AZP: drop redundant /tmp/nvidia-mps bind from UCXX GPU containers

nvidia-container-runtime auto-mounts /tmp/nvidia-mps inside any container
started with --gpus all; explicit `-v /tmp/nvidia-mps:/tmp/nvidia-mps`
on top of that is a no-op duplicate. Verified live on
swx-rdmz-ucx-gpu-01: the MPS pipe + control socket show up under
/tmp/nvidia-mps inside the container even when the bind is omitted.
Other UCX gpu test containers in this file already follow this
convention.

Dropped from both ucxx_rapidsai_ci_conda_gpu and ucxx_rapidsai_ci_wheel_gpu
container options; added a comment so the next reader doesn't add the
bind back.

Author: Alexey-Rivkin

buildlib/pr/main.yml

@@ -266,27 +266,18 @@ resources:
       image: rdmz-harbor.rdmz.labs.mlnx/ucx/rapidsai-ci-conda:26.06-azp-1
       options: $(DOCKER_OPT_ARGS) $(DOCKER_OPT_VOLUMES)
     - container: ucxx_rapidsai_ci_conda_gpu
-      # Same image as above, +GPU. Match upstream rapidsai/ucxx CI container
-      # setup: GPU passthrough + MPS socket, but NO IB devices/host net. UCX
-      # falls back to tcp+sm+cuda_* transports same as upstream; with IB
-      # exposed it picks rc_mlx5 and AM tests hang on this MLNX env.
-      # seccomp=unconfined + apparmor=unconfined: Docker's default profile
-      # blocks the ptrace syscall even when SYS_PTRACE cap is granted, so
-      # ucxx ci/timeout_with_stack.py's gdb backtraces return empty. Lifting
-      # the syscall filter restores gdb attach on hung tests.
+      # GPU passthrough only, no IB/host-net. seccomp/apparmor unconfined so
+      # SYS_PTRACE works (ucxx timeout_with_stack.py uses gdb attach).
+      # /tmp/nvidia-mps auto-mounted by nvidia-container-runtime under --gpus all.
       image: rdmz-harbor.rdmz.labs.mlnx/ucx/rapidsai-ci-conda:26.06-azp-1
-      options: $(DOCKER_OPT_ARGS) $(DOCKER_OPT_VOLUMES) --gpus all --ipc=host -v /tmp/nvidia-mps:/tmp/nvidia-mps --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined
+      options: $(DOCKER_OPT_ARGS) $(DOCKER_OPT_VOLUMES) --gpus all --ipc=host --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined
     - container: ucxx_rapidsai_ci_wheel
-      # Thin wrapper of rapidsai/ci-wheel; see buildlib/dockers/rapidsai-ci-wheel.Dockerfile.
       image: rdmz-harbor.rdmz.labs.mlnx/ucx/rapidsai-ci-wheel:26.06-azp-1
       options: $(DOCKER_OPT_ARGS) $(DOCKER_OPT_VOLUMES)
     - container: ucxx_rapidsai_ci_wheel_gpu
-      # Same image as ucxx_rapidsai_ci_wheel, +GPU + MPS socket + shm + ulimit
-      # bumped to match upstream wheels-test container-options. seccomp/
-      # apparmor unconfined so gdb attach works on hung tests (see conda_gpu
-      # note above).
+      # +GPU + shm + ulimit to match upstream wheel-test container options.
       image: rdmz-harbor.rdmz.labs.mlnx/ucx/rapidsai-ci-wheel:26.06-azp-1
-      options: $(DOCKER_OPT_ARGS) $(DOCKER_OPT_VOLUMES) --gpus all --ipc=host --shm-size=8g --ulimit nofile=1000000:1000000 -v /tmp/nvidia-mps:/tmp/nvidia-mps --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined
+      options: $(DOCKER_OPT_ARGS) $(DOCKER_OPT_VOLUMES) --gpus all --ipc=host --shm-size=8g --ulimit nofile=1000000:1000000 --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined
 
 stages:
   - stage: Codestyle

buildlib/tools/test_ucxx.sh

@@ -36,11 +36,7 @@ cd "$UCXX_DIR"
 # on CPU containers). Idempotent.
 sed -i 's#^  nvidia-smi$#  command -v nvidia-smi >/dev/null \&\& nvidia-smi || echo "(no GPU)"#' ci/test_common.sh
 
-# Diagnostic: surface container uid + key file perms early. Runs A-K
-# walked the wrong path assuming we ran as root and could useradd/su to
-# the MPS daemon's owner uid (61206 swx-azure-svc). Run K proved we are
-# NOT root - useradd hits "cannot lock /etc/passwd; Permission denied".
-# Print id/whoami so the next step decides on real data.
+# Diagnostic: dump container uid + key perms before each GPU test phase.
 diag_container_identity() {
   echo "[diag] === container identity ==="
   id || true
@@ -84,13 +80,8 @@ EOF
   test_python)
     if [ "$IS_GPU" = "true" ]; then
       diag_container_identity
-      # Run O probe (hypothesis A): MPS active (no CUDA_MPS_PIPE_DIRECTORY
-      # override). Drop xdist entirely so pytest runs in a single process,
-      # makes one cuInit through MPS, no fork/spawn fan-out. UCX gtest works
-      # under MPS as a single-process client; if single-process pytest also
-      # works, hypothesis A is confirmed: MPS daemon can't sustain
-      # multi-process cuInit fan-out from xdist workers (control.log shows
-      # `Unable to accept connection` loop).
+      # Drop xdist - single-process pytest issues one cuInit through MPS,
+      # avoids fan-out of half-completed handshakes under MPS load.
       sed -i 's/pytest -n 4/pytest -p no:xdist/g' ci/run_python.sh
       export UCX_LOG_LEVEL=${UCX_LOG_LEVEL:-DEBUG}
       export UCXPY_LOG_LEVEL=${UCXPY_LOG_LEVEL:-DEBUG}
@@ -106,10 +97,6 @@ EOF
     printf '#!/bin/bash\necho "%s"\n' "$PYTHON_CHANNEL_DIR" > "$HOME/.local/bin/rapids-download-from-github"
     chmod +x "$HOME/.local/bin/rapids-download-conda-from-github" "$HOME/.local/bin/rapids-download-from-github"
     diag_container_identity
-    # No MPS bypass for Run O. run_python_distributed.sh does not use xdist
-    # in the test invocation - already single-process - so no patch needed
-    # here. Failure under MPS for the distributed leg is a separate signal
-    # (test_ucxx_localcluster spawns dask workers; those are extra procs).
     export UCX_LOG_LEVEL=${UCX_LOG_LEVEL:-DEBUG}
     export UCXPY_LOG_LEVEL=${UCXPY_LOG_LEVEL:-DEBUG}
     export UCX_LOG_FILE=/tmp/ucx_%P.log
@@ -141,8 +128,6 @@ EOF
     fi
     chmod +x "$HOME/.local/bin/rapids-download-from-github"
     diag_container_identity
-    # Run O probe (hypothesis A): MPS active, drop xdist for single-process
-    # pytest. See test_python phase comment for rationale.
     sed -i 's/pytest -n 4/pytest -p no:xdist/g' ci/run_python.sh
     export UCX_LOG_LEVEL=${UCX_LOG_LEVEL:-DEBUG}
     export UCXPY_LOG_LEVEL=${UCXPY_LOG_LEVEL:-DEBUG}