feat: add CUDA-enabled container images and document how to run containers #46

Merged

rcsheets merged 2 commits from feat/cuda-image into main

2026-07-22 06:04:32 +00:00

rcsheets commented

2026-07-22 06:03:07 +00:00

Owner

No description provided.

rcsheets added 2 commits

2026-07-22 06:03:08 +00:00

feat: add CUDA-enabled container image variant 8b07553568

Dockerfile.cuda builds the cuda-tagged server binary: a golang:1.26 build
stage with the CUDA 13.3 toolkit copied in from NVIDIA's devel image (the
Go image already carries the gcc/g++/make that cgo and nvcc need, so the
build never runs apt), and NVIDIA's runtime image as the final stage for
libcudart/libcublasLt. Kernels compile for sm_86 + sm_120 by default
(CUDA_ARCHS build arg mirrors the Makefile).

CI now builds and pushes -cuda suffixed tags (latest-cuda, <version>-cuda,
<sha>-cuda) alongside the CPU image, with the same flag-validation sanity
check -- it runs without a GPU because the cuda backend's init() only
registers a factory and libcudart dlopens the driver lazily, and it also
proves the runtime image carries the shared libraries the binary links.
make image-cuda / make push-cuda do the same locally.

.dockerignore keeps a locally built kernels .a (and other build products)
out of the build context, so the container always compiles its own kernels
instead of silently baking a stale local library.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs(readme): document running from the container images

ci / test_and_build (pull_request) Successful in 21s

Details

cdc41358be

How to run the CPU image with docker/podman (volume mount, uid 65534,
SELinux labeling, no shell in the scratch image) and the CUDA variant
(-cuda tags, nvidia-container-toolkit, --gpus all / CDI device flags).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pr-reviewer-bot commented

2026-07-22 06:03:08 +00:00

Collaborator

Automated review by pr-reviewer v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id r-605d1c-d7c944
This is an AI-generated review and may contain mistakes.

Status: ✅ Completed

⚠️ The primary review (Mistral Small) failed. The review below is from Claude Sonnet 5, which reviewed the same diff.

✅ Verdict: LGTM — Purely additive CUDA image build/CI/documentation changes with no secrets, credential leaks, or breaking changes to existing pipeline.

Reviewed the diff: adds a CUDA Dockerfile, CI steps to build/tag/push a -cuda image variant, a Makefile target, .dockerignore entries to prevent stale local kernel artifacts from leaking into build context, and README documentation.

Observations:

No secrets or credentials introduced; registry auth uses existing authfile mechanism already in place for the CPU image push.
.dockerignore addition is a sensible fix to avoid baking stale local build artifacts into the image — improves correctness, not a regression.
CI changes mirror the existing CPU image build/push pattern closely (build, tag, sanity check, push), reducing risk of copy-paste mistakes; the sanity check logic is reasonable (checks exit code + required-flag error message).
Dockerfile.cuda pins CUDA_VERSION/CUDA_MM together with a comment explaining the coupling; multi-stage build looks correct, non-root user (65534) retained for runtime.
No tests added, but this is infra/CI/build tooling, consistent with existing test coverage patterns for such files.
Nothing indicates broken existing CPU image build path; changes are purely additive except for .PHONY line update in Makefile, which is non-functional.

No exposed secrets, no obvious logic bugs, no destructive changes to existing pipeline. This is a safe, additive change.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id `r-605d1c-d7c944`* *This is an AI-generated review and may contain mistakes.* **Status:** ✅ Completed --- > ⚠️ The primary review (**Mistral Small**) failed. The review below is from **Claude Sonnet 5**, which reviewed the same diff. **✅ Verdict: LGTM** — Purely additive CUDA image build/CI/documentation changes with no secrets, credential leaks, or breaking changes to existing pipeline. Reviewed the diff: adds a CUDA Dockerfile, CI steps to build/tag/push a `-cuda` image variant, a Makefile target, .dockerignore entries to prevent stale local kernel artifacts from leaking into build context, and README documentation. Observations: - No secrets or credentials introduced; registry auth uses existing authfile mechanism already in place for the CPU image push. - .dockerignore addition is a sensible fix to avoid baking stale local build artifacts into the image — improves correctness, not a regression. - CI changes mirror the existing CPU image build/push pattern closely (build, tag, sanity check, push), reducing risk of copy-paste mistakes; the sanity check logic is reasonable (checks exit code + required-flag error message). - Dockerfile.cuda pins CUDA_VERSION/CUDA_MM together with a comment explaining the coupling; multi-stage build looks correct, non-root user (65534) retained for runtime. - No tests added, but this is infra/CI/build tooling, consistent with existing test coverage patterns for such files. - Nothing indicates broken existing CPU image build path; changes are purely additive except for .PHONY line update in Makefile, which is non-functional. No exposed secrets, no obvious logic bugs, no destructive changes to existing pipeline. This is a safe, additive change. </body>

rcsheets merged commit 590c742089 into main

2026-07-22 06:04:32 +00:00

rcsheets deleted branch feat/cuda-image

2026-07-22 06:04:33 +00:00

rcsheets referenced this pull request from a commit

2026-07-22 06:04:33 +00:00

Merge pull request 'feat: add CUDA-enabled container images and document how to run containers' (#46) from feat/cuda-image into main

rcsheets referenced this pull request

2026-07-22 06:45:23 +00:00

fix: CUDA image security updates, apt caching, and a 13.4 canary build #47