Piotr Mlocek 1c659c1c12 fix(sandbox/bootstrap): GPU Landlock baseline paths and CDI spec missing diagnosis (#710) ...

* fix(sandbox): add GPU device nodes and nvidia-persistenced to landlock baseline

Landlock READ_FILE/WRITE_FILE restricts open(2) on character device files
even when DAC permissions would otherwise allow it. GPU sandboxes need
/dev/nvidiactl, /dev/nvidia-uvm, /dev/nvidia-uvm-tools, /dev/nvidia-modeset,
and per-GPU /dev/nvidiaX nodes in the policy to allow NVML initialization.

Additionally, CDI bind-mounts /run/nvidia-persistenced/socket into the
container. NVML tries to connect to this socket at init time; if the
directory is not in the landlock policy, it receives EACCES (not
ECONNREFUSED), which causes NVML to abort with NVML_ERROR_INSUFFICIENT_PERMISSIONS
even though nvidia-persistenced is optional.

Both classes of paths are auto-added to the baseline when /dev/nvidiactl is
present. Per-GPU device nodes are enumerated at runtime to handle multi-GPU
configurations.

2026-04-01 18:04:25 -07:00

..

install

refactor: simplify install.sh to print PATH guidance (#403)

2026-03-17 12:22:25 -07:00

python

fix(sandbox/bootstrap): GPU Landlock baseline paths and CDI spec missing diagnosis (#710)

2026-04-01 18:04:25 -07:00

rust

feat(bootstrap,cli): switch GPU injection to CDI where supported (#495)

2026-03-31 08:23:52 -07:00