fix: Provision /dev/nvidia-modeset in both display and graphics

[ehfd]

Reviewers: @elezar @myeolenv

Associated with NVIDIA/nvidia-container-toolkit#1979.

Summary

The modeset device was only mounted into containers that requested the display capability; the graphics capability also requires it. The device mount is now gated on either capability.

Why This Exists

/dev/nvidia-modeset backs the display-facing paths of the graphics APIs themselves — Vulkan direct-to-display, the EGLDevice/EGLOutput platform, and the presentation machinery used by Wayland compositor stacks — not only the X.Org driver. In options.h, display already implies OPT_GRAPHICS_LIBS, and OPT_DISPLAY gates exactly one thing: this device mount. A container requesting only graphics therefore received the complete graphics library set but not the device node those APIs need.

The NVIDIA Container Toolkit treats graphics and display as a single gate for its graphics injection at the OCI level, and CDI mode injects the device unconditionally. This aligns the nvidia-container-cli path — used by docker --gpus without the nvidia runtime — with that behavior.

Resolution

The modeset device mount condition in nvc_mount.c checks OPT_DISPLAY|OPT_GRAPHICS_LIBS instead of OPT_DISPLAY alone, with the comment updated accordingly.

Reviewer Considerations

• After this change, graphics and display are functionally identical in this library since OPT_DISPLAY gates nothing else. This is intentional and matches the toolkit's OCI-level behavior and CDI semantics.
• load_kernel_modules() already loads nvidia_modeset and creates the device node under --load-kmods, so no creation-side change is needed.
• The WSL path is unaffected: the check sits inside the !dxcore.initialized branch.

Behavior Changes

• Containers requesting graphics without display receive the modeset device mount and its device cgroup entry.
• compute, utility, and video remain unchanged; display behavior is unchanged.

Implementation Summary

• Extend one condition and its comment in the device mount loop in nvc_mount.c.

Verification

• Built shared and tools on Ubuntu x86_64 with GCC 14 (WITH_LIBELF=yes WITH_TIRPC=yes, version and revision provided for a tag-less tree).
• A/B validation on 2x Tesla P100, driver 580.178.04, Docker 29.7.2, with the CDI spec removed so docker run --runtime=runc --gpus all exercises the hook path and the host node deleted before each run:
  • stock library, NVIDIA_DRIVER_CAPABILITIES=graphics: no modeset device in the container;
  • patched library, graphics: /dev/nvidia-modeset present and openable, with the host node created by --load-kmods;
  • compute,utility: no modeset device; display: unchanged.

[Copilot]

Pull request overview

This PR aligns nvidia-container-cli’s device injection behavior with the NVIDIA Container Toolkit’s OCI-level semantics by ensuring /dev/nvidia-modeset is mounted for containers that request either the display or graphics capability (previously only display).

Changes:

• Extend the modeset-device gating check in nvc_driver_mount() to allow provisioning when OPT_GRAPHICS_LIBS is set, not only OPT_DISPLAY.
• Update the in-code comment to reflect the expanded gating condition.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.