> ## Documentation Index
> Fetch the complete documentation index at: https://tally.wharflab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# tally/gpu/prefer-minimal-driver-capabilities

> `NVIDIA_DRIVER_CAPABILITIES=all` exposes more driver surface than most workloads need; prefer a minimal capability set.

`NVIDIA_DRIVER_CAPABILITIES=all` exposes more driver surface than most workloads need; prefer a minimal capability set.

| Property | Value |
| - | - |
| Severity | Info |
| Category | Correctness |
| Default | Enabled |
| Auto-fix | Suggestion only |

## Description

Detects `ENV NVIDIA_DRIVER_CAPABILITIES=all` in Dockerfiles. The `all` capability set mounts every
NVIDIA driver library and binary into the container, but most ML and CUDA workloads only need
`compute,utility` (NVIDIA's documented default). A smaller set follows the principle of least
privilege and avoids potential compatibility issues.

## Why this matters

* **Least privilege** -- `all` exposes driver capabilities (`graphics`, `video`, `display`, `compat32`)
  that most inference and training workloads never use
* **Compatibility** -- mounting unnecessary driver components can surface driver/library version
  conflicts in environments where the host driver differs from what the image expects
* **Clarity** -- explicitly listing needed capabilities documents the workload's actual requirements

## What is flagged

| Pattern | Flagged? | Fix safety |
| - | - | - |
| `ENV NVIDIA_DRIVER_CAPABILITIES=all` | Yes | `FixSuggestion` |
| `ENV NVIDIA_DRIVER_CAPABILITIES=ALL` (case-insensitive) | Yes | `FixSuggestion` |
| `ENV NVIDIA_DRIVER_CAPABILITIES=compute,utility` | No -- already minimal | -- |
| `ENV NVIDIA_DRIVER_CAPABILITIES=graphics,compute,utility` | No -- intentional | -- |
| `ENV NVIDIA_DRIVER_CAPABILITIES=` (empty) | No | -- |
| `ENV NVIDIA_DRIVER_CAPABILITIES=${VAR}` (variable reference) | No -- parameterized | -- |

## Examples

### Violation

```dockerfile theme={null}
# Exposes all driver capabilities unnecessarily
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ENV NVIDIA_DRIVER_CAPABILITIES=all
```

```dockerfile theme={null}
# Same issue on a custom GPU base image
FROM ubuntu:22.04
ENV NVIDIA_DRIVER_CAPABILITIES=all
```

### No violation

```dockerfile theme={null}
# Explicit minimal set -- preferred
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ENV NVIDIA_DRIVER_CAPABILITIES=compute,utility
```

```dockerfile theme={null}
# Workload that genuinely needs graphics
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ENV NVIDIA_DRIVER_CAPABILITIES=graphics,compute,utility
```

```dockerfile theme={null}
# Parameterized -- not hardcoded
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
ARG CAPS=all
ENV NVIDIA_DRIVER_CAPABILITIES=${CAPS}
```

## Auto-fix behavior

The rule offers a **`FixSuggestion`** (applied with `--fix --fix-unsafe`): replaces `all` with
`compute,utility`. This is safe for most ML/CUDA workloads but may break workloads that genuinely
need `graphics`, `video`, or `display` capabilities -- review before accepting.

For multi-key `ENV` instructions, only the `NVIDIA_DRIVER_CAPABILITIES` value is replaced; other
keys are preserved.

## Configuration

This rule has no rule-specific options.

```toml theme={null}
[rules.tally.gpu.prefer-minimal-driver-capabilities]
severity = "info"
```

## References

* [NVIDIA Container Toolkit: Environment Variables](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/docker-specialized.html)


## Related topics

- [tally/gpu/prefer-runtime-final-stage](/rules/tally/gpu/prefer-runtime-final-stage.md)
- [Rules overview](/rules/overview.md)
- [AI AutoFix (ACP)](/guides/ai-autofix.md)
- [tally/prefer-copy-heredoc](/rules/tally/prefer-copy-heredoc.md)
- [tally/gpu/prefer-uv-over-conda](/rules/tally/gpu/prefer-uv-over-conda.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.