| 315 | |
| 316 | |
| 317 | Future<Option<ContainerLaunchInfo>> NvidiaGpuIsolatorProcess::prepare( |
| 318 | const ContainerID& containerId, |
| 319 | const mesos::slave::ContainerConfig& containerConfig) |
| 320 | { |
| 321 | if (containerId.has_parent()) { |
| 322 | // If we are a nested container in the `DEBUG` class, then we |
| 323 | // don't need to do anything special to prepare ourselves for GPU |
| 324 | // support. All Nvidia volumes will be inherited from our parent. |
| 325 | if (containerConfig.has_container_class() && |
| 326 | containerConfig.container_class() == ContainerClass::DEBUG) { |
| 327 | return None(); |
| 328 | } |
| 329 | |
| 330 | // If we are a nested container in a different class, we don't |
| 331 | // need to maintain an `Info()` struct about the container (since |
| 332 | // we don't directly allocate any GPUs to it), but we do need to |
| 333 | // mount the necessary Nvidia libraries into the container (since |
| 334 | // we live in a different mount namespace than our parent). We |
| 335 | // directly call `_prepare()` to do this for us. |
| 336 | return _prepare(containerId, containerConfig); |
| 337 | } |
| 338 | |
| 339 | if (infos.contains(containerId)) { |
| 340 | return Failure("Container has already been prepared"); |
| 341 | } |
| 342 | |
| 343 | infos[containerId] = new Info( |
| 344 | containerId, path::join(flags.cgroups_root, containerId.value())); |
| 345 | |
| 346 | // Grant access to all `controlDeviceEntries`. |
| 347 | // |
| 348 | // This allows standard NVIDIA tools like `nvidia-smi` to be |
| 349 | // used within the container even if no GPUs are allocated. |
| 350 | // Without these devices, these tools fail abnormally. |
| 351 | foreachkey (const Path& devicePath, controlDeviceEntries) { |
| 352 | Try<Nothing> allow = cgroups::devices::allow( |
| 353 | hierarchy, |
| 354 | infos[containerId]->cgroup, |
| 355 | controlDeviceEntries.at(devicePath)); |
| 356 | |
| 357 | if (allow.isError()) { |
| 358 | return Failure("Failed to grant cgroups access to" |
| 359 | " '" + stringify(devicePath) + "': " + allow.error()); |
| 360 | } |
| 361 | } |
| 362 | |
| 363 | return update(containerId, containerConfig.resources()) |
| 364 | .then(defer(PID<NvidiaGpuIsolatorProcess>(this), |
| 365 | &NvidiaGpuIsolatorProcess::_prepare, |
| 366 | containerId, |
| 367 | containerConfig)); |
| 368 | } |
| 369 | |
| 370 | |
| 371 | // If our `ContainerConfig` specifies a different `rootfs` than the |