bottlerocket-os / bottlerocket-os/bottlerocket

Unable to use lockdown mode with NVIDIA module on bottlerocket

Open
#4,218 3 comments 3 reactions 0 assignees View on GitHub
status/needs-triage type/bug
Dominant language
Rust
Stars
9.7k
Forks
586
Avg merge
1d 11h
Merged PRs (30d)
11

Description

When attempting to load the NVIDIA kernel module on a Bottlerocket AMI using kernel lockdown = `integrity`, errors like the following are produced:

```
5.879228] driverdog[2088]: 23:10:41 [ERROR] '/usr/bin/modprobe' failed - stderr: modprobe: ERROR: could not insert 'nvidia': Operation not permitted
[ 5.881035] driverdog[2088]: modprobe: ERROR: could not insert 'nvidia_uvm': Operation not permitted
[ 5.882187] driverdog[2088]: modprobe: ERROR: could not insert 'nvidia_modeset': Operation not permitted
[FAILED] Failed to start Load additional kernel modules.
See 'systemctl status load-kernel-modules.service' for details.
[DEPEND] Dependency failed for Bottlerocket initial configuration complete.
[DEPEND] Dependency failed for Isolates configured.target.
```

This was tested on the following versions in us-east-1: 1.30 (`ami-0c2f741e432159b2c`), 1.29 (`ami-06033e6f46c64c7db`), and 1.20 (`ami-046b028e6b00a3938`).

Sef-signing also does not work as a workaround - rather, we receive validation rejected.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.