feat(cdi/generate): add --no-ipc-sockets flag to exclude IPC sockets

cmd/nvidia-ctk/cdi/generate/generate.go

@@ -75,8 +75,9 @@ type options struct {
 		CompatContainerRoot string
 	}
 
-	noAllDevice bool
-	deviceIDs   []string
+	noIPCSockets bool
+	noAllDevice  bool
+	deviceIDs    []string
 
 	// the following are used for dependency injection during spec generation.
 	nvmllib nvml.Interface
@@ -243,6 +244,13 @@ func (m command) build() *cli.Command {
 				Destination: &opts.featureFlags,
 				Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_FEATURE_FLAGS"),
 			},
+			&cli.BoolFlag{
+				Name:        "no-ipc-sockets",
+				Aliases:     []string{"disable-ipc-sockets", "disable-ipc-discoverer"},
+				Usage:       "Do not include NVIDIA IPC sockets (nvidia-persistenced, nvidia-fabricmanager, MPS) in the generated CDI specification",
+				Destination: &opts.noIPCSockets,
+				Sources:     cli.EnvVars("NVIDIA_CTK_CDI_GENERATE_NO_IPC_SOCKETS"),
+			},
 			&cli.BoolFlag{
 				Name:        "no-all-device",
 				Usage:       "Don't generate an `all` device for the resultant spec",
@@ -310,6 +318,10 @@ func (m command) validateFlags(c *cli.Command, opts *options) error {
 		m.logger.Warningf("Disabling generation of 'all' device")
 		opts.noAllDevice = true
 	}
+
+	if opts.noIPCSockets && !slices.Contains(opts.featureFlags, string(nvcdi.FeatureDisableIPCDiscoverer)) {
+		opts.featureFlags = append(opts.featureFlags, string(nvcdi.FeatureDisableIPCDiscoverer))
+	}
 	return nil
 }
 

cmd/nvidia-ctk/cdi/generate/generate_test.go

@@ -32,6 +32,7 @@ import (
 
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/devices"
 	"github.com/NVIDIA/nvidia-container-toolkit/internal/test"
+	"github.com/NVIDIA/nvidia-container-toolkit/pkg/nvcdi"
 )
 
 func TestGenerateSpec(t *testing.T) {
@@ -478,6 +479,133 @@ containerEdits:
             - nodev
             - rbind
             - rprivate
+`,
+		},
+		{
+			description: "no-ipc-sockets",
+			options: options{
+				format:       "yaml",
+				mode:         "nvml",
+				vendor:       "example.com",
+				class:        "device",
+				driverRoot:   driverRoot,
+				noIPCSockets: true,
+			},
+			expectedOptions: options{
+				format:            "yaml",
+				mode:              "nvml",
+				vendor:            "example.com",
+				class:             "device",
+				nvidiaCDIHookPath: "/usr/bin/nvidia-cdi-hook",
+				driverRoot:        driverRoot,
+				noIPCSockets:      true,
+				featureFlags:      []string{string(nvcdi.FeatureDisableIPCDiscoverer)},
+			},
+			expectedSpec: `---
+cdiVersion: 0.5.0
+kind: example.com/device
+devices:
+    - name: "0"
+      containerEdits:
+        deviceNodes:
+            - path: /dev/nvidia0
+              hostPath: {{ .driverRoot }}/dev/nvidia0
+        hooks:
+            - hookName: createRuntime
+              path: /usr/bin/nvidia-cdi-hook
+              args:
+                - nvidia-cdi-hook
+                - apply-cuda-memory-limits
+                - --driver-root
+                - {{ .driverRoot }}
+                - --gpu-id
+                - {{ .gpuID }}
+              env:
+                - NVIDIA_CTK_DEBUG=false
+    - name: all
+      containerEdits:
+        deviceNodes:
+            - path: /dev/nvidia0
+              hostPath: {{ .driverRoot }}/dev/nvidia0
+        hooks:
+            - hookName: createRuntime
+              path: /usr/bin/nvidia-cdi-hook
+              args:
+                - nvidia-cdi-hook
+                - apply-cuda-memory-limits
+                - --driver-root
+                - {{ .driverRoot }}
+                - --gpu-id
+                - {{ .gpuID }}
+              env:
+                - NVIDIA_CTK_DEBUG=false
+containerEdits:
+    env:
+        - NVIDIA_CTK_LIBCUDA_DIR=/lib/x86_64-linux-gnu
+        - NVIDIA_VISIBLE_DEVICES=void
+    deviceNodes:
+        - path: /dev/nvidiactl
+          hostPath: {{ .driverRoot }}/dev/nvidiactl
+    hooks:
+        - hookName: createContainer
+          path: /usr/bin/nvidia-cdi-hook
+          args:
+            - nvidia-cdi-hook
+            - create-symlinks
+            - --link
+            - libcuda.so.1::/lib/x86_64-linux-gnu/libcuda.so
+          env:
+            - NVIDIA_CTK_DEBUG=false
+        - hookName: createContainer
+          path: /usr/bin/nvidia-cdi-hook
+          args:
+            - nvidia-cdi-hook
+            - enable-cuda-compat
+            - --host-driver-version=999.88.77
+          env:
+            - NVIDIA_CTK_DEBUG=false
+        - hookName: createContainer
+          path: /usr/bin/nvidia-cdi-hook
+          args:
+            - nvidia-cdi-hook
+            - update-ldcache
+            - --folder
+            - /lib/x86_64-linux-gnu
+            - --folder
+            - /lib/x86_64-linux-gnu/vdpau
+          env:
+            - NVIDIA_CTK_DEBUG=false
+        - hookName: createContainer
+          path: /usr/bin/nvidia-cdi-hook
+          args:
+            - nvidia-cdi-hook
+            - disable-device-node-modification
+          env:
+            - NVIDIA_CTK_DEBUG=false
+        - hookName: createContainer
+          path: /usr/bin/nvidia-cdi-hook
+          args:
+            - nvidia-cdi-hook
+            - update-application-profile
+          env:
+            - NVIDIA_CTK_DEBUG=false
+    mounts:
+        - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/libcuda.so.999.88.77
+          containerPath: /lib/x86_64-linux-gnu/libcuda.so.999.88.77
+          options:
+            - ro
+            - nosuid
+            - nodev
+            - rbind
+            - rprivate
+        - hostPath: {{ .driverRoot }}/lib/x86_64-linux-gnu/vdpau/libvdpau_nvidia.so.999.88.77
+          containerPath: /lib/x86_64-linux-gnu/vdpau/libvdpau_nvidia.so.999.88.77
+          options:
+            - ro
+            - nosuid
+            - nodev
+            - rbind
+            - rprivate
 `,
 		},
 	}

