Transit ops documents required Docker options for municipal AI images that need GPUs. Which guidance belongs in the runbook?
Select an answer to reveal the explanation.
Short Explanation
Write it down once: GPU civic images need Docker GPU access options—--gpus or CDI—not a privileged-mode shortcut. Transit runbooks that skip that flag waste the next outage.
Full Explanation
Transit ops runbooks for municipal AI images that need GPUs must require Docker GPU access options—for example --gpus all or CDI device requests—whenever GPU-backed civic images are launched with Docker. Documenting that requirement turns ad-hoc tribal knowledge into a repeatable control for smoke tests, local validation, and incident response when containers start without accelerators.
Always using --network=none fails by concept for this guidance item: network isolation may be a security control in some contexts, but it is not the GPU-access requirement and can break legitimate NGC pulls or registry checks during image validation. Omitting GPU flags because “Slurm will inject them later” fails because many Docker invocations are outside Slurm (desktop validation, node smoke tests, debug shells); assuming the scheduler will rewrite every docker run leaves those paths broken. Preferring privileged mode instead of the NVIDIA Container Toolkit fails because privileged is a blunt security expansion and is not the supported substitute for toolkit/CDI GPU injection.
Exam caveat: NCP-AII expects operators to know the supported Docker+GPU path (toolkit/runtime/--gpus or CDI), not privileged-mode shortcuts or scheduler wishful thinking. Runbook questions test whether documented practice matches that path.
Operational check for transit: publish a runbook snippet with the exact docker run GPU flags used on the site, require technicians to paste the same options for civic AI image validation, and periodically audit recent docker history/scripts for GPU images launched without --gpus or CDI requests.