Need
When a DRA/CDI GPU allocation is passed to a system container, the injected NVIDIA CDI artifacts assume a privileged, host-namespace environment. sysbox runs containers in a user-mapped namespace, so the nvidia-cdi-hook cannot run and GPU library soname symlinks are not created inside the container — breaking the GPU workload.
Proposal
- Add a SetupDevices flow: a Mgr.SetupDevices() client in libsysbox/sysbox/mgr.go that asks sysbox-mgr to prepare the container's devices, and cfgDevices() in libsysbox/syscont/spec.go invoked from ConvertSpec (before cfgMounts) to reconcile device paths against the host and pass the correct --user uid/gid to an nvidia-container-runtime-hook when present. Wire cfgDevices() into ConvertSpec (it was previously dead code).
- Scrub the nvidia-cdi-hook from the OCI spec after device setup (it must not run inside the user-mapped container).
- Before scrubbing, capture its --link src::dst pairs into Sysbox.LibLinks so createDevices can recreate the soname symlinks (e.g. libnvidia-ml.so.1 -> libnvidia-ml.so.X) inside the container rootfs during setup.
Benefits
Enables NVIDIA GPU/MIG passthrough into sysbox system containers via DRA/CDI.
Part of a 3-repo feature (see sysbox-mgr and sysbox-ipc PRs).
Need
When a DRA/CDI GPU allocation is passed to a system container, the injected NVIDIA CDI artifacts assume a privileged, host-namespace environment. sysbox runs containers in a user-mapped namespace, so the nvidia-cdi-hook cannot run and GPU library soname symlinks are not created inside the container — breaking the GPU workload.
Proposal
Benefits
Enables NVIDIA GPU/MIG passthrough into sysbox system containers via DRA/CDI.
Part of a 3-repo feature (see sysbox-mgr and sysbox-ipc PRs).