Transit wants GPU workload base images that stay supportable and reject unsigned sidecars. What practice fits?
Select an answer to reveal the explanation.
Short Explanation
Transit should ride on signed NGC base images—known station, known train. Unsigned sidecars and mystery builds are how support tickets pile up.
Full Explanation
Standardizing transit GPU workloads on signed NGC containers as base images gives the city a supportable provenance chain: known publisher, known SBOM lineage, and a support path when drivers, CUDA, or framework bugs appear. Signed NGC bases also make it practical to reject unsigned sidecars at pull or admission time, so only reviewed layers join the municipal runtime. For an agency running ETA, CV, and scheduling models, that baseline reduces mean-time-to-diagnose because vendor docs and NVIDIA tooling assume NGC-aligned stacks.
Allowing any unsigned sidecar from public registries fails by concept because provenance and vulnerability scanning become optional; a compromised or abandoned sidecar can ship libraries that collide with the GPU stack or exfiltrate transit telemetry. Banning containers and running binaries by hand on every node fails operationally: it destroys reproducibility, blocks rolling updates, and turns every node into a snowflake that BCM and the scheduler cannot treat uniformly. Locally built mystery images with no NGC provenance fail the supportability requirement even if they happen to run—when NCCL misbehaves or a CVE lands, ops cannot map the binary back to a supported recipe.
Exam caveat: "use NGC" does not mean every layer must come from NGC forever. Cities often add thin, signed municipal layers (configs, agency models, entrypoints) atop NGC bases. The tested idea is that the GPU/runtime foundation stays supportable and signed—not that custom city code is forbidden. Likewise, signing alone is not a substitute for version pinning to the cluster CUDA/driver matrix.
Operational check: enforce registry admission or Docker content trust policies that require signatures on GPU base images; document the approved NGC tag list for transit; scan sidecars before merge; and verify a canary job pulls only allowed digests. After an image update, re-run a GPU smoke and confirm support contacts still map to the published NGC tag in the change ticket.