env variable causing - oci-hook:1: unexpected "|" in command

[erezzarum]

When using screen (GNU) it injects a TERMCAP.
For example

TERMCAP="SC|screen.xterm-256color|VT 100/ANSI X3.64 virtual terminal:DO=\\E[%dB:LE=\\E[%dD:RI=\\E[%dC:UP=\\E[%dA:bs:bt=\\E[Z:cd=\\E[J:ce=\\E[K:cl=\\E[H\\E[J:cm=\\E[%i%d;%dH:ct=\\E[3g:do=^J:nd=\\E[C:pt:rc=\\E8:rs=\\Ec:sc=\\E7:st=\\EH:up=\\EM:le=^H:bl=^G:cr=^M:it#8:ho=\\E[H:nw=\\EE:ta=^I:is=\\E)0:li#69:co#302:am:xn:xv:LP:sr=\\EM:al=\\E[L:AL=\\E[%dL:cs=\\E[%i%d;%dr:dl=\\E[M:DL=\\E[%dM:dc=\\E[P:DC=\\E[%dP:im=\\E[4h:ei=\\E[4l:mi:IC=\\E[%d@:ks=\\E[?1h\\E=:ke=\\E[?1l\\E>:vi=\\E[?25l:ve=\\E[34h\\E[?25h:vs=\\E[34l:ti=\\E[?1049h:te=\\E[?1049l:us=\\E[4m:ue=\\E[24m:so=\\E[3m:se=\\E[23m:mb=\\E[5m:md=\\E[1m:mh=\\E[2m:mr=\\E[7m:me=\\E[m:ms:Co#8:pa#64:AF=\\E[3%dm:AB=\\E[4%dm:op=\\E[39;49m:AX:vb=\\Eg:G0:as=\\E(0:ae=\\E(B:ac=\\140\\140aaffggjjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~..--++,,hhII00:po=\\E[5i:pf=\\E[4i:Km=\\E[<:k0=\\E[10~:k1=\\EOP:k2=\\EOQ:k3=\\EOR:k4=\\EOS:k5=\\E[15~:k6=\\E[17~:k7=\\E[18~:k8=\\E[19~:k9=\\E[20~:k;=\\E[21~:F1=\\E[23~:F2=\\E[24~:kB=\\E[Z:kh=\\E[1~:@1=\\E[1~:kH=\\E[4~:@7=\\E[4~:kN=\\E[6~:kP=\\E[5~:kI=\\E[2~:kD=\\E[3~:ku=\\EOA:kd=\\EOB:kr=\\EOC:kl=\\EOD:km:"

This causes the oci hook to exit with

FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running createRuntime hook #0: exit status 1, stdout: , stderr: containerd: template: oci-hook:1: unexpected "|" in command

