Repository: bottlerocket-os/bottlerocket-core-kit
Pull request #458: Packages: Drop shimpei oci add hook
Author: login: sky1122
Created: 2025-04-04T16:00:27Z | Merged: 2025-04-15T16:39:17Z

<!--
Tips:
- Please read CONTRIBUTING.md to understand our process and our requests for PRs.
- Please file an issue before creating a PR so we can discuss the change and confirm it's not already being worked on.
-->

**Issue number:**

Closes #453 

**Description of changes:**

Replace Shimpei and the OCI-add-hooks packages with NVIDIA Container Runtime to handle OCI hook injection.


**Testing done:**
based on the current branch, running MIG test on k8s-1.32-nvidia variant.
```
{
  "os": {
    "arch": "x86_64",
    "build_id": "e5cd08cf-dirty",
    "pretty_name": "Bottlerocket OS 1.36.0 (aws-k8s-1.32-nvidia)",
    "variant_id": "aws-k8s-1.32-nvidia",
    "version_id": "1.36.0"
  }
}
```

Below is some of the pods
```
╰$ kubectl get pods -A
NAMESPACE     NAME                             READY   STATUS              RESTARTS      AGE
default       nvidia-cuda-workload-45j4d       0/1     ContainerCreating   0             10s
default       nvidia-cuda-workload-4tsv8       0/1     ContainerCreating   0             10s
default       nvidia-cuda-workload-67q25       0/1     ContainerCreating   0             10s
```

```
╰$ kubectl logs nvidia-cuda-workload-45j4d
[Vector addition of 50000 elements]
Copy input data from the host memory to the CUDA device
CUDA kernel launch with 196 blocks of 256 threads
Copy output data from the CUDA device to the host memory
Test PASSED
Done

╰$ kubectl logs nvidia-cuda-workload-4tsv8
[Vector addition of 50000 elements]
Copy input data from the host memory to the CUDA device
CUDA kernel launch with 196 blocks of 256 threads
Copy output data from the CUDA device to the host memory
Test PASSED
Done

 kubectl logs nvidia-cuda-workload-6ggq4
[Vector addition of 50000 elements]
Copy input data from the host memory to the CUDA device
CUDA kernel launch with 196 blocks of 256 threads
Copy output data from the CUDA device to the host memory
Test PASSED
Done
```
Time Slicing and MIG cross setting looks fine
```
Allocatable:
  cpu:                    95690m
  ephemeral-storage:      15751651301
  hugepages-1Gi:          0
  hugepages-2Mi:          0
  memory:                 1167612760Ki
  nvidia.com/gpu:         0
  nvidia.com/gpu.shared:  224
```
Running the CUDA work load and also pass all the test.




- `aws-ecs-2-nvidia`
```
{
    "events": [
        {
            "timestamp": 1743733927639,
            "message": "[Vector addition of 50000 elements]",
            "ingestionTime": 1743733927891
        },
        {
            "timestamp": 1743733927639,
            "message": "Copy input data from the host memory to the CUDA device",
            "ingestionTime": 1743733927891
        },
        {
            "timestamp": 1743733927639,
            "message": "CUDA kernel launch with 196 blocks of 256 threads",
            "ingestionTime": 1743733927891
        },
        {
            "timestamp": 1743733927639,
            "message": "Copy output data from the CUDA device to the host memory",
            "ingestionTime": 1743733927891
        },
        {
            "timestamp": 1743733927639,
            "message": "Test PASSED",
            "ingestionTime": 1743733927891
        },
        {
            "timestamp": 1743733927639,
            "message": "Done",
            "ingestionTime": 1743733927891
        }
    ],
    "nextForwardToken": "f/38886566014310374304316267989737695526165333852819750917/s",
    "nextBackwardToken": "b/38886566014310374304316267989737695526165333852819750912/s"
}
(END)
```
- `aws-k8s-1.32-nvidia`
```
╭─ in ~/k8s
╰$ cat pod-nvidia-test.yaml
apiVersion: v1
kind: Pod
metadata:
  name: k8s-1.32-drop-shimpei
spec:
  restartPolicy: OnFailure
  containers:
    - name: test
      image: nvcr.io/nvidia/k8s/cuda-sample:vectoradd-cuda10.2
      command: ["sleep", "infinity"]
      resources:
        limits:
          nvidia.com/gpu: 1
╭─in ~/k8s
╰$ kubectl apply -f pod-nvidia-test.yaml

╭─ in ~/k8s
╰$ kubectl exec -it k8s-1.32-drop-shimpei -- /bin/bash -c "/tmp/vectorAdd"
[Vector addition of 50000 elements]
Copy input data from the host memory to the CUDA device
CUDA kernel launch with 196 blocks of 256 threads
Copy output data from the CUDA device to the host memory
Test PASSED
Done


Bottlerocket host's root filesystem.
[root@admin]# sheltie
bash-5.1# nvidia-smi
Thu Apr  3 22:44:37 2025
+---------------------------------------------------------------------------------------+
| NVIDIA-SMI 535.230.02             Driver Version: 535.230.02   CUDA Version: 12.2     |
|-----------------------------------------+----------------------+----------------------+
| GPU  Name                 Persistence-M | Bus-Id        Disp.A | Volatile Uncorr. ECC |
| Fan  Temp   Perf          Pwr:Usage/Cap |         Memory-Usage | GPU-Util  Compute M. |
|                                         |                      |               MIG M. |
|=========================================+======================+======================|
|   0  Tesla T4                       On  | 00000000:00:1E.0 Off |                    0 |
| N/A   22C    P8               8W /  70W |      2MiB / 15360MiB |      0%      Default |
|                                         |                      |                  N/A |
+-----------------------------------------+----------------------+----------------------+

+---------------------------------------------------------------------------------------+
| Processes:                                                                            |
|  GPU   GI   CI        PID   Type   Process name                            GPU Memory |
|        ID   ID                                                             Usage      |
|=======================================================================================|
|  No running processes found                                                           |
+---------------------------------------------------------------------------------------+
bash-5.1# exit
exit
[root@admin]# apiclient get os
{
  "os": {
    "arch": "x86_64",
    "build_id": "833cf9ad-dirty",
    "pretty_name": "Bottlerocket OS 1.35.0 (aws-k8s-1.32-nvidia)",
    "variant_id": "aws-k8s-1.32-nvidia",
    "version_id": "1.35.0"
  }
}
```

**Terms of contribution:**

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.


Linked issue #453: Remove shimpei and oci-add-hooks
`shimpei` and `oci-add-hooks` were originally added to support NVIDIA GPUs, since at the time we added the support `nvidia-container-runtime` was a fork of `runc`. The newest versions of  `nvidia-container-runtime` are just a wrapper around `runc`, which already handle how the `prestart` hook is injected for the legacy NVIDIA container toolkit stack. For NVIDIA variants, we can simplify the stack by using `nvidia-container-runtime` instead of these two programs, getting the same results.

