An air-gapped city cluster needs a Triton image for 311 inference. How should civic ops deploy from NGC?
Select an answer to reveal the explanation.
Short Explanation
Air-gap cities do not let every GPU node phone home—mirror NGC into the municipal registry, then deploy. Nightly open pulls and random GitHub forks break policy and consistency. Hand-copied binaries without provenance are an audit nightmare.
Full Explanation
For an air-gapped city cluster, the correct NGC path is to pull the Triton container into the municipal air-gapped registry first, then deploy from that internal mirror. That pattern preserves provenance from NGC while satisfying air-gap policy: compute nodes never need direct Internet egress, and every 311 inference host consumes the same approved artifact. Civic container ops treat the municipal registry as the controlled warehouse—NGC is the vendor source, the city registry is the only storefront nodes may use.
Pulling containers directly through the open Internet from every compute node nightly fails by concept because it violates air-gap assumptions, creates inconsistent node-local caches, and expands egress and supply-chain exposure across the GPU fleet. Ignoring NGC and compiling Triton from random GitHub forks on each node fails because forks lack the certified, version-pinned NGC path and produce divergent binaries that break reproducibility and supportability. Disabling the registry and copying binaries by hand with no provenance fails because hand copies erase attestation, complicate updates, and leave auditors unable to prove which Triton build serves 311.
Exam caveat: air-gapped NGC workflows are about controlled ingress and internal redistribution, not about avoiding NGC entirely. Candidates may think “air-gap means no NGC”; the exam expectation is mirror-then-deploy. Triton image choice still must match driver/CUDA baselines on BCM node images—registry mirroring does not waive compatibility.
Operational check: confirm the NGC Triton image was imported into the municipal registry with recorded digest/tag, verify GPU nodes resolve only that registry, deploy a canary 311 inference pod or service from the mirrored tag, and compare node runtime libraries against the container’s documented CUDA requirements before citywide rollout.