[rsliter]

Summary

Support explicit all-GPU NVIDIA injection through ordinary Docker Desktop WSL sandbox creation. Preserve OpenShell ownership of the workload, protected GPU selection and restart admission while keeping existing CDI behavior unchanged.

Depends on #4204; the tested parent revision is 33350a881f55011286e7c3a68d8007e43e50e0bf.

Related Issue

Closes #4849

Changes

• Add operator-gated docker.nvidia_wsl_gpus=all, limited to Docker Desktop WSL and rejecting conflicting CDI or counted GPU requests.
• Create the NVIDIA DeviceRequest through the Docker driver and bind selection to protected boundary/runtime metadata.
• Validate persisted selection during admission and restart.
• Document configuration and update CLI guidance; cover eligibility, selection conflicts and admission mutation cases with regression tests.

Testing

• Docker driver suite: 165 passed on macOS and ARM64 Linux; two existing tests ignored.
• Strict Clippy and Rust formatting passed.
• Real ARM64 N1X Docker Desktop WSL: non-root CUDA initialization, enumeration, allocation, PTX kernel execution and result retrieval passed.
• Filesystem/network denial, seccomp, no-new-privileges and zero effective capabilities observed.
• Sandbox stop/start and gateway restart preserved exact workload/GPU identity, state and CUDA behavior.
• Owned workload/supervisor cleanup completed and QA gateway stopped.
• Documentation navigation and Markdown lint passed. Fern returned zero errors; all three warnings reproduce on the unchanged parent (MDX parsing, unauthenticated redirects check and theme contrast).
• Repository CI and automated review completed.

Hardware evidence: #4837 (comment)

The test used the local uncommitted patch on the parent revision, identified by compressed patch SHA256 9791d6251efe4f958d460d62cb9cbc5f09646edcd0a1d0c5683455a580683c71. Local commit c0730ecb8c9c8a4562af534ca717af72a06ddd61 matches the tested implementation patch; its only additional change is runtime-overview documentation. The SSH signature was verified locally. Hardware: RTX Spark N1X, Ubuntu24.04 WSL2, Docker Desktop4.96.0 / Engine29.9.1, NVIDIA620.66. Development gateway transport was used. Jetson, x86 hardware, individual GPU selection, model inference and production transport are not qualified by this evidence.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture/configuration guidance updated

Draft review context

Opened as a draft following Jim Meyer's invitation to share the proposed approach for review, relayed by the author. Issue #4849 still awaits state:accepted; the author currently has Read access to the upstream repository. The issue-acceptance check may remain red until maintainers record acceptance. This draft does not claim acceptance or merge readiness.

The PR targets #4204's branch to isolate this change. Retarget and reconcile validation after the dependency lands; the closing reference takes effect when this work reaches the default branch.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}

[rsliter]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

I have read the DCO document and I hereby sign the DCO.

You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.

I have read the DCO document and I hereby sign the DCO.

[rsliter]

WSL hardware validation

Tested implementation: c0730ecb8c9c8a4562af534ca717af72a06ddd61.

A fresh qualification on Docker Desktop WSL2 passed for the explicit docker.nvidia_wsl_gpus=all path. Before running, we fetched the published commit and verified that the remote source matched its implementation, including the new WSL GPU module. We reused the previously built ARM64 binaries after verifying all four recorded SHA-256 hashes; this was not a new build from the published commit. The additional runtime overview documentation does not change those binaries.

Environment: NVIDIA RTX Spark N1X, WSL Ubuntu 24.04 ARM64, kernel 6.18.33.2-microsoft-standard-WSL2, Docker Desktop 4.96.0 / Engine 29.9.1, NVIDIA driver 620.66. Workload image: ghcr.io/nvidia/nemoclaw/sandbox-base:v0.0.137, digest sha256:d8bed276c8ae089f4e1fc421288e1e793b36740a9d7f594586dddb52b8de2505.

Stage	Result
Normal sandbox creation with explicit GPU selection	Passed
CUDA initialization, device enumeration, allocation, PTX kernel execution, and result readback	Passed: one device, kernel result 42
Sandbox stop/start	CUDA, isolation, and persisted sandbox state passed
Gateway restart	Same sandbox recovered to Ready; CUDA, isolation, and persisted state passed
Cleanup	Sandbox deleted, sandbox list empty, no running Docker containers, QA gateway exited and port released

Each CUDA probe returned:

{"uid":998,"devices":1,"kernel_result":42,"cuda":"pass"}

Enforcement probes confirmed denied writes outside permitted paths, denied direct network access, zero effective capabilities, NoNewPrivs: 1, and seccomp mode 2. Strict Landlock remained enabled. The Docker Desktop environment does not advertise AppArmor, so this does not establish AppArmor coverage.

The script initially attempted exec while gateway recovery still reported Provisioning and exited. After confirming that the same sandbox reached Ready, we continued the remaining probes successfully without recreating it or repeating the gateway restart. The early failed probe and successful continuation logs are retained separately.

Raw qualification logs are retained on the test host under ~/openshell-4854-evidence. This establishes the tested single-GPU ARM64 WSL path with all selection. It does not establish x86 WSL, Jetson, multi-GPU selection, inference, or production transport qualification; the dedicated QA gateway used local development transport without provider credentials.

GitHub validation remains separate: Branch Checks and Helm Lint await maintainer /ok to test c0730ecb8c9c8a4562af534ca717af72a06ddd61 admission. The current E2E/GPU E2E success statuses indicate their opt-in labels were absent, not that those suites executed.

[rsliter]

recheck