The other use case we had for both programs was to inject custom OCI hooks, but the single hook has been deprecated for more than a year, and these programs effectively do nothing for normal variants so we could just remove them and go back to just call `runc`.

Diff:
diff --git a/Cargo.lock b/Cargo.lock
index 92b04f70f..82c019c61 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -159,7 +159,6 @@ dependencies = [
  "nvidia-container-toolkit",
  "nvidia-k8s-device-plugin",
  "nvme-cli",
- "oci-add-hooks",
  "open-vm-tools",
  "os",
  "pciutils",
@@ -839,13 +838,6 @@ dependencies = [
  "libnvme",
 ]
 
-[[package]]
-name = "oci-add-hooks"
-version = "0.1.0"
-dependencies = [
- "glibc",
-]
-
 [[package]]
 name = "open-vm-tools"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index 7444afec7..294e1f7dd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -95,7 +95,6 @@ members = [
   "packages/nvidia-container-toolkit",
   "packages/nvidia-k8s-device-plugin",
   "packages/nvme-cli",
-  "packages/oci-add-hooks",
   "packages/open-vm-tools",
   "packages/os",
   "packages/pciutils",
diff --git a/GLOSSARY.md b/GLOSSARY.md
index dd08bfca3..bd9176dc7 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -28,7 +28,6 @@
 * [**thar-be-settings**](sources/api/thar-be-settings): A program that writes out system configuration files, replacing template variables with settings from the API.
 * [**updog**](sources/updater/updog): An update client that interfaces with a specified TUF updates repository to upgrade or downgrade Bottlerocket hosts to different image versions.
 * [**prairiedog**](sources/api/prairiedog): A program that handles various boot related operations.
-* [**shimpei**](sources/shimpei): An OCI compatible shim wrapper around `oci-add-hooks`. Its sole purpose is to call `oci-add-hooks` with the additional `--hook-config-path` and `--runtime-path` parameters that can't be provided by containerd.
 
 ## Non-Bottlerocket terms
 
@@ -44,4 +43,3 @@
 * **TUF**: [The Update Framework](https://theupdateframework.io/).
   A framework that helps developers maintain the security of software update systems.
 * [**wicked**](https://github.com/openSUSE/wicked): A network interface framework and management system.
-* [**oci-add-hooks**](https://github.com/awslabs/oci-add-hooks): An OCI runtime that injects the OCI `prestart`, `poststart`, and `poststop` hooks into a container `config.json` before passing along to an OCI compatible runtime.
diff --git a/kits/bottlerocket-core-kit/Cargo.toml b/kits/bottlerocket-core-kit/Cargo.toml
index 17c2e46d7..22135d523 100644
--- a/kits/bottlerocket-core-kit/Cargo.toml
+++ b/kits/bottlerocket-core-kit/Cargo.toml
@@ -106,7 +106,6 @@ netdog = {path = "../../packages/netdog" }
 nvidia-container-toolkit = { path = "../../packages/nvidia-container-toolkit" }
 nvidia-k8s-device-plugin = { path = "../../packages/nvidia-k8s-device-plugin" }
 nvme-cli = { path = "../../packages/nvme-cli" }
-oci-add-hooks = { path = "../../packages/oci-add-hooks" }
 open-vm-tools = { path = "../../packages/open-vm-tools" }
 os = { path = "../../packages/os" }
 pciutils = { path = "../../packages/pciutils" }
diff --git a/packages/containerd/containerd-config-toml_k8s_containerd_sock b/packages/containerd/containerd-config-toml_k8s_containerd_sock
index b08665d8f..058f3fd3e 100644
--- a/packages/containerd/containerd-config-toml_k8s_containerd_sock
+++ b/packages/containerd/containerd-config-toml_k8s_containerd_sock
@@ -36,16 +36,12 @@ enable_unprivileged_ports = {{settings.container-runtime.enable-unprivileged-por
 enable_unprivileged_icmp = {{settings.container-runtime.enable-unprivileged-icmp}}
 {{/if}}
 
-[plugins."io.containerd.grpc.v1.cri".containerd]
-default_runtime_name = "shimpei"
-
-[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.shimpei]
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
 runtime_type = "io.containerd.runc.v2"
 base_runtime_spec = "/etc/containerd/cri-base.json"
 
-[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.shimpei.options]
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
 SystemdCgroup = true
-BinaryName = "shimpei"
 
 [plugins."io.containerd.grpc.v1.cri".cni]
 bin_dir = "/opt/cni/bin"
diff --git a/packages/containerd/containerd-config-toml_k8s_nvidia_containerd_sock b/packages/containerd/containerd-config-toml_k8s_nvidia_containerd_sock
index d6f905b15..384dafbb5 100644
--- a/packages/containerd/containerd-config-toml_k8s_nvidia_containerd_sock
+++ b/packages/containerd/containerd-config-toml_k8s_nvidia_containerd_sock
@@ -45,7 +45,7 @@ base_runtime_spec = "/etc/containerd/cri-base.json"
 
 [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia.options]
 SystemdCgroup = true
-BinaryName = "nvidia-oci"
+BinaryName = "nvidia-container-runtime"
 
