MIG GPU passthrough for system containers via DRA/CDI

[m-amin-sanati]

Need

System containers need access to NVIDIA MIG GPUs allocated through Kubernetes DRA/CDI (e.g. from the GPU-Operator). Today sysbox has no end-to-end support for passing MIG-capable GPUs into user-namespaced system containers.

Proposal

Add MIG/DRA/CDI GPU passthrough across the three sysbox component repos:

• sysbox-ipc — new SetupDevices gRPC RPC and Device messages so sysbox-mgr can tell sysbox-runc which host device nodes to set up.
• sysbox-mgr — a device manager (deviceMgr) that reconciles GPU discovery, plus mknod of missing NVIDIA MIG capability nodes on the host so they can be bind-mounted into the container.
• sysbox-runc — a SetupDevices flow that processes the configured devices, scrubs the injected nvidia-cdi-hook (it cannot run in a user-mapped namespace), and recreates the CDI soname LibLink symlinks inside the container rootfs.

Benefits

Enables GPU/MIG passthrough into sysbox system containers driven by Kubernetes DRA/CDI, unblocking GPU-Operator-based MIG workspaces while preserving sysbox's security model.

Linked issues/PRs

• nestybox/sysbox-ipc: ipc issue/pr URL
• nestybox/sysbox-mgr: mgr issue/pr URL
• nestybox/sysbox-runc: runc issue/pr URL

Env

  Host / Node
  - OS: Ubuntu with kernel supporting sysbox (base v0.7.1-era sysbox; deployed sysbox-mgr/runc working builds)
  - GPU node(H100) 
  Kubernetes (cluster)
  - RuntimeClass sysbox-runc 
  - DRA ( Dynamic MIG profiling based on workload request on the fly)
  - with NVIDIA GPU-Operator and MIG enabled; NVIDIA driver containerized