oci: implemented CDI device mapping

[preminger]

Description of the Pull Request (PR):

Added a --device flag to the experimental --oci runtime mode, allowing the user to make a device available in the contained using a CDI configuration.

This fixes or addresses the following GitHub issues:

• Fixes Add CDI --device support to --oci mode #1394

[dtrudg]

This is looking pretty nice so far. As in the comments, let's move the CDI specific stuff to its own file now, even though it's fairly trivial.

My biggest concern is to verify we are handling any 'env' edits from the CDI spec correctly.

We currently handle the environment when we finalize the spec, not create it. This is because the environment depends on the image config... which we don't yet have at the initial spec creation.

I think at present here, a CDI spec won't be able to set an env var, as we are replacing the spec.Process in finalizeSpec?

Will chat in-person about tests, as requested.

[elezar]

Some comments from the perspective of CDI. Here I would obviously defer to singulartiy maintainers.

One thing that I was wonder was whether we want to make the use of CDI devices mutually exclusive with other mechanisms for injecting NVIDIA devices? I would argue that this would make sense sicne using them both may lead to hard-to-diagnose problems due to the interactions with the nvidia-container-runtime-hook. This could be implemented as a follow-up though.

[dtrudg]

One thing that I was wonder was whether we want to make the use of CDI devices mutually exclusive with other mechanisms for injecting NVIDIA devices? I would argue that this would make sense sicne using them both may lead to hard-to-diagnose problems due to the interactions with the nvidia-container-runtime-hook.

I don't think we want to do this, personally... other than perhaps issuing a warning. I'd only support making them mutually exclusive if there's a way to scope it easily to only NVIDIA CDI devices.

I can definitely foresee situations where someone might be on a system with no NVIDIA CDI configuration in place yet, but some other CDI configuration for another device. We see the most unlikely combinations of config on hosts, quite regularly :-)

[elezar]

One thing that I was wonder was whether we want to make the use of CDI devices mutually exclusive with other mechanisms for injecting NVIDIA devices? I would argue that this would make sense sicne using them both may lead to hard-to-diagnose problems due to the interactions with the nvidia-container-runtime-hook.

I don't think we want to do this, personally... other than perhaps issuing a warning. I'd only support making them mutually exclusive if there's a way to scope it easily to only NVIDIA CDI devices.

I can definitely foresee situations where someone might be on a system with no NVIDIA CDI configuration in place yet, but some other CDI configuration for another device. We see the most unlikely combinations of config on hosts, quite regularly :-)

You're right. I forgot about the more general use cases here. Sorry about that.

[dtrudg]

This looks good to me to merge as the initial CDI implementation. Please make sure it is either merged using 'squash and merge' on GitHub... or rebased to squash the commits first, though.

If there are any additional things you want to do, please ask @wobito or another to re-review while I'm travelling.

We wil handle a bit more e2e-testing later on. There are the GPU tests, in which we can do some stuff to actually test whether an Nvidia GPU is visible in the container... on systems with one of those :-)