$ export
...
declare -x TERMCAP="SC|screen.xterm-256color|VT 100/ANSI X3.64 virtual terminal:DO=\\E[%dB:LE=\\E[%dD:RI=\\E[%dC:UP=\\E[%dA:bs:bt=\\E[Z:cd=\\E[J:ce=\\E[K:cl=\\E[H\\E[J:cm=\\E[%i%d;%dH:ct=\\E[3g:do=^J:nd=\\E[C:pt:rc=\\E8:rs=\\Ec:sc=\\E7:st=\\EH:up=\\EM:le=^H:bl=^G:cr=^M:it#8:ho=\\E[H:nw=\\EE:ta=^I:is=\\E)0:li#69:co#302:am:xn:xv:LP:sr=\\EM:al=\\E[L:AL=\\E[%dL:cs=\\E[%i%d;%dr:dl=\\E[M:DL=\\E[%dM:dc=\\E[P:DC=\\E[%dP:im=\\E[4h:ei=\\E[4l:mi:IC=\\E[%d@:ks=\\E[?1h\\E=:ke=\\E[?1l\\E>:vi=\\E[?25l:ve=\\E[34h\\E[?25h:vs=\\E[34l:ti=\\E[?1049h:te=\\E[?1049l:us=\\E[4m:ue=\\E[24m:so=\\E[3m:se=\\E[23m:mb=\\E[5m:md=\\E[1m:mh=\\E[2m:mr=\\E[7m:me=\\E[m:ms:Co#8:pa#64:AF=\\E[3%dm:AB=\\E[4%dm:op=\\E[39;49m:AX:vb=\\Eg:G0:as=\\E(0:ae=\\E(B:ac=\\140\\140aaffggjjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~..--++,,hhII00:po=\\E[5i:pf=\\E[4i:Km=\\E[<:k0=\\E[10~:k1=\\EOP:k2=\\EOQ:k3=\\EOR:k4=\\EOS:k5=\\E[15~:k6=\\E[17~:k7=\\E[18~:k8=\\E[19~:k9=\\E[20~:k;=\\E[21~:F1=\\E[23~:F2=\\E[24~:kB=\\E[Z:kh=\\E[1~:@1=\\E[1~:kH=\\E[4~:@7=\\E[4~:kN=\\E[6~:kP=\\E[5~:kI=\\E[2~:kD=\\E[3~:ku=\\EOA:kd=\\EOB:kr=\\EOC:kl=\\EOD:km:"
...
$ nerdctl run --network=host --rm -it --gpus all --entrypoint /bin/bash <IMAGE>
FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running createRuntime hook #0: exit status 1, stdout: , stderr: containerd: template: oci-hook:1: unexpected "|" in command
$ unset TERMCAP
$ nerdctl run --network=host --rm -it --gpus all --entrypoint /bin/bash <IMAGE>
root@ip-10-1-0-235:/#

[erezzarum]

I'm not sure if this pose a security issue as well.
What caused it is not the pipe ("|") but "{{ }}"

export MY_VAR="{{ }}"
FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running createRuntime hook #0: exit status 1, stdout: , stderr: containerd: template: oci-hook:1: missing value for command

export MY_VAR="{{ function }}"
FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running createRuntime hook #0: exit status 1, stdout: , stderr: containerd: template: oci-hook:1: function "function" not defined

[elezar]

One thing to note: The NVIDIA Container Toolkit does not natively use createRuntime hooks. The issue that you are seeing comes from the way nerdctl (and ctr) implement support for the --gpus flag. cc @AkihiroSuda

As it happens, I have recently created the following PRs to update how this is done:

• nerdctl: Handle --gpus flag using CDI containerd/nerdctl#4617
• ctr: Map ctr --gpus requests to NVIDIA CDI device requests containerd/containerd#12537

It may be that the (createContainer) hooks that are used in the case of the updated implementation are still succeptible to this issue, but I would assume that the changes made to address https://www.wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape would prevent this in general.

If there is a security issue here, this is most likely with the OCI spec itself since it would affect ANY OCI createRuntime hooks and not just those used to provide NVIDIA GPU injection. A distincition should also be made between this case and CVE-2025-23266 where the environment in the CONTAINER IMAGE could affect behaviour on the host and not the environment explicitly set on the host -- albeit outside of the expected context of the hook execution.

[erezzarum]

Are we sure this is not where this happens?
https://github.com/NVIDIA/nvidia-container-toolkit/blob/main/cmd/nvidia-container-runtime-hook/main.go#L154

[elezar]

As per your log:

error running createRuntime hook #0

a createRuntime hook is explicitly mentioned. For nerdctl this is added in the following code (https://github.com/containerd/containerd/blame/f37f951f5601b309e3b31fadf66991625370f7ba/contrib/nvidia/nvidia.go#L90) imported from containerd. (See here where the options are handled). Note that this invokes the nvidia-container-cli (implemented in https://github.com/NVIDIA/libnvidia-container) directly.

Note that Docker uses a prestart hook: https://github.com/moby/moby/blob/710302ecf2e958db92cb7d92f8838ea063a31765/daemon/devices_nvidia_linux.go#L108 which would invoke the code from the nvidia-container-runtime-hook that you reference above.