 [plugins."io.containerd.grpc.v1.cri".cni]
 bin_dir = "/opt/cni/bin"
diff --git a/packages/docker-engine/daemon-json b/packages/docker-engine/daemon-json
index 939f96d07..78fd555cc 100644
--- a/packages/docker-engine/daemon-json
+++ b/packages/docker-engine/daemon-json
@@ -9,8 +9,6 @@ std = { version = "v1", helpers = ["join_array"] }
   "max-concurrent-downloads": 10,
   "storage-driver": "overlay2",
   "data-root": "/var/lib/docker",
-  "default-runtime": "shimpei",
-  "runtimes": { "shimpei": { "path": "shimpei" } },
   {{#if settings.oci-defaults.capabilities}}
   "default-capabilities": {{oci_defaults "docker" settings.oci-defaults.capabilities}},
   {{/if}}
diff --git a/packages/docker-engine/daemon-nvidia-json b/packages/docker-engine/daemon-nvidia-json
index 3ba4ed0c9..64ca34bab 100644
--- a/packages/docker-engine/daemon-nvidia-json
+++ b/packages/docker-engine/daemon-nvidia-json
@@ -9,8 +9,7 @@ std = { version = "v1", helpers = ["join_array"] }
   "max-concurrent-downloads": 10,
   "storage-driver": "overlay2",
   "data-root": "/var/lib/docker",
-  "default-runtime": "shimpei",
-  "runtimes": { "shimpei": { "path": "shimpei" }, "nvidia": { "path": "nvidia-oci" } },
+  "runtimes": { "nvidia": { "path": "nvidia-container-runtime" } },
   {{#if settings.oci-defaults.capabilities}}
   "default-capabilities": {{oci_defaults "docker" settings.oci-defaults.capabilities}},
   {{/if}}
diff --git a/packages/libnvidia-container/0004-Use-NVIDIA_PATH-to-look-up-binaries.patch b/packages/libnvidia-container/0004-Use-NVIDIA_PATH-to-look-up-binaries.patch
deleted file mode 100644
index a7997445b..000000000
--- a/packages/libnvidia-container/0004-Use-NVIDIA_PATH-to-look-up-binaries.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 831d6c71e30b8d533123600648bb12cbb225a100 Mon Sep 17 00:00:00 2001
-From: Arnaldo Garcia Rincon <agarrcia@amazon.com>
-Date: Mon, 1 Nov 2021 16:18:19 +0000
-Subject: [PATCH] Use NVIDIA_PATH to look up binaries
-
-Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
----
- src/nvc_info.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/nvc_info.c b/src/nvc_info.c
-index 55c3ba9..56dcbd2 100644
---- a/src/nvc_info.c
-+++ b/src/nvc_info.c
-@@ -251,8 +251,8 @@ find_binary_paths(struct error *err, struct dxcore_context* dxcore, struct nvc_d
-         char path[PATH_MAX];
-         int rv = -1;
- 
--        if ((env = secure_getenv("PATH")) == NULL) {
--                error_setx(err, "environment variable PATH not found");
-+        if ((env = secure_getenv("NVIDIA_PATH")) == NULL && (env = secure_getenv("PATH")) == NULL) {
-+                error_setx(err, "environment variables NVIDIA_PATH/PATH not found");
-                 return (-1);
-         }
-         if ((env = ptr = xstrdup(err, env)) == NULL)
--- 
-2.37.1
-
diff --git a/packages/libnvidia-container/0005-makefile-avoid-ldconfig-when-cross-compiling.patch b/packages/libnvidia-container/0004-makefile-avoid-ldconfig-when-cross-compiling.patch
similarity index 87%
rename from packages/libnvidia-container/0005-makefile-avoid-ldconfig-when-cross-compiling.patch
rename to packages/libnvidia-container/0004-makefile-avoid-ldconfig-when-cross-compiling.patch
index 1a5939584..4ab2c995b 100644
--- a/packages/libnvidia-container/0005-makefile-avoid-ldconfig-when-cross-compiling.patch
+++ b/packages/libnvidia-container/0004-makefile-avoid-ldconfig-when-cross-compiling.patch
@@ -1,4 +1,4 @@
-From 5bdaf17b05b7cb9620681cbd594ec050237e2403 Mon Sep 17 00:00:00 2001
+From 671e97dfad23fe9b5852e2ebe32969a7f7a20fd0 Mon Sep 17 00:00:00 2001
 From: Arnaldo Garcia Rincon <agarrcia@amazon.com>
 Date: Tue, 18 Jan 2022 23:57:24 +0000
 Subject: [PATCH] makefile: avoid ldconfig when cross-compiling
@@ -14,10 +14,10 @@ Signed-off-by: Markus Boehme <markubo@amazon.com>
  1 file changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/Makefile b/Makefile
-index 60429d3..7d4c19b 100644
+index b914727f..2473686c 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -269,7 +269,10 @@ ifeq ($(WITH_NVCGO), yes)
+@@ -266,7 +266,10 @@ ifeq ($(WITH_NVCGO), yes)
  	$(INSTALL) -m 755 $(DEPS_DIR)$(libdir)/$(LIBGO_SHARED) $(DESTDIR)$(libdir)
  	$(LN) -sf $(LIBGO_SONAME) $(DESTDIR)$(libdir)/$(LIBGO_SYMLINK)
  endif
@@ -30,5 +30,5 @@ index 60429d3..7d4c19b 100644
  	$(MAKE_DIR)/$(LIB_PKGCFG).in "$(strip $(VERSION))" "$(strip $(LIB_LDLIBS_SHARED))" > $(DESTDIR)$(pkgconfdir)/$(LIB_PKGCFG)
  	# Install binary files
 -- 
-2.39.0
+2.47.0
 
diff --git a/packages/libnvidia-container/libnvidia-container.spec b/packages/libnvidia-container/libnvidia-container.spec
index 8cfa2e87a..dcfdc4cd4 100644
--- a/packages/libnvidia-container/libnvidia-container.spec
+++ b/packages/libnvidia-container/libnvidia-container.spec
@@ -17,8 +17,7 @@ Source2: libnvidia-container-sysctl.conf
 Patch0001: 0001-use-shared-libtirpc.patch
 Patch0002: 0002-use-prefix-from-environment.patch
 Patch0003: 0003-keep-debug-symbols.patch
-Patch0004: 0004-Use-NVIDIA_PATH-to-look-up-binaries.patch
-Patch0005: 0005-makefile-avoid-ldconfig-when-cross-compiling.patch
+Patch0004: 0004-makefile-avoid-ldconfig-when-cross-compiling.patch
 
 BuildRequires: %{_cross_os}glibc-devel
 BuildRequires: %{_cross_os}libelf-devel
diff --git a/packages/nvidia-container-toolkit/nvidia-container-toolkit.spec b/packages/nvidia-container-toolkit/nvidia-container-toolkit.spec
index 77a448cd8..c714df315 100644
--- a/packages/nvidia-container-toolkit/nvidia-container-toolkit.spec
+++ b/packages/nvidia-container-toolkit/nvidia-container-toolkit.spec
@@ -16,15 +16,13 @@ URL: https://%{goimport}
 Source0: https://%{goimport}/archive/v%{gover}/nvidia-container-toolkit-%{gover}.tar.gz
 Source1: nvidia-container-toolkit-config-k8s.toml
 Source2: nvidia-container-toolkit-config-ecs.toml
-Source3: nvidia-oci-hooks-json
-Source4: nvidia-gpu-devices.rules
-Source5: nvidia-container-toolkit-tmpfiles-ecs.conf
-Source6: nvidia-container-toolkit-tmpfiles-k8s.conf
-Source7: nvidia-container-toolkit-config-k8s
+Source3: nvidia-gpu-devices.rules
+Source4: nvidia-container-toolkit-tmpfiles-ecs.conf
+Source5: nvidia-container-toolkit-tmpfiles-k8s.conf
+Source6: nvidia-container-toolkit-config-k8s
 
 BuildRequires: %{_cross_os}glibc-devel
 Requires: %{_cross_os}libnvidia-container
-Requires: %{_cross_os}shimpei
 
 %description
 %{summary}.
@@ -60,6 +58,7 @@ export GOLDFLAGS="-compressdwarf=false -linkmode=external -extldflags '${CGO_LDF
 go build -ldflags="${GOLDFLAGS}" -o nvidia-container-runtime-hook ./cmd/nvidia-container-runtime-hook
 go build -ldflags="${GOLDFLAGS}" -o nvidia-ctk ./cmd/nvidia-ctk
 go build -ldflags="${GOLDFLAGS}" -o nvidia-cdi-hook ./cmd/nvidia-cdi-hook
+go build -ldflags="${GOLDFLAGS}" -o nvidia-container-runtime ./cmd/nvidia-container-runtime
 
 %install
 install -d %{buildroot}%{_cross_bindir}
@@ -72,14 +71,13 @@ install -d %{buildroot}%{_cross_templatedir}/nvidia-container-runtime
 install -p -m 0755 nvidia-container-runtime-hook %{buildroot}%{_cross_bindir}/
 install -p -m 0755 nvidia-ctk %{buildroot}%{_cross_bindir}/
 install -p -m 0755 nvidia-cdi-hook %{buildroot}%{_cross_bindir}/
+install -p -m 0755 nvidia-container-runtime %{buildroot}%{_cross_bindir}/
 install -m 0644 %{S:1} %{buildroot}%{_cross_factorydir}/nvidia-container-runtime/
 install -m 0644 %{S:2} %{buildroot}%{_cross_factorydir}/nvidia-container-runtime/
-install -m 0644 %{S:3} %{buildroot}%{_cross_templatedir}/nvidia-oci-hooks-json
-install -p -m 0644 %{S:4} %{buildroot}%{_cross_udevrulesdir}/90-nvidia-gpu-devices.rules
-install -m 0644 %{S:5} %{buildroot}%{_cross_tmpfilesdir}/nvidia-container-toolkit-ecs.conf
-install -m 0644 %{S:6} %{buildroot}%{_cross_tmpfilesdir}/nvidia-container-toolkit-k8s.conf
-install -m 0644 %{S:7} %{buildroot}%{_cross_templatedir}/nvidia-container-runtime/
-ln -s shimpei %{buildroot}%{_cross_bindir}/nvidia-oci
+install -p -m 0644 %{S:3} %{buildroot}%{_cross_udevrulesdir}/90-nvidia-gpu-devices.rules
+install -m 0644 %{S:4} %{buildroot}%{_cross_tmpfilesdir}/nvidia-container-toolkit-ecs.conf
+install -m 0644 %{S:5} %{buildroot}%{_cross_tmpfilesdir}/nvidia-container-toolkit-k8s.conf
+install -m 0644 %{S:6} %{buildroot}%{_cross_templatedir}/nvidia-container-runtime/
 
 %files
 %license LICENSE
@@ -87,8 +85,7 @@ ln -s shimpei %{buildroot}%{_cross_bindir}/nvidia-oci
 %{_cross_bindir}/nvidia-container-runtime-hook
 %{_cross_bindir}/nvidia-ctk
 %{_cross_bindir}/nvidia-cdi-hook
-%{_cross_bindir}/nvidia-oci
-%{_cross_templatedir}/nvidia-oci-hooks-json
+%{_cross_bindir}/nvidia-container-runtime
 %{_cross_udevrulesdir}/90-nvidia-gpu-devices.rules
 
 %files ecs
diff --git a/packages/nvidia-container-toolkit/nvidia-oci-hooks-json b/packages/nvidia-container-toolkit/nvidia-oci-hooks-json
deleted file mode 100644
index fad6e2c60..000000000
--- a/packages/nvidia-container-toolkit/nvidia-oci-hooks-json
+++ /dev/null
@@ -1,13 +0,0 @@
-+++
-{
-  "hooks": {
-    "prestart": [
-      {
-        "path": "/usr/bin/nvidia-container-runtime-hook",
-        "args": ["nvidia-container-runtime-hook", "prestart"]
-      }
-    ],
-    "poststart": [
-    ]
-  }
-}
diff --git a/packages/oci-add-hooks/Cargo.toml b/packages/oci-add-hooks/Cargo.toml
deleted file mode 100644
index b1c0621e7..000000000
--- a/packages/oci-add-hooks/Cargo.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-[package]
-name = "oci-add-hooks"
-version = "0.1.0"
-edition = "2021"
-publish = false
-build = "../build.rs"
-
-[lib]
-path = "../packages.rs"
-
-[package.metadata.build-package]
-# Use a specific upstream commit since there are no releases or tags.
-releases-url = "https://github.com/awslabs/oci-add-hooks/commits/master/"
-
-[[package.metadata.build-package.external-files]]
-url = "https://github.com/awslabs/oci-add-hooks/archive/ef29fe312d2e1858d5eb28ab0abe0cbee298a165/oci-add-hooks-ef29fe3.tar.gz"
-sha512 = "018b561f838172e768a70acdeb2c27939f931391ced019a23c5193eee6b8970bc02a3e5fa05917010ca2064d1876649ef139d7657700c42a3ddd6e2c174f27dc"
-bundle-modules = [ "go" ]
-
-[build-dependencies]
-glibc = { path = "../glibc" }
diff --git a/packages/oci-add-hooks/oci-add-hooks.spec b/packages/oci-add-hooks/oci-add-hooks.spec
deleted file mode 100644
index 51466a619..000000000
--- a/packages/oci-add-hooks/oci-add-hooks.spec
+++ /dev/null
@@ -1,41 +0,0 @@
-%global goproject github.com/awslabs
-%global gorepo oci-add-hooks
-%global goimport %{goproject}/%{gorepo}
-
-%global gitrev ef29fe312d2e1858d5eb28ab0abe0cbee298a165
-%global shortrev %(c=%{gitrev}; echo ${c:0:7})
-
-Name: %{_cross_os}oci-add-hooks
-Version: 1.0.0
-Release: 1%{?dist}
-Epoch: 1
-Summary: OCI runtime wrapper that injects OCI hooks
-License: Apache-2.0 AND MIT
-URL: https://github.com/awslabs/oci-add-hooks
-Source0: %{gorepo}-%{shortrev}.tar.gz
-Source1: bundled-%{gorepo}-%{shortrev}.tar.gz
-BuildRequires: %{_cross_os}glibc-devel
-
-%description
-%{summary}.
-
-%prep
-%setup -n %{gorepo}-%{gitrev}
-%setup -T -D -n %{gorepo}-%{gitrev} -b 1
-
-%build
-%set_cross_go_flags
-export LD_VERSION="-X main.commit=oci-add-hooks-%{gitrev}"
-go build -ldflags="${GOLDFLAGS} ${LD_VERSION}" -o oci-add-hooks
-
-%install
-install -d %{buildroot}%{_cross_bindir}
-install -p -m 0755 oci-add-hooks %{buildroot}%{_cross_bindir}
-
-%cross_scan_attribution go-vendor vendor
-
-%files
-%license LICENSE NOTICE
-%{_cross_attribution_file}
-%{_cross_attribution_vendor_dir}
-%{_cross_bindir}/oci-add-hooks
diff --git a/packages/os/Cargo.toml b/packages/os/Cargo.toml
index b6541fe59..64caaf050 100644
--- a/packages/os/Cargo.toml
+++ b/packages/os/Cargo.toml
@@ -21,7 +21,6 @@ source-groups = [
     "models",
     "imdsclient",
     "retry-read",
-    "shimpei",
     "driverdog",
     "cfsignal",
     "bloodhound",
diff --git a/packages/os/oci-default-hooks-json b/packages/os/oci-default-hooks-json
deleted file mode 100644
index ab08bab5d..000000000
--- a/packages/os/oci-default-hooks-json
+++ /dev/null
@@ -1,9 +0,0 @@
-+++
-{
-  "hooks": {
-    "prestart": [
-    ],
-    "poststart": [
-    ]
-  }
-}
diff --git a/packages/os/os.spec b/packages/os/os.spec
index 50c05ba72..7800b0306 100644
--- a/packages/os/os.spec
+++ b/packages/os/os.spec
@@ -21,7 +21,6 @@ Source3: eni-max-pods
 Source5: updog-toml
 Source6: metricdog-toml
 Source7: host-ctr-toml
-Source8: oci-default-hooks-json
 Source9: cfsignal-toml
 Source10: warm-pool-wait-toml
 Source11: bottlerocket-cis-checks-metadata-json
@@ -85,7 +84,6 @@ Requires: %{_cross_os}metricdog
 Requires: %{_cross_os}prairiedog
 Requires: %{_cross_os}schnauzer
 Requires: %{_cross_os}settings-committer
-Requires: %{_cross_os}shimpei
 Requires: %{_cross_os}signpost
 Requires: %{_cross_os}storewolf
 Requires: %{_cross_os}sundog
@@ -377,12 +375,6 @@ Conflicts: (%{_cross_os}image-feature(no-fips) or %{_cross_os}cfsignal-bin)
 %description -n %{_cross_os}cfsignal-fips-bin
 %{summary}.
 
-%package -n %{_cross_os}shimpei
-Summary: OCI-compatible shim around oci-add-hooks
-Requires: %{_cross_os}oci-add-hooks
-%description -n %{_cross_os}shimpei
-%{summary}.
-
 %package -n %{_cross_os}driverdog
 Summary: Tool to load additional drivers
 Requires: %{_cross_os}binutils
@@ -540,7 +532,6 @@ echo "** Output from non-static builds:"
     -p bootstrap-containers \
     -p prairiedog \
     -p certdog \
-    -p shimpei \
     -p bloodhound \
     -p xfscli \
     -p shibaken \
@@ -602,7 +593,7 @@ for p in \
   migrator prairiedog certdog \
   signpost updog metricdog logdog \
   ghostdog bootstrap-commands bootstrap-containers \
-  shimpei bloodhound \
+  bloodhound \
   bottlerocket-cis-checks \
   bottlerocket-fips-checks \
   kubernetes-cis-checks \
@@ -698,7 +689,7 @@ if [ -s "%{_cross_repo_root_json}" ] ; then
 fi
 
 install -d %{buildroot}%{_cross_templatedir}
-install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:8} %{S:14} %{S:15} %{S:16} %{S:17} %{S:18} %{S:19} %{S:21} \
+install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:14} %{S:15} %{S:16} %{S:17} %{S:18} %{S:19} %{S:21} \
   %{buildroot}%{_cross_templatedir}
 
 install -d %{buildroot}%{_cross_unitdir}
@@ -884,10 +875,6 @@ install -p -m 0644 %{S:400} %{S:401} %{S:402} %{buildroot}%{_cross_licensedir}
 %files -n %{_cross_os}pluto-fips-bin
 %{_cross_fips_bindir}/pluto
 
-%files -n %{_cross_os}shimpei
-%{_cross_bindir}/shimpei
-%{_cross_templatedir}/oci-default-hooks-json
-
 %files -n %{_cross_os}prairiedog
 %{_cross_bindir}/prairiedog
 %{_cross_unitdir}/reboot-if-required.service
diff --git a/sources/Cargo.lock b/sources/Cargo.lock
index 20de2ccd7..8f520814a 100644
--- a/sources/Cargo.lock
+++ b/sources/Cargo.lock
@@ -4901,17 +4901,6 @@ dependencies = [
  "toml",
 ]
 
-[[package]]
-name = "shimpei"
-version = "0.1.0"
-dependencies = [
- "generate-readme",
- "log",
- "nix",
- "simplelog",
- "snafu",
-]
-
 [[package]]
 name = "shlex"
 version = "1.3.0"
diff --git a/sources/Cargo.toml b/sources/Cargo.toml
index 608c1c83d..7aa32f11d 100644
--- a/sources/Cargo.toml
+++ b/sources/Cargo.toml
@@ -75,8 +75,6 @@ members = [
 
     "constants",
 
-    "shimpei",
-
     "xfscli",
 ]
 
