Question 300
During a GPU datacenter maintenance window, an engineer discovers: A container in a multi-tenant GPU cluster can see accelerators allocated to another job because the runtime launches with unrestricted device exposure. Which repeatable operational safeguard best prevents recurrence of this failure?
Explanation
Correct Answer
This preventive practice addresses the underlying failure (Default broad GPU visibility can violate resource allocation and isolation assumptions in shared container environments.) and supports continued assurance through: A negative tenant test cannot enumerate unauthorized accelerators while the permitted device runs the expected workload.
Incorrect Answers
This prevention control targets another operational risk: After a driver upgrade, the container toolkit continues referencing stale GPU library paths, and a container loads incompatible runtime libraries. The currently reported mechanism remains: Default broad GPU visibility can violate resource allocation and isolation assumptions in shared container environments.
This prevention control targets another operational risk: A Docker AI image launches on a GPU host but reports no CUDA devices because the NVIDIA container runtime integration was never installed. The currently reported mechanism remains: Default broad GPU visibility can violate resource allocation and isolation assumptions in shared container environments.
This prevention control targets another operational risk: A BlueField DPU application fails after the host updates DOCA packages, while the DPU firmware and embedded software versions remain from an earlier release. The currently reported mechanism remains: Default broad GPU visibility can violate resource allocation and isolation assumptions in shared container environments.