Skip to content

fix(installer): refresh packaged Station CDI #7158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cv merged 5 commits into from
Jul 18, 2026
Merged

fix(installer): refresh packaged Station CDI #7158

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
98f5add
fix(installer): refresh packaged Station CDI
senthilr-nv Jul 18, 2026
0fd63e9
chore(ci): add platform matrix SPDX metadata
senthilr-nv Jul 18, 2026
cbab48a
merge: refresh PR #7158 from main
cv Jul 18, 2026
7dc32f0
test(installer): stub CDI mutation safety gate
cv Jul 18, 2026
8503b58
test(installer): cover packaged CDI failures
cv Jul 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ci/platform-matrix.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"$comment": "Single source of truth for NemoClaw launch claims and platform support. Covers platforms, inference providers, supported agents, messaging integrations, and deployment paths. Scripts read this to generate README and docs tables. QA/CI update platform/provider rows; the engineering owner reviews other rows. Docs are derived.",
"$comment": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.\nSPDX-License-Identifier: Apache-2.0\n\nSingle source of truth for NemoClaw launch claims and platform support. Covers platforms, inference providers, supported agents, messaging integrations, and deployment paths. Scripts read this to generate README and docs tables. QA/CI update platform/provider rows; the engineering owner reviews other rows. Docs are derived.",
"version": "1.1",
"updated": "2026-07-17",

