Fix update of ldcache on non-debian containers

This change ensures that the ldcache in a non-debian container
includes libraries at /lib64 and /usr/lib64 when running on
debian host.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

internal/ldconfig/ldconfig.go

@@ -38,9 +38,10 @@ const (
 )
 
 type Ldconfig struct {
-	ldconfigPath string
-	inRoot       string
-	directories  []string
+	ldconfigPath     string
+	inRoot           string
+	isDebianLikeHost bool
+	directories      []string
 }
 
 // NewRunner creates an exec.Cmd that can be used to run ldconfig.
@@ -50,6 +51,9 @@ func NewRunner(id string, ldconfigPath string, containerRoot string, additionala
 		"--ldconfig-path", strings.TrimPrefix(config.NormalizeLDConfigPath("@"+ldconfigPath), "@"),
 		"--container-root", containerRoot,
 	}
+	if isDebian() {
+		args = append(args, "--is-debian-like-host")
+	}
 	args = append(args, additionalargs...)
 
 	return createReexecCommand(args)
@@ -66,6 +70,10 @@ func NewRunner(id string, ldconfigPath string, containerRoot string, additionala
 //	--ldconfig-path=LDCONFIG_PATH	the path to ldconfig on the host
 //	--container-root=CONTAINER_ROOT	the path in which ldconfig must be run
 //
+// The following flags are optional:
+//
+//	--is-debian-like-host	Indicates that the host system is debian-based.
+//
 // The remaining args are folders where soname symlinks need to be created.
 func NewFromArgs(args ...string) (*Ldconfig, error) {
 	if len(args) < 1 {
@@ -74,6 +82,7 @@ func NewFromArgs(args ...string) (*Ldconfig, error) {
 	fs := flag.NewFlagSet(args[1], flag.ExitOnError)
 	ldconfigPath := fs.String("ldconfig-path", "", "the path to ldconfig on the host")
 	containerRoot := fs.String("container-root", "", "the path in which ldconfig must be run")
+	isDebianLikeHost := fs.Bool("is-debian-like-host", false, "the hook is running from a Debian-like host")
 	if err := fs.Parse(args[1:]); err != nil {
 		return nil, err
 	}
@@ -86,9 +95,10 @@ func NewFromArgs(args ...string) (*Ldconfig, error) {
 	}
 
 	l := &Ldconfig{
-		ldconfigPath: *ldconfigPath,
-		inRoot:       *containerRoot,
-		directories:  fs.Args(),
+		ldconfigPath:     *ldconfigPath,
+		inRoot:           *containerRoot,
+		isDebianLikeHost: *isDebianLikeHost,
+		directories:      fs.Args(),
 	}
 	return l, nil
 }
@@ -106,6 +116,12 @@ func (l *Ldconfig) UpdateLDCache() error {
 		"-f", "/etc/ld.so.conf",
 		"-C", "/etc/ld.so.cache",
 	}
+	// If we are running in a non-debian container on a debian host we also
+	// need to add the system directories for non-debian hosts to the list of
+	// folders processed by ldconfig.
+	if l.isDebianLikeHost && !isDebian() {
+		args = append(args, "/lib64", "/usr/lib64")
+	}
 
 	if err := createLdsoconfdFile(ldsoconfdFilenamePattern, l.directories...); err != nil {
 		return fmt.Errorf("failed to update ld.so.conf.d: %w", err)
@@ -114,6 +130,14 @@ func (l *Ldconfig) UpdateLDCache() error {
 	return SafeExec(ldconfigPath, args, nil)
 }
 
+func isDebian() bool {
+	info, err := os.Stat("/etc/debian_version")
+	if err != nil {
+		return false
+	}
+	return !info.IsDir()
+}
+
 func (l *Ldconfig) prepareRoot() (string, error) {
 	// To prevent leaking the parent proc filesystem, we create a new proc mount
 	// in the specified root.

tests/e2e/nvidia-container-toolkit_test.go

@@ -533,4 +533,29 @@ EOF`)
 			Expect(err).ToNot(HaveOccurred())
 		})
 	})
+
+	When("running a container a ubi9 container", Ordered, func() {
+		var (
+			expectedOutput string
+		)
+		BeforeAll(func(ctx context.Context) {
+			_, _, err := runner.Run(`docker pull redhat/ubi9`)
+			Expect(err).ToNot(HaveOccurred())
+
+			expectedOutput, _, err = runner.Run(`docker run --rm --runtime=runc redhat/ubi9 bash -c "ldconfig -p | grep libc.so."`)
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		It("should include the system libraries when using the nvidia-container-runtime", func(ctx context.Context) {
+			output, _, err := runner.Run(`docker run --rm --runtime=nvidia -e NVIDIA_VISIBLE_DEVICES=all redhat/ubi9 bash -c "ldconfig -p | grep libc.so."`)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(output).To(Equal(expectedOutput))
+		})
+
+		It("should include the system libraries when using the nvidia-container-runtime-hook", Label("legacy"), func(ctx context.Context) {
+			output, _, err := runner.Run(`docker run --rm --runtime=runc --gpus=all redhat/ubi9 bash -c "ldconfig -p | grep libc.so."`)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(output).To(Equal(expectedOutput))
+		})
+	})
 })