diff --git a/sources/shimpei/Cargo.toml b/sources/shimpei/Cargo.toml
deleted file mode 100644
index 9911a9c00..000000000
--- a/sources/shimpei/Cargo.toml
+++ /dev/null
@@ -1,18 +0,0 @@
-[package]
-name = "shimpei"
-version = "0.1.0"
-authors = ["Arnaldo Garcia Rincon <agarrcia@amazon.com>"]
-license = "Apache-2.0 OR MIT"
-edition = "2021"
-publish = false
-# Don't rebuild crate just because of changes to README.
-exclude = ["README.md"]
-
-[dependencies]
-log.workspace = true
-simplelog.workspace = true
-snafu.workspace = true
-nix.workspace = true
-
-[build-dependencies]
-generate-readme.workspace = true
diff --git a/sources/shimpei/README.md b/sources/shimpei/README.md
deleted file mode 100644
index 4a40a6546..000000000
--- a/sources/shimpei/README.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# shimpei
-
-Current version: 0.1.0
-
-  shimpei is an OCI compatible shim wrapper around `oci-add-hooks`. Its sole purpose is
-  to call `oci-add-hooks` with the additional `--hook-config-path` and `--runtime-path`
-  parameters that can't be provided by containerd.
-
-## Colophon
-
-This text was generated from `README.tpl` using [cargo-readme](https://crates.io/crates/cargo-readme), and includes the rustdoc from `src/main.rs`.
diff --git a/sources/shimpei/README.tpl b/sources/shimpei/README.tpl
deleted file mode 100644
index 7b992c507..000000000
--- a/sources/shimpei/README.tpl
+++ /dev/null
@@ -1,9 +0,0 @@
-# {{crate}}
-
-Current version: {{version}}
-
-{{readme}}
-
-## Colophon
-
-This text was generated from `README.tpl` using [cargo-readme](https://crates.io/crates/cargo-readme), and includes the rustdoc from `src/main.rs`.
diff --git a/sources/shimpei/build.rs b/sources/shimpei/build.rs
deleted file mode 100644
index 5b3a661c3..000000000
--- a/sources/shimpei/build.rs
+++ /dev/null
@@ -1,3 +0,0 @@
-fn main() {
-    generate_readme::from_main().unwrap();
-}
diff --git a/sources/shimpei/src/main.rs b/sources/shimpei/src/main.rs
deleted file mode 100644
index 82f37cd56..000000000
--- a/sources/shimpei/src/main.rs
+++ /dev/null
@@ -1,103 +0,0 @@
-/*!
-  shimpei is an OCI compatible shim wrapper around `oci-add-hooks`. Its sole purpose is
-  to call `oci-add-hooks` with the additional `--hook-config-path` and `--runtime-path`
-  parameters that can't be provided by containerd.
-*/
-
-#[macro_use]
-extern crate log;
-
-use simplelog::{Config as LogConfig, LevelFilter, SimpleLogger};
-use snafu::{OptionExt, ResultExt};
-use std::env;
-use std::ffi::CString;
-use std::path::Path;
-use std::process;
-
-/// Path to runc binary
-const RUNC_BIN_PATH: &str = "/usr/bin/runc";
-
-/// Path to hooks definitions
-const HOOKS_CONFIG_BASE_PATH: &str = "/etc/shimpei";
-
-/// Path to oci-add-hooks
-const OCI_ADD_HOOKS: &str = "/usr/bin/oci-add-hooks";
-
-fn run() -> Result<()> {
-    setup_logger()?;
-    let mut args = env::args();
-    let prefix = args
-        .next()
-        .context(error::MissingArgSnafu { what: "name" })?;
-    let hook_path = Path::new(HOOKS_CONFIG_BASE_PATH).join(format!("{}-hooks.json", prefix));
-
-    let mut oci_add_hooks_args: Vec<CString> = vec![
-        CString::new("oci-add-hooks").expect("Couldn't create CString from 'oci-add-hooks'"),
-        CString::new("--hook-config-path")
-            .expect("Couldn't create CString from '--hook-config-path'"),
-        CString::new(hook_path.display().to_string()).context(error::InvalidStringSnafu {
-            input: hook_path.display().to_string(),
-        })?,
-        CString::new("--runtime-path").expect("Couldn't create CString from '--runtime-path'"),
-        CString::new(RUNC_BIN_PATH).context(error::InvalidStringSnafu {
-            input: RUNC_BIN_PATH.to_string(),
-        })?,
-    ];
-    for arg in args {
-        oci_add_hooks_args
-            .push(CString::new(arg.as_bytes()).context(error::InvalidStringSnafu { input: arg })?);
-    }
-
-    // Use the `execv` syscall instead of `std::process::Command`, since
-    // it will call `posix_spawn` under the hood, which forks instead of
-    // replacing the current process
-
-    nix::unistd::execv(
-        &CString::new(OCI_ADD_HOOKS).context(error::InvalidStringSnafu {
-            input: OCI_ADD_HOOKS.to_string(),
-        })?,
-        &oci_add_hooks_args,
-    )
-    .context(error::ExecvSnafu {
-        program: OCI_ADD_HOOKS.to_string(),
-    })?;
-
-    Ok(())
-}
-
-fn setup_logger() -> Result<()> {
-    SimpleLogger::init(LevelFilter::Info, LogConfig::default()).context(error::LoggerSnafu)
-}
-
-fn main() {
-    if let Err(e) = run() {
-        error!("{}", e);
-        process::exit(1);
-    }
-}
-
-/// ＜コ：ミ くコ:彡 ＜コ：ミ くコ:彡 ＜コ：ミ くコ:彡 ＜コ：ミ くコ:彡 ＜コ：ミ くコ:彡 ＜コ：ミ くコ:彡
-mod error {
-    use snafu::Snafu;
-
-    #[derive(Debug, Snafu)]
-    #[snafu(visibility(pub(super)))]
-    pub(super) enum Error {
-        #[snafu(display("Failed to setup logger: {}", source))]
-        Logger { source: log::SetLoggerError },
-
-        #[snafu(display("Couldn't create CString from '{}': {}", input, source))]
-        InvalidString {
-            input: String,
-            source: std::ffi::NulError,
-        },
-
-        #[snafu(display("Failed to exec '{}' : {}", program, source))]
-        Execv { program: String, source: nix::Error },
-
-        #[snafu(display("Missing argument '{}'", what))]
-        MissingArg { what: String },
-    }
-}
-
-type Result<T> = std::result::Result<T, error::Error>;


Reviews:
user: login: arnaldo2792
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-04T16:51:03Z
user: login: sky1122
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-05T00:07:04Z
user: login: sky1122
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-05T00:08:03Z
user: login: sky1122
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-05T00:09:15Z
user: login: arnaldo2792
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-07T16:56:18Z
user: login: arnaldo2792
body: You forgot to remove `packages/oci-add-hooks`
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T21:52:18Z
user: login: arnaldo2792
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T19:03:09Z
user: login: arnaldo2792
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T17:03:42Z
user: login: bcressey
body: Please minimize the changes to `nvidia-container-toolkit.spec` and `os.spec` and then I'll take another look. Most of it looks fine to me but it's not necessary to do a lot of source renumbering.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T20:45:05Z
user: login: arnaldo2792
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T20:58:59Z
user: login: sky1122
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T21:42:27Z
user: login: bcressey
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T21:50:13Z
user: login: piyush-jena
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T22:01:09Z

Review comments:
diff_hunk: @@ -17,7 +17,6 @@ Source2: libnvidia-container-sysctl.conf
 Patch0001: 0001-use-shared-libtirpc.patch
 Patch0002: 0002-use-prefix-from-environment.patch
 Patch0003: 0003-keep-debug-symbols.patch
-Patch0004: 0004-Use-NVIDIA_PATH-to-look-up-binaries.patch
path: packages/libnvidia-container/libnvidia-container.spec
user: login: arnaldo2792
body: You should change the number sequence here, and rebuild the patches without this patch, as they were created in the same patch set. By dropping this patch, the patch set must be updated as a whole.
created_at: 2025-04-04T16:48:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -37,15 +37,14 @@ enable_unprivileged_icmp = {{settings.container-runtime.enable-unprivileged-icmp
 {{/if}}
 
 [plugins."io.containerd.grpc.v1.cri".containerd]
-default_runtime_name = "shimpei"
+default_runtime_name = "runc"
path: packages/containerd/containerd-config-toml_k8s_containerd_sock
user: login: arnaldo2792
body: nit: I think we can avoid this since the default runtime is `runc`
created_at: 2025-04-04T16:49:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,7 +21,6 @@ Source3: eni-max-pods
 Source5: updog-toml
 Source6: metricdog-toml
 Source7: host-ctr-toml
-Source8: oci-default-hooks-json
 Source9: cfsignal-toml
path: packages/os/os.spec
user: login: arnaldo2792
body: This sucks, but please renumber the sources.
created_at: 2025-04-04T16:50:49Z
author_association: CONTRIBUTOR
diff_hunk: @@ -37,15 +37,14 @@ enable_unprivileged_icmp = {{settings.container-runtime.enable-unprivileged-icmp
 {{/if}}
 
