"Отказано в доступе" при попытке запустить контейнер nvidia-docker
1. Описание проблемы или функции
я не могу нормально запустить контейнер:
# getenforce
Permissive
# docker run -it nvidia/cuda nvidia-smi
standard_init_linux.go:178: exec user process caused "permission denied"
# docker run -it nvidia/cuda sh -c "nvidia-smi"
Tue May 8 23:37:48 2018
+-----------------------------------------------------------------------------+
| NVIDIA-SMI 390.42 Driver Version: 390.42 |
|-------------------------------+----------------------+----------------------+
| GPU Name Persistence-M| Bus-Id Disp.A | Volatile Uncorr. ECC |
| Fan Temp Perf Pwr:Usage/Cap| Memory-Usage | GPU-Util Compute M. |
|===============================+======================+======================|
| 0 Tesla K80 Off | 00000000:06:00.0 Off | 0 |
| N/A 27C P8 26W / 149W | 0MiB / 11441MiB | 0% Default |
+-------------------------------+----------------------+----------------------+
следовательно, это вызывает проблемы для моих контейнеров nvidia/k8s-device-plugin для kubernetes.
2. Действия по воспроизведению проблемы
# yum install -y nvidia-container-runtime-hook
# yum install --downloadonly --downloaddir=/tmp/ nvidia-docker2-2.0.3-1.docker1.13.1.noarch nvidia-container-runtime-2.0.0-1.docker1.13.1.x86_64
# rpm -Uhv --replacefiles /tmp/nvidia-container-runtime-2.0.0-1.docker1.13.1.x86_64.rpm /tmp/nvidia-docker2-2.0.3-1.docker1.13.1.noarch.rpm
# cat <<EOF > /etc/systemd/system/docker.service.d/override.conf
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd-current --add-runtime=nvidia=/usr/bin/nvidia-container-runtime --default-runtime=nvidia --exec-opt native.cgroupdriver=systemd --userland-proxy-path=/usr/libexec/docker/docker-proxy-current \$OPTIONS \$DOCKER_STORAGE_OPTIONS \$DOCKER_NETWORK_OPTIONS \$ADD_REGISTRY \$BLOCK_REGISTRY \$INSECURE_REGISTRY \$REGISTRIES
EOF
# cat /etc/docker/daemon.json
{
}
# systemctl daemon-reload
# sudo systemctl restart docker
3. Информация, которую необходимо приложить (необязательно, если она считается неактуальной)
# uname -a
Linux ocio-gpu01 3.10.0-693.21.1.el7.x86_64 #1 SMP Wed Mar 7 19:03:37 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
# docker --version
Docker version 1.13.1, build 774336d/1.13.1
# nvidia-smi
Tue May 8 10:37:55 2018
+-----------------------------------------------------------------------------+
| NVIDIA-SMI 390.46 Driver Version: 390.46 |
...
# nvidia-container-cli -V
version: 1.0.0
build date: 2018-04-26T23:10+0000
build revision: 163054a04b21c4455c8cae7e47873d9f2a091f55
build compiler: gcc 4.8.5 20150623 (Red Hat 4.8.5-16)
build platform: x86_64
build flags: -D_GNU_SOURCE -D_FORTIFY_SOURCE=2 -DNDEBUG -std=gnu11 -O2 -g -fdata-sections -ffunction-sections -fstack-protector -fno-strict-aliasing -fvisibility=hidden -Wall -Wextra -Wcast-align -Wpointer-arith -Wmissing-prototypes -Wnonnull -Wwrite-strings -Wlogical-op -Wformat=2 -Wmissing-format-attribute -Winit-self -Wshadow -Wstrict-prototypes -Wunreachable-code -Wconversion -Wsign-conversion -Wno-unknown-warning-option -Wno-format-extra-args -Wno-gnu-alignof-expression -Wl,-zrelro -Wl,-znow -Wl,-zdefs -Wl,--gc-sections