deployments/systemd/nvidia-cdi-refresh.env

@@ -27,3 +27,8 @@
 #
 # NVIDIA_DRIVER_ROOT=/
 # NVIDIA_DEV_ROOT=/
+
+# To exclude NVIDIA IPC sockets (/run/nvidia-persistenced/socket,
+# /run/nvidia-fabricmanager/socket, /tmp/nvidia-mps) from the generated CDI spec
+# (useful for sandboxed runtimes like gVisor/runsc or Kata Containers), uncomment:
+# NVIDIA_CTK_CDI_GENERATE_NO_IPC_SOCKETS=true

internal/discover/ipc.go

@@ -32,7 +32,7 @@ var ipcMountOptions = []string{
 
 type ipcMounts mounts
 
-// NewIPCDiscoverer creats a discoverer for NVIDIA IPC sockets.
+// NewIPCDiscoverer creates a discoverer for NVIDIA IPC sockets.
 func NewIPCDiscoverer(logger logger.Interface, driverRoot string) (Discover, error) {
 	sockets := newMounts(
 		logger,

pkg/nvcdi/driver-nvml_test.go

@@ -0,0 +1,55 @@
+/**
+# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+**/
+
+package nvcdi
+
+import (
+	"testing"
+
+	testlog "github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/require"
+
+	"github.com/NVIDIA/nvidia-container-toolkit/internal/lookup/root"
+)
+
+func TestNewIPCDiscoverer(t *testing.T) {
+	logger, _ := testlog.NewNullLogger()
+
+	t.Run("default enables IPC discoverer", func(t *testing.T) {
+		l := &nvcdilib{
+			logger:       logger,
+			driver:       root.New(root.WithDriverRoot("/")),
+			featureFlags: make(map[FeatureFlag]bool),
+		}
+		d, err := l.newIPCDiscoverer()
+		require.NoError(t, err)
+		require.NotNil(t, d)
+	})
+
+	t.Run("FeatureDisableIPCDiscoverer disables IPC discoverer", func(t *testing.T) {
+		l := &nvcdilib{
+			logger: logger,
+			driver: root.New(root.WithDriverRoot("/")),
+			featureFlags: map[FeatureFlag]bool{
+				FeatureDisableIPCDiscoverer: true,
+			},
+		}
+		d, err := l.newIPCDiscoverer()
+		require.NoError(t, err)
+		require.Nil(t, d)
+	})
+}