fix(azurelinux): update nvidia-container-toolkit to 1.17.8#8984
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the Azure Linux pin for the nvidia-container-toolkit component in parts/common/components.json to move AKS Azure Linux GPU images onto the 1.17.8 toolkit family, aligning with the security remediation requirement noted in the PR description.
Changes:
- Bump Azure Linux
nvidia-container-toolkitlatestVersionfrom1.17.3to1.17.8inparts/common/components.json.
Package Update Analysis: nvidia-container-toolkit
Version change: 1.17.3 → 1.17.8 (patch update)
OS variants affected: Azure Linux (the azurelinux.current components.json entry)
OS variants NOT updated: None — this component entry is Azure Linux–only in this repo (Ubuntu uses a different GPU image/toolkit supply path per PR description)
Changes between 1.17.3 and 1.17.8
| Change | Description | Risk |
|---|---|---|
| Security | Fixes multiple vulnerabilities addressed in 1.17.8 (including CVE-2025-23266, CVE-2025-23267 per NVIDIA bulletins/release notes) | 🟢 Low (positive change) |
| Bug fix / Behavior | Deterministic ordering of CDI mounts (can affect generated CDI output ordering; intended to stabilize testing/behavior) | 🟡 Medium |
| Debuggability | Adds NVIDIA_CTK_DEBUG environment variable to hooks |
🟢 Low |
| Bug fix | Fixes default handling for --cuda-compat-mode (addresses failures in some version-mix scenarios) |
🟢 Low |
| Bug fix | Fixes ldcache update variable initialization issues (noted on some distros/builds) and adds more logging | 🟢 Low |
Overall Risk: 🟡 Medium
Justification: This is a patch-level update with security fixes and a small behavior change around CDI mount ordering. While the change surface in this PR is minimal (a single pin update), nvidia-container-toolkit is a GPU-critical component, so it’s worth treating as medium operational risk.
Recommendation: Approve; if available, validate on an Azure Linux GPU nodepool that CDI/runtime config generation and GPU workloads still initialize correctly.
What this PR does / why we need it:
Updates the Azure Linux nvidia-container-toolkit family pin from
1.17.3to1.17.8to consume upstream security and bug fixes.The Azure Linux repository provides matching
1.17.8packages for the toolkit and its dependencies. The existing install logic selects the common upstream version and lets DNF resolve the appropriate package release.OS coverage: Azure Linux only. Ubuntu obtains the toolkit from the aks-gpu image.
Validation:
make validate-componentsgo test ./pkg/agent/...make generategenerated no additional diffs; its unit/generation stages passed, then the repository-wide shellcheck stage stopped on existing SC3014 warnings in unrelated filesWhich issue(s) this PR fixes:
N/A
Release note: