> ## Documentation Index
> Fetch the complete documentation index at: https://tally.wharflab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# tally/gpu/no-container-runtime-in-image

> NVIDIA container runtime packages belong on the host, not inside the image.

NVIDIA container runtime packages belong on the host, not inside the image.

| Property | Value |
| - | - |
| Severity | Warning |
| Category | Correctness |
| Default | Enabled |
| Auto-fix | No |

## Description

Detects `RUN` instructions that install NVIDIA Container Toolkit host-side packages
(`nvidia-container-toolkit`, `nvidia-docker2`, `libnvidia-container*`) inside the
container image via a package manager (`apt`, `apt-get`, `yum`, `dnf`, `microdnf`, `apk`).

These packages are part of the
[NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html), which hooks into the
container runtime on the **host** to expose GPUs to containers. Installing them inside the image does not make the image GPU-enabled, wastes image
layers, and can mask the real requirement: that the host or cluster runtime must have the toolkit configured.

## Why this matters

* **Wrong layer** -- the toolkit runs on the host/node, not in the container
* **Does not enable GPU access** -- GPU device injection is handled by the container runtime (e.g., `nvidia-container-runtime`, CDI), not by packages
  inside the image
* **Bloats the image** -- the toolkit pulls in host-specific libraries that serve no purpose in the container filesystem
* **Hides requirements** -- a working GPU setup depends on the host runtime configuration, not on image contents

## Examples

### Violation

```dockerfile theme={null}
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y nvidia-container-toolkit
```

```dockerfile theme={null}
FROM centos:7
RUN yum install -y nvidia-docker2
```

```dockerfile theme={null}
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
RUN apt-get update && apt-get install -y libnvidia-container1
```

### No violation

```dockerfile theme={null}
# GPU base image with application packages only
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
RUN apt-get update && apt-get install -y python3 python3-pip
```

```dockerfile theme={null}
# Non-GPU image with unrelated packages
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y curl wget git
```

## Matched packages

| Package | Description |
| - | - |
| `nvidia-container-toolkit` | Main toolkit meta-package (CLI, hook, CDI generator) |
| `nvidia-docker2` | Legacy wrapper for Docker runtime integration |
| `libnvidia-container*` | Low-level container GPU library (`libnvidia-container1`, `libnvidia-container-tools`, etc.) |

## Configuration

This rule has no rule-specific options.

```toml theme={null}
[rules.tally.gpu.no-container-runtime-in-image]
severity = "warning"
```

## References

* [NVIDIA Container Toolkit Install Guide](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html)
* [NVIDIA Container Toolkit Architecture](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/arch-overview.html)


## Related topics

- [tally/gpu/no-hardcoded-visible-devices](/rules/tally/gpu/no-hardcoded-visible-devices.md)
- [tally/gpu/prefer-runtime-final-stage](/rules/tally/gpu/prefer-runtime-final-stage.md)
- [tally/gpu/no-buildtime-gpu-queries](/rules/tally/gpu/no-buildtime-gpu-queries.md)
- [tally/gpu/no-redundant-cuda-install](/rules/tally/gpu/no-redundant-cuda-install.md)
- [tally/windows/no-run-mounts](/rules/tally/windows/no-run-mounts.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.