Skip to content

fix(azurelinux): update nvidia-container-toolkit to 1.17.8#8984

Merged
djsly merged 1 commit into
mainfrom
aganeshkumar/azlinux-toolkit-1.17.8
Jul 20, 2026
Merged

fix(azurelinux): update nvidia-container-toolkit to 1.17.8#8984
djsly merged 1 commit into
mainfrom
aganeshkumar/azlinux-toolkit-1.17.8

Conversation

@ganeshkumarashok

@ganeshkumarashok ganeshkumarashok commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

Updates the Azure Linux nvidia-container-toolkit family pin from 1.17.3 to 1.17.8 to consume upstream security and bug fixes.

The Azure Linux repository provides matching 1.17.8 packages for the toolkit and its dependencies. The existing install logic selects the common upstream version and lets DNF resolve the appropriate package release.

OS coverage: Azure Linux only. Ubuntu obtains the toolkit from the aks-gpu image.

Validation:

  • make validate-components
  • go test ./pkg/agent/...
  • make generate generated no additional diffs; its unit/generation stages passed, then the repository-wide shellcheck stage stopped on existing SC3014 warnings in unrelated files
  • Verified the required RPMs are available in the Azure Linux repository

Which issue(s) this PR fixes:

N/A

Release note:

none

Copilot AI review requested due to automatic review settings July 20, 2026 04:44
@github-actions github-actions Bot added the components This pull request updates cached components on Linux or Windows VHDs label Jul 20, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Azure Linux pin for the nvidia-container-toolkit component in parts/common/components.json to move AKS Azure Linux GPU images onto the 1.17.8 toolkit family, aligning with the security remediation requirement noted in the PR description.

Changes:

  • Bump Azure Linux nvidia-container-toolkit latestVersion from 1.17.3 to 1.17.8 in parts/common/components.json.

Package Update Analysis: nvidia-container-toolkit

Version change: 1.17.3 → 1.17.8 (patch update)
OS variants affected: Azure Linux (the azurelinux.current components.json entry)
OS variants NOT updated: None — this component entry is Azure Linux–only in this repo (Ubuntu uses a different GPU image/toolkit supply path per PR description)

Changes between 1.17.3 and 1.17.8

Change Description Risk
Security Fixes multiple vulnerabilities addressed in 1.17.8 (including CVE-2025-23266, CVE-2025-23267 per NVIDIA bulletins/release notes) 🟢 Low (positive change)
Bug fix / Behavior Deterministic ordering of CDI mounts (can affect generated CDI output ordering; intended to stabilize testing/behavior) 🟡 Medium
Debuggability Adds NVIDIA_CTK_DEBUG environment variable to hooks 🟢 Low
Bug fix Fixes default handling for --cuda-compat-mode (addresses failures in some version-mix scenarios) 🟢 Low
Bug fix Fixes ldcache update variable initialization issues (noted on some distros/builds) and adds more logging 🟢 Low

Overall Risk: 🟡 Medium

Justification: This is a patch-level update with security fixes and a small behavior change around CDI mount ordering. While the change surface in this PR is minimal (a single pin update), nvidia-container-toolkit is a GPU-critical component, so it’s worth treating as medium operational risk.
Recommendation: Approve; if available, validate on an Azure Linux GPU nodepool that CDI/runtime config generation and GPU workloads still initialize correctly.

@djsly
djsly merged commit 1e84302 into main Jul 20, 2026
46 checks passed
@djsly
djsly deleted the aganeshkumar/azlinux-toolkit-1.17.8 branch July 20, 2026 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

components This pull request updates cached components on Linux or Windows VHDs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants