containers / containers/toolbox
Bump nvidia-container-toolkit to ≥ v1.18.0 for arch-specific Vulkan ICD discovery
- Dominant language
- Go
- Stars
- 3.5k
- Forks
- 262
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
On Fedora Silverblue with the RPM Fusion proprietary NVIDIA driver, Vulkan applications inside a Toolbx container fall back to `llvmpipe` even though the CDI machinery from #1497 otherwise works correctly.
I think the cause is that the current pinned version of `nvidia-container-toolkit` only looks for `vulkan/icd.d/nvidia_icd.json`, while Fedora/RPM Fusion ships the ICD manifest as `vulkan/icd.d/nvidia_icd.x86_64.json`. The ICD is therefore never added to the generated CDI specification, so the driver library is bind mounted into the container but the Vulkan loader has no manifest telling it the driver exists.
This is NVIDIA/nvidia-container-toolkit#767, fixed by NVIDIA/nvidia-container-toolkit#1125, which was released in `v1.18.0`. `src/go.mod` currently pins:
```
github.com/NVIDIA/nvidia-container-toolkit v1.17.8
```
**Steps how to reproduce the behaviour**
1. Fedora Silverblue 44 with `akmod-nvidia-580xx` and `xorg-x11-drv-nvidia-580xx-cuda` layered from RPM Fusion.
2. `toolbox enter`
3. `dnf install vulkan-tools && vulkaninfo --summary`
**Expected behaviour**
`vulkaninfo --summary` lists the NVIDIA GPU with `driverID = DRIVER_ID_NVIDIA_PROPRIETARY`.
**Actual behaviour**
Only `llvmpipe` is listed, plus a loader error about the implicit layer:
```
ERROR: [Loader Message] Code 0 : loader_get_json: Invalid JSON file /etc/vulkan/implicit_layer.d/nvidia_layers.json
...
Devices:
========
GPU0:
apiVersion = 1.4.354
driverVersion = 26.1.8
vendorID = 0x10005
deviceID = 0x0000
deviceType = PHYSICAL_DEVICE_TYPE_CPU
deviceName = llvmpipe (LLVM 22.1.8, 256 bits)
driverID = DRIVER_ID_MESA_LLVMPIPE
driverName = llvmpipe
driverInfo = Mesa 26.1.8 (LLVM 22.1.8)
conformanceVersion = 1.3.1.1
deviceUUID = 6d657361-3236-2e31-2e38-000000000000
driverUUID = 6c6c766d-7069-7065-5555-494400000000
```
The implicit layer is mounted (its filename is not arch-suffixed, so it matches) while the ICD it depends on is not, which is what produces the loader error.
Everything else in the CDI spec resolves correctly — `libGLX_nvidia.so.580.178.04`, the device nodes, and the ldcache update:
```
level=info msg="Selecting /usr/lib64/libGLX_nvidia.so.580.178.04 as /usr/lib64/libGLX_nvidia.so.580.178.04"
level=info msg="Selecting /dev/nvidiactl as /dev/nvidiactl"
level=info msg="Selecting /usr/share/vulkan/implicit_layer.d/nvidia_layers.json as /etc/vulkan/implicit_layer.d/nvidia_layers.json"
```
The only failure is the ICD lookup:
```
level=debug msg="Locating \"vulkan/icd.d/nvidia_icd.json\" in [/etc /var/home/victor/.local/share/flatpak/exports/share /var/lib/flatpak/exports/share /usr/local/share /usr/share]"
level=debug msg="Locating \"vulkan/icd.d/nvidia_icd.json\" in [/]"
level=warning msg="Could not locate vulkan/icd.d/nvidia_icd.json: pattern vulkan/icd.d/nvidia_icd.json not found\npattern vulkan/icd.d/nvidia_icd.json not found"
```
On the host the file is present under its arch-suffixed name:
```
$ ls /usr/share/vulkan/icd.d/nvidia_icd.x86_64.json
/usr/share/vulkan/icd.d/nvidia_icd.x86_64.json
```
Inside the container, `/etc/ld.so.conf.d/toolbx-nvidia.conf` is written as expected:
```
$ cat /etc/ld.so.conf.d/toolbx-nvidia.conf
# Written by Toolbx
# https://containertoolbx.org/
/usr/lib64
