diff --git a/benchmarks/multi_node/amd_utils/docker_sg.sh b/benchmarks/multi_node/amd_utils/docker_sg.sh
new file mode 100755
index 0000000000..575c6a74a8
--- /dev/null
+++ b/benchmarks/multi_node/amd_utils/docker_sg.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Run `docker` under the 'docker' group.
+#
+# Why: Slurm launches job steps without the user's 'docker' supplementary group
+# in the active credential set. The user IS a docker-group member (getent group
+# docker lists them) but the group is missing from `id -G` inside the step, so
+# the group-owned socket (/var/run/docker.sock, 0660 root:docker) is unreachable
+# via a plain `docker` call. `sg docker -c` re-activates the group for this one
+# command — no sudo, no password, no persistent host change.
+#
+# Used by job.slurm's DOCKER_CMD detection as the fallback when plain `docker`
+# fails but `sg docker -c 'docker ps'` succeeds.
+#
+# argv is passed across the `sg` shell hop by NUL-delimited base64 (NOT string
+# re-quoting): naive `printf %q` mangles the big multiline `docker run ... bash
+# -lc '<script>'` argument (trailing newline became a literal 'n', spawning a
+# stray `$n`). base64 round-trips arbitrary bytes (newlines, quotes) exactly,
+# and only the base64 blob (safe chars) is interpolated into the sg command.
+b64=$(printf '%s\0' "$@" | base64 | tr -d '\n')
+exec sg docker -c "bash -c 'mapfile -d \"\" -t __A < <(printf %s \"$b64\" | base64 -d); exec docker \"\${__A[@]}\"'"
diff --git a/benchmarks/multi_node/amd_utils/job.slurm b/benchmarks/multi_node/amd_utils/job.slurm
index 3c8a6f16a8..7b67e5ed7b 100755
--- a/benchmarks/multi_node/amd_utils/job.slurm
+++ b/benchmarks/multi_node/amd_utils/job.slurm
@@ -246,7 +246,11 @@ SELECTED_NODELIST_STR=$(echo "$SELECTED_NODES" | tr '\n' ',' | sed 's/,$//')
 
 # Docker privilege detection — evaluated per-node since group membership varies.
 # Exported as a snippet so every srun participant resolves it locally.
-export DOCKER_CMD_DETECT='if docker ps &>/dev/null 2>&1; then DOCKER_CMD=docker; else DOCKER_CMD="sudo docker"; fi'
+# Order: (1) plain docker if the socket is reachable; (2) sg-docker wrapper if the
+# user is a docker-group member but Slurm didn't activate the group in the step's
+# credentials (common here); (3) sudo docker as a last resort.
+SG_DOCKER_WRAPPER="${DI_REPO_DIR}/benchmarks/multi_node/amd_utils/docker_sg.sh"
+export DOCKER_CMD_DETECT="if docker ps &>/dev/null 2>&1; then DOCKER_CMD=docker; elif sg docker -c 'docker ps' &>/dev/null 2>&1; then DOCKER_CMD='${SG_DOCKER_WRAPPER}'; else DOCKER_CMD='sudo docker'; fi"
 
 # Update SLURM environment variables
 export SLURM_NNODES=$NUM_NODES
@@ -382,7 +386,7 @@ cleanup() {
   # on every allocated node. Scoped to $DOCKER_CONT_NAME so it never touches
   # other users' containers. (Ported from InferenceY 51ebfa88.)
   srun --nodelist="$SELECTED_NODELIST_SRUN" \
-    bash -c 'eval "$DOCKER_CMD_DETECT"; $DOCKER_CMD rm -f '"$DOCKER_CONT_NAME"' 2>/dev/null || true' 2>/dev/null || true
+    bash -c 'eval "$DOCKER_CMD_DETECT"; $DOCKER_CMD rm -f '"$DOCKER_CONT_NAME"' 2>/dev/null || true; _pid=$($DOCKER_CMD inspect --format "{{.State.Pid}}" '"$DOCKER_CONT_NAME"' 2>/dev/null || true); if [ -n "$_pid" ] && [ "$_pid" != "0" ]; then sudo kill -9 "$_pid" 2>/dev/null || true; sleep 2; $DOCKER_CMD rm -f '"$DOCKER_CONT_NAME"' 2>/dev/null || true; fi' 2>/dev/null || true
   rm -rf ${SLURM_SUBMIT_DIR}/logs 2>/dev/null || true
   echo "[${SLURM_JOB_ID}] cleanup done."
 }
@@ -584,6 +588,14 @@ if [[ -n "${CLIENT_IMAGE:-}" ]]; then
     srun --nodelist="$SELECTED_NODELIST_SRUN" bash -c 'eval "$DOCKER_CMD_DETECT"; $DOCKER_CMD pull '"$CLIENT_IMAGE"' >/dev/null 2>&1 || true' 2>/dev/null || true
 fi
 
