[unknownhackerworld]

Description

NVIDIA_DRIVER_CAPABILITIES is parsed two different ways, and they disagree when the value has whitespace or empty entries.

Root cause. CUDA.GetDriverCapabilities() in internal/config/image/cuda_image.go split the variable on , and used every piece as is:

for c := range strings.SplitSeq(env, ",") {
    capabilities[DriverCapability(c)] = true
}

The legacy hook path (getDriverCapabilities in cmd/nvidia-container-runtime-hook/container_config.go) instead uses image.NewDriverCapabilities, which trims each entry and skips empty ones. GetDriverCapabilities() is what requiresGraphicsModifier in internal/modifier/graphics.go uses to decide whether to inject the graphics libraries and DRM devices. So with NVIDIA_DRIVER_CAPABILITIES="compute, graphics":

• the runtime hook / nvidia-container-cli path treats graphics as requested
• the graphics modifier sees " graphics", decides that neither graphics nor display was requested, and skips the modification

The container gets compute but silently misses the graphics (Vulkan/EGL/GLX) libraries. As a side effect, an unset or empty variable also produced a map with a single "" key.

Fix. GetDriverCapabilities() now returns NewDriverCapabilities(i.env[EnvVarNvidiaDriverCapabilities]), so both paths use the same parser. Valid values without whitespace give the same result as before.

Tradeoffs / alternatives.

• I could have trimmed inside the existing loop. Reusing NewDriverCapabilities keeps one parser for this variable instead of two that can drift apart again.
• I did not change how an unset variable is treated by the graphics modifier (it still means no graphics), because that is a separate behavior question from parsing.

Duplicate check. I searched open and closed issues and PRs for NVIDIA_DRIVER_CAPABILITIES, GetDriverCapabilities and capability whitespace handling. The only related open PR is #2122, which changes the panic message in the hook's getDriverCapabilities and does not touch this parser.

AI assistance (an AI coding agent) was used to find this bug, write the fix and tests, run the tests below, and draft this description.

Checklist

• No secrets, sensitive information, or unrelated changes
• Unit tests passing (make test) - see Testing for the exact commands
• Lint checks passing (make lint) - golangci-lint was not available in my environment. go vet and gofmt -l are clean for the changed packages.
• Test cases are added for new code paths
• Commits are signed-off and cryptographically signed

Testing

• New TestGetDriverCapabilities in internal/config/image/cuda_image_test.go covers unset, empty, plain, whitespace-padded and empty-entry values.
• New case in TestGraphicsModifier (internal/modifier/graphics_test.go): NVIDIA_DRIVER_CAPABILITIES="compute, graphics" must create the graphics modifier.

Before the fix (fix reverted, tests kept):

--- FAIL: TestGetDriverCapabilities
    expected: []string{"compute", "graphics"}
    actual  : []string{" compute ", " graphics "}
--- FAIL: TestGraphicsModifier
    expected: []string{"all"}
    actual  : []string(nil)

After the fix:

go test ./internal/config/image/ ./internal/modifier/ ./cmd/nvidia-container-runtime-hook/
ok  github.com/NVIDIA/nvidia-container-toolkit/internal/config/image
ok  github.com/NVIDIA/nvidia-container-toolkit/internal/modifier
ok  github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-container-runtime-hook

go test ./... passes except the cmd/nvidia-container-runtime tests that need the built nvidia-container-runtime binary on PATH. Those fail the same way without this change. This was not tested on a GPU node.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[henry118]

@unknownhackerworld please cryptographically sign the commit

[unknownhackerworld]

Thanks @henry118, I've re-pushed the commit signed.

[dims]

Sorry @unknownhackerworld, we are unable to accept this contribution as we only see github in the key.

# 3. verify
git verify-commit FETCH_HEAD
git log -1 --show-signature FETCH_HEAD

On this PR's commit the output is:

gpg: Signature made Mon Oct 26 15:33:09 2026 EDT
gpg:                using RSA key B5690EEEBB952194
gpg: Good signature from "GitHub <noreply@github.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
Primary key fingerprint: 9684 79A1 AFF9 27E3 7D1A  566B B569 0EEE BB95 2194