Require a path separator below the device-mount root

internal/config/image/cuda_image.go

@@ -370,8 +370,11 @@ func (i CUDA) requestsFromMounts() []string {
 		}
 		seen[destination] = true
 
-		// Only consider container mount points that begin with 'root'
-		if !strings.HasPrefix(destination, root) {
+		// Only consider container mount points below 'root'. The separator is
+		// required: without it a sibling path such as
+		// /var/run/nvidia-container-devices-backup/GPU0 has the same prefix,
+		// and the remainder is read as a device request.
+		if !strings.HasPrefix(destination, root+"/") {
 			continue
 		}
 

internal/config/image/cuda_image_test.go

@@ -513,6 +513,30 @@ func TestGetVisibleDevicesFromMounts(t *testing.T) {
 			mounts:          makeTestMounts("GPU0", "imex/0", "GPU1"),
 			expectedDevices: []string{"GPU0", "GPU1"},
 		},
+		{
+			description: "Container path is a sibling of 'root'",
+			mounts: []specs.Mount{
+				{
+					Source:      "/dev/null",
+					Destination: DeviceListAsVolumeMountsRoot + "-backup/GPU0",
+				},
+				{
+					Source:      "/dev/null",
+					Destination: DeviceListAsVolumeMountsRoot + ".old/GPU1",
+				},
+			},
+			expectedDevices: nil,
+		},
+		{
+			description: "A sibling of 'root' does not request a CDI device",
+			mounts: []specs.Mount{
+				{
+					Source:      "/dev/null",
+					Destination: DeviceListAsVolumeMountsRoot + "cdi/nvidia.com/gpu=0",
+				},
+			},
+			expectedDevices: nil,
+		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.description, func(t *testing.T) {
@@ -523,6 +547,37 @@ func TestGetVisibleDevicesFromMounts(t *testing.T) {
 	}
 }
 
+func TestImexChannelsFromMounts(t *testing.T) {
+	var tests = []struct {
+		description      string
+		mounts           []specs.Mount
+		expectedChannels []string
+	}{
+		{
+			description:      "channels below 'root' are requested",
+			mounts:           makeTestMounts("imex/0", "GPU0", "imex/1"),
+			expectedChannels: []string{"0", "1"},
+		},
+		{
+			description: "a sibling of 'root' does not request a channel",
+			mounts: []specs.Mount{
+				{
+					Source:      "/dev/null",
+					Destination: DeviceListAsVolumeMountsRoot + "imex/0",
+				},
+			},
+			expectedChannels: nil,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.description, func(t *testing.T) {
+			image, err := New(WithMounts(tc.mounts))
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedChannels, image.imexChannelsFromMounts())
+		})
+	}
+}
+
 func TestVisibleDevices(t *testing.T) {
 	var tests = []struct {
 		description                   string