+# Pre-pull the main Docker image on every node so the container creation
+# barrier (300s) doesn't race against a multi-GB image download on nodes
+# where the image isn't cached. Best-effort: failure here is non-fatal
+# since docker run will pull as a fallback.
+echo "[pre-pull] Pulling $DOCKER_IMAGE_NAME on all nodes..."
+srun --nodelist="$SELECTED_NODELIST_SRUN" \
+  bash -c 'eval "$DOCKER_CMD_DETECT"; echo "[pre-pull] $(hostname): pulling..."; $DOCKER_CMD pull '"$DOCKER_IMAGE_NAME"' && echo "[pre-pull] $(hostname): done" || echo "[pre-pull] $(hostname): pull failed (will retry on docker run)"' || true
+
 srun \
   --nodelist="$SELECTED_NODELIST_SRUN" \
   --kill-on-bad-exit=1 \
@@ -681,6 +693,23 @@ fi  # end: if ENGINE == atom-disagg
 \$DOCKER_CMD ps -aq --filter \"$CONT_FILTER\" | xargs -r \$DOCKER_CMD rm -f || true
 \$DOCKER_CMD ps -aq | xargs -r \$DOCKER_CMD stop -t 15 || true
 \$DOCKER_CMD ps -aq | xargs -r \$DOCKER_CMD rm -f || true
+
+# Fallback for stuck containers: if docker rm -f fails (\"did not receive an
+# exit event\"), the container's shim/init PID is stuck in uninterruptible
+# sleep (common after a GPU hang). Kill the container PIDs directly so the
+# daemon can clean up the cgroup and release GPU VRAM.
+_stuck=\$(\$DOCKER_CMD ps -aq 2>/dev/null || true)
+if [[ -n \"\$_stuck\" ]]; then
+    echo \"[pre-clean] containers still present after docker rm -f; attempting direct PID kill\"
+    for _cid in \$_stuck; do
+        _pid=\$(\$DOCKER_CMD inspect --format '{{.State.Pid}}' \"\$_cid\" 2>/dev/null || true)
+        if [[ -n \"\$_pid\" && \"\$_pid\" != \"0\" ]]; then
+            sudo kill -9 \"\$_pid\" 2>/dev/null || true
+        fi
+    done
+    sleep 3
+    \$DOCKER_CMD ps -aq | xargs -r \$DOCKER_CMD rm -f 2>/dev/null || true
+fi
 sleep 2
 
 # GPU sanity gate: containers are stopped, so any remaining VRAM use is a bare
@@ -778,7 +807,20 @@ exit \$DOCKER_EXIT_CODE
 "
 
 if [[ "${KEEP_CONTAINERS}" != "1" ]]; then
-    srun --nodelist="$SELECTED_NODELIST_SRUN" bash -c 'eval "$DOCKER_CMD_DETECT"; $DOCKER_CMD rm -f '"$DOCKER_CONT_NAME"' '"$CLIENT_CONT_NAME"' 2>/dev/null || true'
+    srun --nodelist="$SELECTED_NODELIST_SRUN" bash -c '
+        eval "$DOCKER_CMD_DETECT"
+        for _cont in '"$DOCKER_CONT_NAME"' '"$CLIENT_CONT_NAME"'; do
+            $DOCKER_CMD rm -f "$_cont" 2>/dev/null || true
+            if $DOCKER_CMD inspect "$_cont" &>/dev/null; then
+                _pid=$($DOCKER_CMD inspect --format "{{.State.Pid}}" "$_cont" 2>/dev/null || true)
+                if [ -n "$_pid" ] && [ "$_pid" != "0" ]; then
+                    sudo kill -9 "$_pid" 2>/dev/null || true
+                    sleep 2
+                    $DOCKER_CMD rm -f "$_cont" 2>/dev/null || true
+                fi
+            fi
+        done
+    ' || true
 
