Courts OCR workers die with permission errors on NVIDIA device nodes. What Docker troubleshooting step fits?
Select an answer to reveal the explanation.
Short Explanation
Permission errors on NVIDIA devices mean the container cannot open the GPU door—fix mounts and groups, not citywide 777. Head-node root babysitting is not a courts OCR design.
Full Explanation
Courts OCR workers dying with permission errors on NVIDIA device nodes need Docker device mounts and group permissions repaired for municipal GPU containers. Containers must receive /dev/nvidia* (and related) mounts with identities that are allowed to open those nodes—commonly via the nvidia runtime/CDI injection plus correct supplementary groups (for example video/render) or device cgroup rules. Fixing mounts and permissions restores GPU OCR without relaxing citywide filesystem security.
Chmod 777 on every civic filesystem including backups fails by concept: it is a blunt privilege expansion that violates least privilege and does not specifically ensure correct device injection into the container namespace. Running OCR only as root on the BCM head node interactively fails architecture and operations—OCR is a scaled worker workload, not an interactive head-node chore, and head-node GPU babysitting bypasses scheduling and audit. Ignoring device nodes and forcing CPU OCR despite GPU SLAs fails the service contract: courts throughput and latency targets assume accelerators.
Exam caveat: permission errors can look like "CUDA not found" or EACCES on device nodes; read the log carefully. Do not confuse missing --gpus/device requests (no devices present) with present devices that the process cannot open (permissions/groups). The stem names permission errors on device nodes, so focus on mounts and groups.
Operational check: from a failing OCR container, list device nodes and attempt a CUDA probe; on the host, verify group memberships and NVIDIA Container Toolkit mount configuration; apply the least-privilege fix (groups/udev/runtime) per runbook; restart workers and confirm OCR jobs complete under the GPU SLA with no EACCES in logs.