 [plugins."io.containerd.grpc.v1.cri".containerd]
-default_runtime_name = "shimpei"
+default_runtime_name = "runc"
path: packages/containerd/containerd-config-toml_k8s_containerd_sock
user: login: sky1122
body: removed.
created_at: 2025-04-05T00:07:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,7 +21,6 @@ Source3: eni-max-pods
 Source5: updog-toml
 Source6: metricdog-toml
 Source7: host-ctr-toml
-Source8: oci-default-hooks-json
 Source9: cfsignal-toml
path: packages/os/os.spec
user: login: sky1122
body: I noticed the previous source also doesn't get ordered, so I create a separate commit to order the source.
created_at: 2025-04-05T00:08:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -17,7 +17,6 @@ Source2: libnvidia-container-sysctl.conf
 Patch0001: 0001-use-shared-libtirpc.patch
 Patch0002: 0002-use-prefix-from-environment.patch
 Patch0003: 0003-keep-debug-symbols.patch
-Patch0004: 0004-Use-NVIDIA_PATH-to-look-up-binaries.patch
path: packages/libnvidia-container/libnvidia-container.spec
user: login: sky1122
body: Thank you for pointing out and let me know the best practice on changing patches. Changed.
created_at: 2025-04-05T00:09:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -698,7 +690,7 @@ if [ -s "%{_cross_repo_root_json}" ] ; then
 fi
 
 install -d %{buildroot}%{_cross_templatedir}
-install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:8} %{S:14} %{S:15} %{S:16} %{S:17} %{S:18} %{S:19} %{S:21} \
+install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:14} %{S:15} %{S:16} %{S:17} %{S:18} %{S:19} %{S:21} \
path: packages/os/os.spec
user: login: arnaldo2792
body: If `S:8` isn't installed anymore, you have to remove the file from the sources as well. That file is `oci-default-hooks-json`
created_at: 2025-04-07T16:49:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,7 +21,6 @@ Source3: eni-max-pods
 Source5: updog-toml
 Source6: metricdog-toml
 Source7: host-ctr-toml
-Source8: oci-default-hooks-json
 Source9: cfsignal-toml
path: packages/os/os.spec
user: login: arnaldo2792
body: I just saw that you added this as part of this commit, but you should keep this change in the other commit where you changed `os.spec` since that's where the file was actually removed.
created_at: 2025-04-07T16:51:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -58,6 +58,7 @@ export GOLDFLAGS="-compressdwarf=false -linkmode=external -extldflags '${CGO_LDF
 go build -ldflags="${GOLDFLAGS}" -o nvidia-container-runtime-hook ./cmd/nvidia-container-runtime-hook
 go build -ldflags="${GOLDFLAGS}" -o nvidia-ctk ./cmd/nvidia-ctk
 go build -ldflags="${GOLDFLAGS}" -o nvidia-cdi-hook ./cmd/nvidia-cdi-hook
+go build -ldflags="${GOLDFLAGS}" -o nvidia-container-runtime ./cmd/nvidia-container-runtime
path: packages/nvidia-container-toolkit/nvidia-container-toolkit.spec
user: login: arnaldo2792
body: I would prefer if you keep adding `nvidia-container-runtime` as its own commit, instead of making it part of the commit that removes `oci-add-hook`
created_at: 2025-04-07T16:53:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,9 +0,0 @@
-+++
path: packages/os/oci-default-hooks-json
user: login: arnaldo2792
body: This shouldn't be in this commit, you removed this file from a spec in the commit where you drop shimpei
created_at: 2025-04-07T23:33:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,19 +21,18 @@ Source3: eni-max-pods
 Source5: updog-toml
 Source6: metricdog-toml
 Source7: host-ctr-toml
-Source8: oci-default-hooks-json
-Source9: cfsignal-toml
-Source10: warm-pool-wait-toml
-Source11: bottlerocket-cis-checks-metadata-json
-Source13: kubernetes-cis-checks-metadata-json
-Source14: certdog-toml
-Source15: prairiedog-toml
-Source16: thar-be-updates-toml
-Source17: corndog-toml
-Source18: bootstrap-containers-toml
-Source19: host-containers-toml
-Source20: bottlerocket-fips-checks-metadata-json
-Source21: bootstrap-commands-toml
+Source8: cfsignal-toml
+Source9: warm-pool-wait-toml
+Source10: bottlerocket-cis-checks-metadata-json
+Source11: kubernetes-cis-checks-metadata-json
+Source12: certdog-toml
+Source13: prairiedog-toml
path: packages/os/os.spec
user: login: arnaldo2792
body: Nice, you fixed the numbering (missing 12)! Thanks!
created_at: 2025-04-08T21:44:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -698,7 +689,7 @@ if [ -s "%{_cross_repo_root_json}" ] ; then
 fi
 
 install -d %{buildroot}%{_cross_templatedir}
-install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:8} %{S:14} %{S:15} %{S:16} %{S:17} %{S:18} %{S:19} %{S:21} \
+install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:12} %{S:13} %{S:14} %{S:15} %{S:16} %{S:17} %{S:19} \
path: packages/os/os.spec
user: login: arnaldo2792
body: You are missing `%{S:18}`.
created_at: 2025-04-08T21:48:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -698,7 +689,7 @@ if [ -s "%{_cross_repo_root_json}" ] ; then
 fi
 
 install -d %{buildroot}%{_cross_templatedir}
-install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:8} %{S:14} %{S:15} %{S:16} %{S:17} %{S:18} %{S:19} %{S:21} \
+install -p -m 0644 %{S:5} %{S:6} %{S:7} %{S:12} %{S:13} %{S:14} %{S:15} %{S:16} %{S:17} %{S:19} \
path: packages/os/os.spec
user: login: arnaldo2792
body: I was pointed out that line 651 has `S:18`
created_at: 2025-04-09T19:03:09Z
author_association: CONTRIBUTOR
diff_hunk: @@ -16,15 +16,13 @@ URL: https://%{goimport}
 Source0: https://%{goimport}/archive/v%{gover}/nvidia-container-toolkit-%{gover}.tar.gz
 Source1: nvidia-container-toolkit-config-k8s.toml
 Source2: nvidia-container-toolkit-config-ecs.toml
-Source3: nvidia-oci-hooks-json
path: packages/nvidia-container-toolkit/nvidia-container-toolkit.spec
user: login: arnaldo2792
body: I asked @sky1122 to keep this change and the removal of `nvidia-oci-hooks-json` in this commit and not in the other commit that modifies `nvidia-container-toolkit` because removing this file was used by `shimpei`.
created_at: 2025-04-14T17:00:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -36,16 +36,12 @@ enable_unprivileged_ports = {{settings.container-runtime.enable-unprivileged-por
 enable_unprivileged_icmp = {{settings.container-runtime.enable-unprivileged-icmp}}
 {{/if}}
 
-[plugins."io.containerd.grpc.v1.cri".containerd]
-default_runtime_name = "shimpei"
-
-[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.shimpei]
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
path: packages/containerd/containerd-config-toml_k8s_containerd_sock
user: login: bcressey
body: Do we still need to specify `default_runtime_name` somewhere, or does it default to `runc`?
created_at: 2025-04-14T20:37:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,19 +21,18 @@ Source3: eni-max-pods
 Source5: updog-toml
 Source6: metricdog-toml
 Source7: host-ctr-toml
-Source8: oci-default-hooks-json
-Source9: cfsignal-toml
-Source10: warm-pool-wait-toml
-Source11: bottlerocket-cis-checks-metadata-json
-Source13: kubernetes-cis-checks-metadata-json
-Source14: certdog-toml
-Source15: prairiedog-toml
-Source16: thar-be-updates-toml
-Source17: corndog-toml
-Source18: bootstrap-containers-toml
-Source19: host-containers-toml
-Source20: bottlerocket-fips-checks-metadata-json
-Source21: bootstrap-commands-toml
+Source8: cfsignal-toml
path: packages/os/os.spec
user: login: bcressey
body: Personally, I'd opt to leave a gap in source files vs. renumbering them all, in the interests of making it easier to review.

