Repository navigation
Conversation
NGC images such as nvcr.io/nvidia/pytorch keep HPC-X and other libraries under /opt, which the default policy does not grant. `import torch` then fails with "libmpi.so.40: cannot open shared object file", and the denial is hard to diagnose: Landlock does not govern stat(), so ls and ldconfig still show the library, and glibc reports EACCES as "No such file or directory". Add an example policy that grants /opt and /sys read-only and /dev/shm read-write on top of the default policy, with a one-command CUDA check and an explanation of each addition. Signed-off-by: Dmitry Monakhov <dmonakhov@nvidia.com>
|
Thank you for your interest in contributing to OpenShell, @dmonakhov. This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer. To get vouched:
See CONTRIBUTING.md for details. |
|
Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text: I have read the DCO document and I hereby sign the DCO. You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot. |
I have read the DCO document and I hereby sign the DCO. |
NGC images such as nvcr.io/nvidia/pytorch keep HPC-X and other libraries under /opt, which the default policy does not grant.
import torchthen fails with "libmpi.so.40: cannot open shared object file", and the denial is hard to diagnose: Landlock does not govern stat(), so ls and ldconfig still show the library, and glibc reports EACCES as "No such file or directory".Add an example policy that grants /opt and /sys read-only and /dev/shm read-write on top of the default policy, with a one-command CUDA check and an explanation of each addition.