Expand Down Expand Up @@ -66,7 +66,7 @@
"prd_priority": "P1",
"ci_tested": false,
"prerequisites_notes": "Deferred. For evaluation on a qualifying DGX Station GB300, see [Additional Setup for DGX Station](prerequisites/dgx-station-preparation) before the Quickstart.",
"notes": "The PRD marks this platform as P1. Workstation form-factor with NVIDIA GPUs and the same Docker + NVIDIA Container Toolkit + CDI requirements as DGX Spark. Station remains Deferred. For canonical hardware qualification, image requirements, preparation, repair limits, reboot handoff, and the explicit temporary metadata override, see [Prepare DGX Station to Install NemoClaw](../get-started/prerequisites/dgx-station-preparation). On a Station GB300, the installer accepts either a clean generic Ubuntu 24.04 ARM64 image or stock DGX OS `7.2.0`, `7.4.0`, or `7.5.0` when a safe, root-owned `/etc/dgx-release` marker identifies `DGX Server for GALAXY-GB300`. It also recognizes two exact no-OTA factory profiles for bounded qualification. Both require `DGX_PLATFORM=DGX Server for GALAXY-GB300` and require `DGX_OTA_VERSION` and `DGX_OTA_DATE` to be absent. The April 2026 NVIDIA Colossus BaseOS profile requires `DGX_PRETTY_NAME=NVIDIA DGX Server`, `DGX_SWBUILD_VERSION=7.5.0-GB300ws-GB200ws`, and `DGX_SWBUILD_DATE=2026-04-02-08-20-16`; the June 2026 NVIDIA AI Developer Tools profile requires `DGX_PRETTY_NAME=NVIDIA DGX GB300WS`, `DGX_SWBUILD_VERSION=7.5.0`, and `DGX_SWBUILD_DATE=2026-06-16-11-48-10`. The stock DGX OS and AI Developer Tools paths validate the factory stack in place without replacing host packages, enabling or restarting services, generating CDI configuration, or rewriting the Docker runtime. The Colossus BaseOS path preserves the factory kernel, driver, DKMS, Docker, and NVIDIA Container Toolkit packages and prepares only Docker access and packaged CDI. Only the Colossus BaseOS path registers the NVIDIA Docker runtime when the launch probe proves it is missing, with restoration of the prior daemon configuration if registration fails. Each path validates the factory GB300 driver and volatile ECC state, Docker and containerd, Buildx, `nvidia-ctk`, CDI, and GPU visibility through both CDI and `--gpus all` before it proceeds. By default, unknown DGX OS versions, unmatched no-OTA factory images, unsafe release markers, and other Station generations stop before host preparation. The installer offers express install with the pinned `nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4` recipe, including an approximately 352 GB model download, without follow-up provider, model, policy, or sandbox-name choices. On Station GB300 only, direct-GPU sandbox policies add the exact read-only BDF directory for each host-discovered NVIDIA display-class PCI device, plus only existing CPU, memory, NUMA topology, and NVIDIA module initialization paths; they do not add `/sys`, the PCI parent subtree, or sysfs write access. One physical DGX OS `7.5.0` GB300 validation completed with released OpenShell `0.0.85`, local Nemotron Ultra serving, sandbox `cuInit(0)`, and a Hermes write/read file-tool task. In that validation, reads of `/sys/fs/cgroup/cgroup.controllers` and `/sys/class/net/lo/address` remained denied. DGX Station remains Deferred pending repeat qualification from a clean host and CI coverage. Pass `--station-deepseek` to use `deepseek-ai/DeepSeek-V4-Flash` while retaining the one-confirmation express flow. The flag requires an interactive terminal, and `/dev/tty` must be available when the installer runs through `curl | bash`. For headless setup on a qualifying Station, select `NEMOCLAW_PROVIDER=install-vllm` and `NEMOCLAW_VLLM_MODEL=deepseek-v4-flash` instead. Direct managed-vLLM onboarding still defaults to `deepseek-ai/DeepSeek-V4-Flash` when no model override is set."
"notes": "The PRD marks this platform as P1. Workstation form-factor with NVIDIA GPUs and the same Docker + NVIDIA Container Toolkit + CDI requirements as DGX Spark. Station remains Deferred. For canonical hardware qualification, image requirements, preparation, repair limits, reboot handoff, and the explicit temporary metadata override, see [Prepare DGX Station to Install NemoClaw](../get-started/prerequisites/dgx-station-preparation). On a Station GB300, the installer accepts either a clean generic Ubuntu 24.04 ARM64 image or stock DGX OS `7.2.0`, `7.4.0`, or `7.5.0` when a safe, root-owned `/etc/dgx-release` marker identifies `DGX Server for GALAXY-GB300`. It also recognizes two exact no-OTA factory profiles for bounded qualification. Both require `DGX_PLATFORM=DGX Server for GALAXY-GB300` and require `DGX_OTA_VERSION` and `DGX_OTA_DATE` to be absent. The April 2026 NVIDIA Colossus BaseOS profile requires `DGX_PRETTY_NAME=NVIDIA DGX Server`, `DGX_SWBUILD_VERSION=7.5.0-GB300ws-GB200ws`, and `DGX_SWBUILD_DATE=2026-04-02-08-20-16`; the June 2026 NVIDIA AI Developer Tools profile requires `DGX_PRETTY_NAME=NVIDIA DGX GB300WS`, `DGX_SWBUILD_VERSION=7.5.0`, and `DGX_SWBUILD_DATE=2026-06-16-11-48-10`. The stock DGX OS path validates the factory stack in place without replacing host packages, enabling or restarting services, generating CDI configuration, or rewriting the Docker runtime. The AI Developer Tools path preserves those boundaries when `nvidia.com/gpu=all` is already present. When that CDI device is missing, it requires no active workloads, enables the packaged `nvidia-cdi-refresh.path` and `nvidia-cdi-refresh.service` units, starts the path unit, restarts the refresh service, and checks the device again. It stops with service diagnostics if packaged refresh fails or omits the device. It never generates CDI directly, rewrites the Docker runtime, or restarts Docker or containerd. The Colossus BaseOS path preserves the factory kernel, driver, DKMS, Docker, and NVIDIA Container Toolkit packages and prepares only Docker access and packaged CDI. Only the Colossus BaseOS path registers the NVIDIA Docker runtime when the launch probe proves it is missing, with restoration of the prior daemon configuration if registration fails. Each path validates the factory GB300 driver and volatile ECC state, Docker and containerd, Buildx, `nvidia-ctk`, CDI, and GPU visibility through both CDI and `--gpus all` before it proceeds. By default, unknown DGX OS versions, unmatched no-OTA factory images, unsafe release markers, and other Station generations stop before host preparation. The installer offers express install with the pinned `nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4` recipe, including an approximately 352 GB model download, without follow-up provider, model, policy, or sandbox-name choices. On Station GB300 only, direct-GPU sandbox policies add the exact read-only BDF directory for each host-discovered NVIDIA display-class PCI device, plus only existing CPU, memory, NUMA topology, and NVIDIA module initialization paths; they do not add `/sys`, the PCI parent subtree, or sysfs write access. One physical DGX OS `7.5.0` GB300 validation completed with released OpenShell `0.0.85`, local Nemotron Ultra serving, sandbox `cuInit(0)`, and a Hermes write/read file-tool task. In that validation, reads of `/sys/fs/cgroup/cgroup.controllers` and `/sys/class/net/lo/address` remained denied. DGX Station remains Deferred pending repeat qualification from a clean host and CI coverage. Pass `--station-deepseek` to use `deepseek-ai/DeepSeek-V4-Flash` while retaining the one-confirmation express flow. The flag requires an interactive terminal, and `/dev/tty` must be available when the installer runs through `curl | bash`. For headless setup on a qualifying Station, select `NEMOCLAW_PROVIDER=install-vllm` and `NEMOCLAW_VLLM_MODEL=deepseek-v4-flash` instead. Direct managed-vLLM onboarding still defaults to `deepseek-ai/DeepSeek-V4-Flash` when no model override is set."
Comment thread
coderabbitai[bot] marked this conversation as resolved.
},
{
"name": "NVIDIA RTX (consumer and Pro workstation GPUs)",
Expand Down
10 changes: 8 additions & 2 deletions docs/get-started/dgx-station-preparation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,11 +73,17 @@ After changing pinned packages, the installer exits with status `10`; reboot, si

