Repository: containerd/containerd
File: cmd/ctr/commands/run/run_unix.go (Go)

Code before:
		}
		if cliContext.IsSet("cgroup") {
			// NOTE: can be set to "" explicitly for disabling cgroup.
			opts = append(opts, oci.WithCgroup(cliContext.String("cgroup")))
		}
		limit := cliContext.Uint64("memory-limit")
		if limit != 0 {
			opts = append(opts, oci.WithMemoryLimit(limit))
		}

		var cdiDeviceIDs []string
		for _, dev := range cliContext.StringSlice("device") {
			if parser.IsQualifiedName(dev) {
				cdiDeviceIDs = append(cdiDeviceIDs, dev)
				continue
			}
			opts = append(opts, oci.WithDevices(dev, "", "rwm"))
		}
		gpuIDs := cliContext.IntSlice("gpus")
		if len(cdiDeviceIDs) > 0 || len(gpuIDs) > 0 {
			opts = append(opts, withStaticCDIRegistry())
		}
		opts = append(opts,
			cdispec.WithGPUs(gpuIDs...),
			cdispec.WithCDIDevices(cdiDeviceIDs...),
		)

		rootfsPropagation := cliContext.String("rootfs-propagation")
		if rootfsPropagation != "" {
			opts = append(opts, func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
				if s.Linux != nil {
					s.Linux.RootfsPropagation = rootfsPropagation
				} else {
					s.Linux = &specs.Linux{
						RootfsPropagation: rootfsPropagation,
					}
				}

				return nil
			})
		}

		if c := cliContext.String("blockio-config-file"); c != "" {
			if err := blockio.SetConfigFromFile(c, false); err != nil {
				return nil, fmt.Errorf("blockio-config-file error: %w", err)
			}
		}

		if c := cliContext.String("blockio-class"); c != "" {
			if linuxBlockIO, err := blockio.OciLinuxBlockIO(c); err == nil {
				opts = append(opts, oci.WithBlockIO(linuxBlockIO))

Review comment (suggestion):
How about adding a new option function as follows:
```
func withCDIDeviceRequests(cdiDeviceIDs []string, gpuIDs []int) []oci.SpecOpts {
	if len(cdiDeviceIDs) == 0 && len(gpuIDs) == 0 {
		return nil
	}

	var opts []oci.SpecOpts
	opts = append(opts, withStaticCDIRegistry())

	if len(gpuIDs) == 0 {
		return append(opts, cdispec.WithCDIDevices(cdiDeviceIDs...))
	}

	modifyingOption := func(ctx context.Context, client oci.Client, c *containers.Container, s *oci.Spec) error {
		devices, err := gpuDeviceNames(ctx, gpuIDs...)
		if err != nil {
			return err
		}
		return cdispec.WithCDIDevices(append(cdiDeviceIDs, devices...)...)(ctx, client, c, s)
	}

	return append(opts, modifyingOption)

}
```

And then calling it here:


```suggestion

		var cdiDeviceIDs []string
for _, dev := range cliContext.StringSlice("device") {
if parser.IsQualifiedName(dev) {
cdiDeviceIDs = append(cdiDeviceIDs, dev)
continue
}
opts = append(opts, oci.WithDevices(dev, "", "rwm"))
}

		if gpuIDs := cliContext.IntSlice("gpus"); len(cdiDeviceIDs) > 0 || len(gpuIDs) > 0 {
			opts = append(opts, withCDIDeviceRequests(cdiDeviceIDs, gpuIDs)...)
		}
```

Code after:
			opts = append(opts, oci.WithNewPrivileges)
		}
		if cliContext.IsSet("cgroup") {
			// NOTE: can be set to "" explicitly for disabling cgroup.
			opts = append(opts, oci.WithCgroup(cliContext.String("cgroup")))
		}
		limit := cliContext.Uint64("memory-limit")
		if limit != 0 {
			opts = append(opts, oci.WithMemoryLimit(limit))
		}

		var cdiDeviceIDs []string
		for _, dev := range cliContext.StringSlice("device") {
			if parser.IsQualifiedName(dev) {
				cdiDeviceIDs = append(cdiDeviceIDs, dev)
				continue
			}
			opts = append(opts, oci.WithDevices(dev, "", "rwm"))
		}

		if gpuIDs := cliContext.IntSlice("gpus"); len(cdiDeviceIDs) > 0 || len(gpuIDs) > 0 {
			opts = append(opts, withCDIDeviceRequests(cdiDeviceIDs, gpuIDs)...)
		}

		rootfsPropagation := cliContext.String("rootfs-propagation")
		if rootfsPropagation != "" {
			opts = append(opts, func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
				if s.Linux != nil {
					s.Linux.RootfsPropagation = rootfsPropagation
				} else {
					s.Linux = &specs.Linux{
						RootfsPropagation: rootfsPropagation,
					}
				}

				return nil
			})
		}

		if c := cliContext.String("blockio-config-file"); c != "" {
			if err := blockio.SetConfigFromFile(c, false); err != nil {
				return nil, fmt.Errorf("blockio-config-file error: %w", err)
			}
		}

		if c := cliContext.String("blockio-class"); c != "" {
			if linuxBlockIO, err := blockio.OciLinuxBlockIO(c); err == nil {
				opts = append(opts, oci.WithBlockIO(linuxBlockIO))
			} else {
				return nil, fmt.Errorf("blockio-class error: %w", err)
			}