/usr/lib64/vdpau
```
And `/usr/share/vulkan/icd.d/` contains only the Mesa ICDs:
```
$ ll /usr/share/vulkan/icd.d/
total 48
-rw-r--r--. 1 root root 178 Aug 19 02:00 asahi_icd.x86_64.json
-rw-r--r--. 1 root root 181 Aug 19 02:00 broadcom_icd.x86_64.json
-rw-r--r--. 1 root root 176 Aug 19 02:00 dzn_icd.x86_64.json
-rw-r--r--. 1 root root 182 Aug 19 02:00 freedreno_icd.x86_64.json
-rw-r--r--. 1 root root 184 Aug 19 02:00 intel_hasvk_icd.x86_64.json
-rw-r--r--. 1 root root 178 Aug 19 02:00 intel_icd.x86_64.json
-rw-r--r--. 1 root root 176 Aug 19 02:00 lvp_icd.x86_64.json
-rw-r--r--. 1 root root 180 Aug 19 02:00 nouveau_icd.x86_64.json
-rw-r--r--. 1 root root 181 Aug 19 02:00 panfrost_icd.x86_64.json
-rw-r--r--. 1 root root 185 Aug 19 02:00 powervr_mesa_icd.x86_64.json
-rw-r--r--. 1 root root 179 Aug 19 02:00 radeon_icd.x86_64.json
-rw-r--r--. 1 root root 179 Aug 19 02:00 virtio_icd.x86_64.json
```
To validate this theory I've simply created the file `/etc/vulkan/icd.d/nvidia_icd.x86_64.json` inside the container with:
```
{
"file_format_version" : "1.0.1",
"ICD": {
"library_path": "/usr/lib64/libGLX_nvidia.so.0",
"api_version" : "1.4.312"
}
}
```
Which is what the current version of the same file on the host contains.
After running `vulkaninfo --summary` I can now see the Nvidia GPU:
```
Devices:
========
GPU0:
apiVersion = 1.4.312
driverVersion = 580.178.4.0
vendorID = 0x10de
deviceID = 0x1b06
deviceType = PHYSICAL_DEVICE_TYPE_DISCRETE_GPU
deviceName = NVIDIA GeForce GTX 1080 Ti
driverID = DRIVER_ID_NVIDIA_PROPRIETARY
driverName = NVIDIA
driverInfo = 580.178.04
conformanceVersion = 1.4.1.3
deviceUUID = dcbdff5e-df81-a129-4b51-2c341689d83e
driverUUID = f0e773c0-8ed4-56b7-842b-3368d137712a
GPU1:
apiVersion = 1.4.354
driverVersion = 26.1.8
vendorID = 0x10005
deviceID = 0x0000
deviceType = PHYSICAL_DEVICE_TYPE_CPU
deviceName = llvmpipe (LLVM 22.1.8, 256 bits)
driverID = DRIVER_ID_MESA_LLVMPIPE
driverName = llvmpipe
driverInfo = Mesa 26.1.8 (LLVM 22.1.8)
conformanceVersion = 1.3.1.1
deviceUUID = 6d657361-3236-2e31-2e38-000000000000
driverUUID = 6c6c766d-7069-7065-5555-494400000000
```
**Screenshots**
N/A
**Output of `toolbox --version` (v0.0.90+)**
`toolbox version 0.3`
**Toolbx package info (`rpm -q toolbox`)**
`toolbox-0.3-4.fc44.x86_64`
**Output of `podman version`**
```
Client: Podman Engine
Version: 5.8.4
API Version: 5.8.4
Go Version: go1.26.4-X:nodwarf5
Git Commit: 5431df23c742e5edea35bef34eed696f4db0106b
Built: Fri Jun 26 02:00:00 2026
Build Origin: Fedora Project
OS/Arch: linux/amd64
```
**Podman package info (`rpm -q podman`)**
`podman-5.8.4-1.fc44.x86_64`
**Info about your OS**
Fedora Silverblue 44, NVIDIA GeForce GTX 1080 Ti, driver 580.178.04
**Additional context**
The image used for the toolbox is my own "custom" one built from a simple Dockerfile with a `FROM registry.fedoraproject.org/fedora-toolbox:44` and some `RUN` to install some packages, it's available here: https://github.com/shellt0pia/fedora-toolbox
Contributor guide
Research direction
Start in src/go.mod and inspect the pinned github.com/NVIDIA/nvidia-container-toolkit version. Update the dependency to v1.18.0 or newer, then run the project’s available Go checks; done means the dependency is no longer pinned to v1.17.8 and the checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, devops
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 85/100