Skip to main content
NVIDIA_DRIVER_CAPABILITIES=all exposes more driver surface than most workloads need; prefer a minimal capability set.
PropertyValue
SeverityInfo
CategoryCorrectness
DefaultEnabled
Auto-fixSuggestion only

​
Description

Detects ENV NVIDIA_DRIVER_CAPABILITIES=all in Dockerfiles. The all capability set mounts every NVIDIA driver library and binary into the container, but most ML and CUDA workloads only need compute,utility (NVIDIA’s documented default). A smaller set follows the principle of least privilege and avoids potential compatibility issues.

​
Why this matters

  • Least privilege — all exposes driver capabilities (graphics, video, display, compat32) that most inference and training workloads never use
  • Compatibility — mounting unnecessary driver components can surface driver/library version conflicts in environments where the host driver differs from what the image expects
  • Clarity — explicitly listing needed capabilities documents the workload’s actual requirements

​
What is flagged

PatternFlagged?Fix safety
ENV NVIDIA_DRIVER_CAPABILITIES=allYesFixSuggestion
ENV NVIDIA_DRIVER_CAPABILITIES=ALL (case-insensitive)YesFixSuggestion
ENV NVIDIA_DRIVER_CAPABILITIES=compute,utilityNo — already minimal—
ENV NVIDIA_DRIVER_CAPABILITIES=graphics,compute,utilityNo — intentional—
ENV NVIDIA_DRIVER_CAPABILITIES= (empty)No—
ENV NVIDIA_DRIVER_CAPABILITIES=${VAR} (variable reference)No — parameterized—

​
Examples

​
Violation

# Exposes all driver capabilities unnecessarily
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ENV NVIDIA_DRIVER_CAPABILITIES=all

# Same issue on a custom GPU base image
FROM ubuntu:22.04
ENV NVIDIA_DRIVER_CAPABILITIES=all

​
No violation

# Explicit minimal set -- preferred
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ENV NVIDIA_DRIVER_CAPABILITIES=compute,utility

# Workload that genuinely needs graphics
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ENV NVIDIA_DRIVER_CAPABILITIES=graphics,compute,utility

# Parameterized -- not hardcoded
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ARG CAPS=all
ENV NVIDIA_DRIVER_CAPABILITIES=${CAPS}

​
Auto-fix behavior

The rule offers a FixSuggestion (applied with --fix --fix-unsafe): replaces all with compute,utility. This is safe for most ML/CUDA workloads but may break workloads that genuinely need graphics, video, or display capabilities — review before accepting. For multi-key ENV instructions, only the NVIDIA_DRIVER_CAPABILITIES value is replaced; other keys are preserved.

​
Configuration

This rule has no rule-specific options. 
[rules.tally."gpu/prefer-minimal-driver-capabilities"]
severity = "info"

​
References