Use a tmpfs to store the modified params file

Instead of creating the params file on the host, we use a tmpfs
mounted into the container instead.

Signed-off-by: Evan Lezar <[email protected]>

Author: elezar

cmd/nvidia-cdi-hook/update-nvidia-params/mount_linux.go

@@ -20,10 +20,16 @@
 package nvidiaparams
 
 import (
+	"fmt"
+
 	"golang.org/x/sys/unix"
 )
 
+func createTmpFs(target string, size uint64) error {
+	// return unix.Mount("tmpfs", target, "tmpfs", 0, fmt.Sprintf("ro,nosuid,nodev,noexec,size=%d", size))
+	return unix.Mount("tmpfs", target, "tmpfs", 0, fmt.Sprintf("size=%d", size))
+}
+
 func bindMountReadonly(source string, target string) error {
 	return unix.Mount(source, target, "", unix.MS_BIND|unix.MS_RDONLY|unix.MS_NOSYMFOLLOW, "")
-
 }

cmd/nvidia-cdi-hook/update-nvidia-params/mount_other.go

@@ -23,6 +23,10 @@ import (
 	"fmt"
 )
 
+func createTmpFs(target string, size uint64) error {
+	return fmt.Errorf("not supported")
+}
+
 func bindMountReadonly(source string, target string) error {
 	return fmt.Errorf("not supported")
 }

cmd/nvidia-cdi-hook/update-nvidia-params/update-nvidia-params.go

@@ -115,6 +115,7 @@ func (m command) updateNvidiaParamsFromReader(r io.Reader, containerRoot string)
 	var newLines []string
 	scanner := bufio.NewScanner(r)
 	var requiresModification bool
+	var requiredSize uint64
 	for scanner.Scan() {
 		line := scanner.Text()
 		if strings.HasPrefix(line, "ModifyDeviceFiles: ") {
@@ -128,6 +129,7 @@ func (m command) updateNvidiaParamsFromReader(r io.Reader, containerRoot string)
 			}
 		}
 		newLines = append(newLines, line)
+		requiredSize += uint64(len(line) + 5)
 	}
 	if err := scanner.Err(); err != nil {
 		return fmt.Errorf("failed to read params file: %w", err)
@@ -137,7 +139,15 @@ func (m command) updateNvidiaParamsFromReader(r io.Reader, containerRoot string)
 		return nil
 	}
 
-	containerParamsFile, err := os.CreateTemp("", "nvct-params-*")
+	tmpRoot, err := os.MkdirTemp("", "nvct-empty-dir*")
+	if err != nil {
+		return fmt.Errorf("failed to create temporary folder: %w", err)
+	}
+	if err := createTmpFs(tmpRoot, requiredSize); err != nil {
+		return fmt.Errorf("failed to create tmpfs mount for params file: %w", err)
+	}
+
+	containerParamsFile, err := os.Create(filepath.Join(tmpRoot, "nvct-params"))
 	if err != nil {
 		return fmt.Errorf("failed to create temporary params file: %w", err)
 	}
@@ -147,7 +157,7 @@ func (m command) updateNvidiaParamsFromReader(r io.Reader, containerRoot string)
 		return fmt.Errorf("failed to write temporary params file: %w", err)
 	}
 
-	if err := containerParamsFile.Chmod(0o644); err != nil {
+	if err := containerParamsFile.Chmod(0o444); err != nil {
 		return fmt.Errorf("failed to set permissions on temporary params file: %w", err)
 	}
 

cmd/nvidia-ctk-installer/container/toolkit/toolkit_test.go

@@ -87,6 +87,11 @@ containerEdits:
     - /lib/x86_64-linux-gnu
     hookName: createContainer
     path: {{ .toolkitRoot }}/nvidia-cdi-hook
+  - args:
+    - nvidia-cdi-hook
+    - update-nvidia-params
+    hookName: createContainer
+    path: {{ .toolkitRoot }}/nvidia-cdi-hook
   mounts:
   - containerPath: /lib/x86_64-linux-gnu/libcuda.so.999.88.77
     hostPath: /host/driver/root/lib/x86_64-linux-gnu/libcuda.so.999.88.77