name = "oci-spec" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3df6f876ad774d6a676f7e968f5c3edacc32f90e65fe680a8b686235396556fb" +dependencies = [ + "const_format", + "derive_builder", + "getset", + "regex", + "serde", + "serde_json", + "strum", + "strum_macros", + "thiserror", +] + [[package]] name = "once_cell" version = "1.21.4" @@ -1151,6 +1558,7 @@ version = "0.0.0" dependencies = [ "async-trait", "base64", + "container-device-interface", "glob", "ipnet", "miette", @@ -1232,6 +1640,12 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" +[[package]] +name = "outref" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e" + [[package]] name = "owo-colors" version = "4.4.0" @@ -1261,6 +1675,12 @@ dependencies = [ "windows-link", ] +[[package]] +name = "path-clean" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "17359afc20d7ab31fdb42bb844c8b3bb1dabd7dcf7e68428492da7f16966fcef" + [[package]] name = "percent-encoding" version = "2.3.2" @@ -1492,6 +1912,12 @@ dependencies = [ "proc-macro2", ] +[[package]] +name = "r-efi" +version = "5.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" + [[package]] name = "r-efi" version = "6.0.0" @@ -1524,6 +1950,43 @@ dependencies = [ "bitflags", ] +[[package]] +name = "ref-cast" +version = "1.0.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3" +dependencies = [ + "ref-cast-impl", +] + +[[package]] +name = "ref-cast-impl" +version = "1.0.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a" +dependencies = [ + "proc-macro2", + "quote", + "syn 3.0.6", +] + +[[package]] +name = "referencing" +version = "0.46.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fbf332a2f81899f6836f22c03da73dae8a664c32e3016b84692c23cddadc95d" +dependencies = [ + "ahash", + "fluent-uri", + "getrandom 0.3.4", + "hashbrown 0.16.1", + "itoa", + "micromap", + "parking_lot", + "percent-encoding", + "serde_json", +] + [[package]] name = "regex" version = "1.13.1" @@ -1590,9 +2053,9 @@ dependencies = [ [[package]] name = "rustix" -version = "1.1.4" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190" +checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d" dependencies = [ "bitflags", "errno", @@ -1664,6 +2127,12 @@ version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f" +[[package]] +name = "ryu" +version = "1.0.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f" + [[package]] name = "same-file" version = "1.0.6" @@ -1744,7 +2213,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -1760,6 +2229,19 @@ dependencies = [ "zmij", ] +[[package]] +name = "serde_yaml" +version = "0.9.34+deprecated" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47" +dependencies = [ + "indexmap", + "itoa", + "ryu", + "serde", + "unsafe-libyaml", +] + [[package]] name = "sha2" version = "0.10.9" @@ -1837,6 +2319,24 @@ version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" +[[package]] +name = "strum" +version = "0.27.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf" + +[[package]] +name = "strum_macros" +version = "0.27.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7" +dependencies = [ + "heck", + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "subtle" version = "2.6.1" @@ -1877,9 +2377,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.5" +version = "3.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9" +checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" dependencies = [ "proc-macro2", "quote", @@ -1900,7 +2400,7 @@ checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -1953,7 +2453,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -1998,7 +2498,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]] @@ -2197,11 +2697,17 @@ version = "2.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142" +[[package]] +name = "unicode-general-category" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f" + [[package]] name = "unicode-ident" -version = "1.0.24" +version = "1.0.26" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" +checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954" [[package]] name = "unicode-width" @@ -2215,6 +2721,18 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" +[[package]] +name = "unicode-xid" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" + +[[package]] +name = "unsafe-libyaml" +version = "0.2.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" + [[package]] name = "untrusted" version = "0.9.0" @@ -2256,12 +2774,28 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "uuid-simd" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23b082222b4f6619906941c17eb2297fff4c2fb96cb60164170522942a200bd8" +dependencies = [ + "outref", + "vsimd", +] + [[package]] name = "version_check" version = "0.9.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" +[[package]] +name = "vsimd" +version = "0.8.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64" + [[package]] name = "walkdir" version = "2.5.0" @@ -2287,6 +2821,15 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasip2" +version = "1.0.4+wasi-0.2.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487" +dependencies = [ + "wit-bindgen", +] + [[package]] name = "wasm-bindgen" version = "0.2.128" @@ -2319,7 +2862,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", "wasm-bindgen-shared", ] @@ -2429,6 +2972,12 @@ version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" +[[package]] +name = "wit-bindgen" +version = "0.57.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" + [[package]] name = "writeable" version = "0.6.4" @@ -2454,10 +3003,30 @@ checksum = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", "synstructure", ] +[[package]] +name = "zerocopy" +version = "0.8.57" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873" +dependencies = [ + "zerocopy-derive", +] + +[[package]] +name = "zerocopy-derive" +version = "0.8.57" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "zerofrom" version = "0.1.8" @@ -2475,7 +3044,7 @@ checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", "synstructure", ] @@ -2517,7 +3086,7 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.5", + "syn 3.0.6", ] [[package]]