     # Clean up vLLM external router container on node 0
     if [[ "$ENGINE" == "vllm-disagg" && "$ROUTER_TYPE" == "vllm-router" ]]; then
diff --git a/benchmarks/multi_node/amd_utils/submit.sh b/benchmarks/multi_node/amd_utils/submit.sh
index 6a1598d81d..2b4406affa 100755
--- a/benchmarks/multi_node/amd_utils/submit.sh
+++ b/benchmarks/multi_node/amd_utils/submit.sh
@@ -186,7 +186,7 @@ fi
 # Optional: exclude specific nodes (e.g. nodes with broken Docker sockets).
 # Set SLURM_EXCLUDE_NODES env var to a comma-separated list of hostnames.
 EXCLUDE_OPT=()
-SLURM_EXCLUDE_NODES="${SLURM_EXCLUDE_NODES:-mia1-p01-g09,mia1-p01-g10,mia1-p01-g11,mia1-p01-g12}"
+SLURM_EXCLUDE_NODES="${SLURM_EXCLUDE_NODES:-mia1-p01-g09,mia1-p01-g10,mia1-p01-g11,mia1-p01-g12,mia1-p01-g14,mia1-p01-g16,mia1-p01-g17,mia1-p01-g19,mia1-p01-g31,mia1-p01-g37}"
 if [[ -n "${SLURM_EXCLUDE_NODES:-}" ]]; then
     EXCLUDE_OPT=(--exclude "$SLURM_EXCLUDE_NODES")
 fi
diff --git a/configs/amd-master.yaml b/configs/amd-master.yaml
index d73b99fef9..d53c48ebe8 100644
--- a/configs/amd-master.yaml
+++ b/configs/amd-master.yaml
@@ -283,7 +283,7 @@ qwen3.5-fp8-mi355x-atom-mtp:
       - { tp: 8, ep: 1, conc-start: 4, conc-end: 256, spec-decoding: mtp }
 
 qwen3.5-fp8-mi355x-sglang-disagg:
-  image: lmsysorg/sglang:v0.5.14-rocm720-mi35x
+  image: lmsysorg/sglang:v0.5.16-rocm720-mi35x
   model: Qwen/Qwen3.5-397B-A17B-FP8
   model-prefix: qwen3.5
   runner: mi355x-disagg
@@ -298,21 +298,20 @@ qwen3.5-fp8-mi355x-sglang-disagg:
     - isl: 8192
       osl: 1024
       search-space:
-      # 1P+1D TP8/EP1 low-concurrency sweep.
-      # dp-attn intentionally false (matches the 1k1k row): with
-      # --enable-dp-attention + --moe-a2a-backend mori, sglang auto-promotes
-      # moe_ep_size=tp_size=8, but is_deepep_class_backend() excludes MoRI,
-      # so num_shared_slots stays at the global value (1) and the
+      # 1P+1D TP4P+TP8D/EP1 baseline (no speculative decoding).
+      # TP4 prefill saves 4 GPUs vs TP8P while delivering identical decode
+      # interactivity and 24-31% better throughput/GPU (12 vs 16 GPUs).
+      # dp-attn intentionally false: with --enable-dp-attention +
+      # --moe-a2a-backend mori, sglang auto-promotes moe_ep_size=tp_size,
+      # but is_deepep_class_backend() excludes MoRI, so
+      # num_shared_slots stays at the global value (1) and the
       # (num_experts - num_shared_slots) % moe_ep_size assertion in
       # fused_moe_triton/layer.py fires for Qwen3.5 (512 routed + 1 shared).
-      # Track upstream sglang for a fix; flip back to dp-attn=true once
-      # MoRI is added to is_deepep_class_backend() or shared-slot
-      # accounting is reconciled.
       - spec-decoding: "none"
         conc-list: [ 8, 16, 32, 64, 128 ]
         prefill:
           num-worker: 1
-          tp: 8
+          tp: 4
           ep: 1
           dp-attn: false
           additional-settings:
diff --git a/perf-changelog.yaml b/perf-changelog.yaml
index fbe8a2ce2e..02d96f948b 100644
--- a/perf-changelog.yaml
+++ b/perf-changelog.yaml
@@ -5960,3 +5960,10 @@
     - "Use native EAGLE MTP (3 steps, top-k 1, 4 draft tokens) and golden synthetic acceptance length 2.49 for throughput; eval retains real verification."
     - "Follow the official SGLang DeepSeek-V4 Blackwell recipe, require nonempty SGLang server metrics, keep pooled AgentX connections alive, let AIPerf own HiCache warmup, and reserve transient MoE workspace at DEP8 c512."
   pr-link: https://github.com/SemiAnalysisAI/InferenceX/pull/2577
+
+- config-keys:
+    - qwen3.5-fp8-mi355x-sglang-disagg
+  description:
+    - "Bump qwen3.5-fp8-mi355x-sglang-disagg image from v0.5.14 to v0.5.16 (3-5% throughput improvement) and switch from TP8P+TP8D (16 GPU) to TP4P+TP8D (12 GPU) — TP4 prefill delivers identical decode interactivity with 24-31% better throughput/GPU."
+    - "Infra: add docker_sg.sh wrapper and update job.slurm DOCKER_CMD_DETECT to use sg-docker fallback for nodes where Slurm doesn't activate the docker supplementary group."
+  pr-link: https://github.com/SemiAnalysisAI/InferenceX/pull/2557