On a qualifying stock DGX OS or exact no-OTA factory image, express install validates the factory stack in place against the local default Docker daemon.
It requires a loaded GB300 driver with zero volatile corrected and uncorrected ECC errors, active Docker and containerd services, working Docker Buildx, `nvidia-ctk`, the `nvidia.com/gpu=all` CDI device, and successful `nvidia-smi` device-visibility probes through both CDI and `--gpus all`.
The stock DGX OS and AI Developer Tools paths do not install or replace host packages, enable or restart services, generate CDI configuration, or rewrite the Docker runtime.
The stock DGX OS path does not install or replace host packages, enable or restart services, generate CDI configuration, or rewrite the Docker runtime.
The AI Developer Tools path preserves those boundaries when `nvidia.com/gpu=all` is already present.
When that CDI device is missing, the AI Developer Tools path first confirms that no workloads are active, then enables the packaged `nvidia-cdi-refresh.path` and `nvidia-cdi-refresh.service` units, starts the path unit, restarts the refresh service, and checks the device again.
It stops with service diagnostics if packaged refresh fails or omits the device.
It never generates CDI directly, rewrites the Docker runtime, or restarts Docker or containerd.
This compatibility repair is owned by the June 2026 AI Developer Tools factory-image boundary, which can leave its packaged CDI units disabled; it can be removed after repeat clean-host qualification shows that the qualified image consistently advertises `nvidia.com/gpu=all` at boot.
The Colossus BaseOS path requires the exact reviewed package and failed-service fingerprints, preserves the factory kernel, driver, DKMS, Docker, and NVIDIA Container Toolkit packages, and prepares only Docker access and packaged CDI.
Only the Colossus BaseOS path registers the NVIDIA Docker runtime when the launch probe proves that the runtime is missing, and it restores the prior daemon configuration if registration fails.
The preparation helper writes a private audit log under `~/station-bootstrap-logs`.
Aside from the installer's separately disclosed `docker`-group membership grant when the current trusted account needs Docker access, the stock DGX OS and AI Developer Tools paths leave only the digest-pinned visibility-test image in the Docker cache.
Aside from the installer's separately disclosed `docker`-group membership grant when the current trusted account needs Docker access, the stock DGX OS path leaves only the digest-pinned visibility-test image in the Docker cache.
The AI Developer Tools path can also leave the packaged CDI refresh units enabled when it repairs a missing device.

One physical DGX OS `7.5.0` GB300 validation completed with released OpenShell `0.0.85`, local Nemotron Ultra serving, sandbox `cuInit(0)`, and a Hermes write/read file-tool task.
Repeat qualification from a clean host and CI coverage remain pending.
Expand Down
Loading
Loading