Enabling GPUs on Fedora with Image Mode (fedora-bootc)

GPUs are essential for many Linux users for enabling applications such as gaming and running local LLMs. Having ready-to-use GPU drivers, including NVIDIA on Fedora, has become an important use case for the Fedora Project. In the past weeks, we (Fedora CoreOS working group) have been experimenting with using bootc aka bootable containers to build a custom version of Fedora with NVIDIA drivers out of the box, this image is hosted on Quay.io at quay.io/coreos-devel/fedora-bootc-nvidia

Bootable containers enable an Image Mode workflow by leveraging the OCI ecosystem.This workflow leverages Dockerfile/Containerfile to customize and modify a base image, giving users the flexibility to quickly build and iterate derived versions of Fedora. This image is built using Fedora Bootc as a base image. By using the same Containerfile, you can also build images using other Atomic Desktops as a base ( Silverblue, Kinoite, etc). For example, we are also building a derived version based on Fedora CoreOS.

Leveraging this technology, we were able to build and easily make available an OCI image with GPU drivers.

How to test?

This is currently a proof of concept aimed at understanding the feasibility of building such an image, as well as the interest in having such images in Fedora.

If you want to test it, we wrote instructions to use the image and start a local LLM with ramalama

You can also watch a screencast of this use case.

Where do we go from here?

The goal of this proof of concept is to show-case how we can leverage existing cloud-native ecosystems (infrastructure and tools) to innovate and build new experiences in Fedora. Image mode and bootable containers represent an exciting approach to building and configuring operating systems. Our aim is to build a community of bootable container enthusiasts within Fedora.

Furthermore, we would like to initiate discussions around building and signing out-of-tree drivers within the existing Fedora infrastructure. Currently, we are utilizing NVIDIA’s DKMS packages which simplifies integration significantly. However, this introduces the downside of breaking Secure Boot as the kernel modules are not signed with Fedora’s key. Having NVIDIA’s open-source kernel module built and signed part of Fedora’s rpms packages would strengthen Fedora’s offering in terms of gaming and running AI workloads.

How to contribute?

There are currently no plans to take this proof of concept further, but if you are interested in using, building, testing or maintaining such images or simply excited about bootable containers. Please reach out in the comments below or directly on the repo.

If you are more curious about bootable containers in general and would like to participate in the development of bootc, you can check the project contribution guide.

7 Likes

I might be missing something… The readme says that “the kmods are not signed by the Fedora’s key but a self-signed one” but I don’t see anything that looks like key setup in the Containerfile, (and if it were there, it would still require enrolling a key in the MOK.)

I think it should be possible to set up kernel signing with AWS KMS, and I’m interested in building up a secure standard template for projects that want to build and sign kernels and modules. Would you be interested in that?

I’m interested in building up a secure standard template for projects that want to build and sign kernels and modules. Would you be interested in that?

This would be awesome, I’m currently building unsigned modules for Nvidia Open and ZFS.