From eeff98db12cb38ae2ada61bf01198884cf5bf224 Mon Sep 17 00:00:00 2001
From: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Date: Mon, 28 Oct 2024 13:18:02 +0100
Subject: [PATCH] packages/nvidia-ctk-oci-hook: init

This adds a package for the OCI hook required to start peer pods GPU containers.
---
 packages/by-name/mkNixosConfig/package.nix    |  1 +
 .../by-name/nvidia-ctk-oci-hook/package.nix   | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 packages/by-name/nvidia-ctk-oci-hook/package.nix

diff --git a/packages/by-name/mkNixosConfig/package.nix b/packages/by-name/mkNixosConfig/package.nix
index c4187f7b9..3b08d93d5 100644
--- a/packages/by-name/mkNixosConfig/package.nix
+++ b/packages/by-name/mkNixosConfig/package.nix
@@ -41,6 +41,7 @@ lib.makeOverridable (
             cloud-api-adaptor
             kernel-podvm-azure
             pause-bundle
+            nvidia-ctk-oci-hook
             nvidia-ctk-with-config
             ;
           inherit (outerPkgs.kata) kata-agent;
diff --git a/packages/by-name/nvidia-ctk-oci-hook/package.nix b/packages/by-name/nvidia-ctk-oci-hook/package.nix
new file mode 100644
index 000000000..dfd5d0457
--- /dev/null
+++ b/packages/by-name/nvidia-ctk-oci-hook/package.nix
@@ -0,0 +1,27 @@
+# Copyright 2024 Edgeless Systems GmbH
+# SPDX-License-Identifier: AGPL-3.0-only
+
+{
+  writeShellApplication,
+  nvidia-ctk-with-config,
+  lib,
+}:
+writeShellApplication {
+  name = "nvidia-ctk-oci-hook";
+
+  text = ''
+    # Log the o/p of the hook to a file
+    ${lib.getExe' nvidia-ctk-with-config "nvidia-container-runtime-hook"} \
+      -config ${nvidia-ctk-with-config}/etc/nvidia-container-runtime/config.toml \
+      -debug "$@" > /var/log/nvidia-hook.log 2>&1
+  '';
+
+  meta = {
+    description = "OCI hook for nvidia-container-runtime";
+    longDescription = ''
+      This is an OCI hook (prestart) for the nvidia-container-runtime. It is used to
+      facilitate GPU containers in peer pods with the necessary drivers, libraries,
+      and binaries to access the GPU.
+    '';
+  };
+}