In reply to @connorbaker:matrix.org
I've not used such a setup so I can't say -- am I understanding correctly that you'd have a NixOS VM running docker containers, and you want to pass the GPU through the VM and then through to the container?

In reply to @hexa:lossy.network
given that nix fails hard when a substituter is unavailable

In reply to @ser:sergevictor.eu
As I want to have a few containers, I suppose SR-IOV or MIG devices would be the best, do you have any experience with them?

In reply to @glepage:matrix.org
SomeoneSerge (UTC+U[-12,12]), connor (he/him) (UTC-7)
FYI: someone is adding NVIDIA's warp library: https://github.com/NixOS/nixpkgs/pull/412838

The interesting part is

      MemoryDenyWriteExecute = false; # Needed for CUDA/PyTorch JIT
      PrivateDevices = false; # Needed for GPU access
      RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK"];
      DevicePolicy = "closed"; # Only allow the following devices, based on strace usage:
      DeviceAllow = lib.flatten [
        # Basic devices
        "/dev/null rw"
        "/dev/urandom r"
        "/dev/tty rw"

        # NVIDIA control devices
        "/dev/nvidiactl rw"
        "/dev/nvidia-modeset rw"
        "/dev/nvidia-uvm rw"
        "/dev/nvidia-uvm-tools rw"

        (builtins.map (i: "/dev/nvidia${builtins.toString i} rw") (lib.splitString " " cfg.cudaDevices))

        # NVIDIA capability devices
        "/dev/nvidia-caps/nvidia-cap1 r"
        "/dev/nvidia-caps/nvidia-cap2 r"
      ];
      ProtectKernelTunables = true;
      ProtectKernelModules = true;
      ProtectControlGroups = true;
      RestrictNamespaces = true;
      LockPersonality = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      RemoveIPC = true;
      PrivateMounts = true;
      PrivateUsers = true;
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectClock = true;
      ProtectProc = "invisible";
      UMask = "0077";
      CapabilityBoundingSet = ["CAP_SYS_NICE"];
      AmbientCapabilities = ["CAP_SYS_NICE"];

Two things I've promised to look at today:

1. Bumping the version of protobuf used by OpenCV, which hasn't been updated in a while (need to backport to 25.05 as well).
2. Figuring out how to revert https://github.com/NixOS/nixpkgs/pull/414647 in a way that doesn't break consumers of OpenCV -- really don't want cudatoolkit propagated to all consumers of OpenCV.