It's the same rationale behind not using spaces to vertically align columns, and ending lists with a trailing `,` in contexts where that's supported. Don't add more "green" to the review if you can help it, unless it's in service of a technical goal beyond mere cosmetics.

It may seem innocuous but what you've done here is caused the reviewer to have to verify that every line in `%install` that copies one of these files has been modified correctly, which requires a lot of scrolling back and forth.
created_at: 2025-04-14T20:42:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -36,16 +36,12 @@ enable_unprivileged_ports = {{settings.container-runtime.enable-unprivileged-por
 enable_unprivileged_icmp = {{settings.container-runtime.enable-unprivileged-icmp}}
 {{/if}}
 
-[plugins."io.containerd.grpc.v1.cri".containerd]
-default_runtime_name = "shimpei"
-
-[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.shimpei]
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
path: packages/containerd/containerd-config-toml_k8s_containerd_sock
user: login: arnaldo2792
body: `containerd` defaults to `runc`
created_at: 2025-04-14T20:58:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,19 +21,18 @@ Source3: eni-max-pods
 Source5: updog-toml
 Source6: metricdog-toml
 Source7: host-ctr-toml
-Source8: oci-default-hooks-json
-Source9: cfsignal-toml
-Source10: warm-pool-wait-toml
-Source11: bottlerocket-cis-checks-metadata-json
-Source13: kubernetes-cis-checks-metadata-json
-Source14: certdog-toml
-Source15: prairiedog-toml
-Source16: thar-be-updates-toml
-Source17: corndog-toml
-Source18: bootstrap-containers-toml
-Source19: host-containers-toml
-Source20: bottlerocket-fips-checks-metadata-json
-Source21: bootstrap-commands-toml
+Source8: cfsignal-toml
path: packages/os/os.spec
user: login: sky1122
body: Thanks for sharing the idea behind these. 
Change the os.spec to only contain drop shimpei and oci-add-hooks in the forced push.
created_at: 2025-04-14T21:42:27Z
author_association: CONTRIBUTOR

PR comments:
user: login: sky1122
created_at: 2025-04-07T16:54:51Z
body: Force Pushed to change the git commit histories to separate drop shimpei and oci-add-hook, change commit message etc.
author_association: CONTRIBUTOR
user: login: sky1122
created_at: 2025-04-07T21:57:57Z
body: forced pushed to
- move os.spec changes to drop oci-add-hooks commit
- move install nvidia container runtime to a separate commit

notice something in drop shimpei, will do another forced pushed to take care of that change.
author_association: CONTRIBUTOR
user: login: sky1122
created_at: 2025-04-07T22:42:56Z
body: force pushed(s) to
- move some drop oci-add-hooks from shimpei commit (previous one)
- delete default-oci-hooks.json (current one)
author_association: CONTRIBUTOR
user: login: sky1122
created_at: 2025-04-08T18:32:04Z
body: force pushed to move changes in different commits

notice there is a extra line added, will do another force pushed to remove these from last commit
author_association: CONTRIBUTOR
user: login: sky1122
created_at: 2025-04-09T22:12:49Z
body: forced pushed to reorder the commit sequent.
forced pushed to pick up the missing commit during the reordering process.
author_association: CONTRIBUTOR
user: login: sky1122
created_at: 2025-04-10T00:26:14Z
body: Forced push the commit to reword `nvidia-container-toolkit: provide nvidia-container-runtime` commit
author_association: CONTRIBUTOR
user: login: sky1122
created_at: 2025-04-10T00:35:16Z
body: Forced pushed to add sign off in each commits
author_association: CONTRIBUTOR
user: login: sky1122
created_at: 2025-04-10T18:17:11Z
body: based on the current branch, running MIG test on k8s-1.32-nvidia variant.
```
{
  "os": {
    "arch": "x86_64",
    "build_id": "e5cd08cf-dirty",
    "pretty_name": "Bottlerocket OS 1.36.0 (aws-k8s-1.32-nvidia)",
    "variant_id": "aws-k8s-1.32-nvidia",
    "version_id": "1.36.0"
  }
}
```

Below is some of the pods
```
╰$ kubectl get pods -A
NAMESPACE     NAME                             READY   STATUS              RESTARTS      AGE
default       nvidia-cuda-workload-45j4d       0/1     ContainerCreating   0             10s
default       nvidia-cuda-workload-4tsv8       0/1     ContainerCreating   0             10s
default       nvidia-cuda-workload-67q25       0/1     ContainerCreating   0             10s
```

```
╰$ kubectl logs nvidia-cuda-workload-45j4d
[Vector addition of 50000 elements]
Copy input data from the host memory to the CUDA device
CUDA kernel launch with 196 blocks of 256 threads
Copy output data from the CUDA device to the host memory
Test PASSED
Done

╰$ kubectl logs nvidia-cuda-workload-4tsv8
[Vector addition of 50000 elements]
Copy input data from the host memory to the CUDA device
CUDA kernel launch with 196 blocks of 256 threads
Copy output data from the CUDA device to the host memory
Test PASSED
Done

 kubectl logs nvidia-cuda-workload-6ggq4
[Vector addition of 50000 elements]
Copy input data from the host memory to the CUDA device
CUDA kernel launch with 196 blocks of 256 threads
Copy output data from the CUDA device to the host memory
Test PASSED
Done
```
Time Slicing and MIG cross setting looks fine
```
Allocatable:
  cpu:                    95690m
  ephemeral-storage:      15751651301
  hugepages-1Gi:          0
  hugepages-2Mi:          0
  memory:                 1167612760Ki
  nvidia.com/gpu:         0
  nvidia.com/gpu.shared:  224
```
Running the CUDA work load and also pass all the test.

author_association: CONTRIBUTOR
user: login: arnaldo2792
created_at: 2025-04-14T17:12:09Z
body: I cloned these changes and confirmed that bypassing GPU requests through `NVIDIA_VISIBLE_DEVICES=all` in k8s variants work as expected. The same test in ECS doesn't have any effect because the ECS agent clobbers the `NVIDIA_VISIBLE_DEVICES` with the actual list of the devices allocated for the ECS tasks. 
author_association: CONTRIBUTOR