dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

AGENTS.md: External Exposure Policy (MANDATORY); comfyui_rocm seam retargeted

Browse Source 
Every Caddy-proxied service is now either behind the auth chain or
explicitly internal-only, with the provider-first flip procedure codified.
The comfyui GPU-access seam test now asserts the deployed contract
(group_add keep-groups + udev MODE 0666 on kfd/renderD*) instead of the
pre-fix 'video' group assumption.
This commit is contained in:
Frank
2026-08-30 23:26:18 -07:00
parent a382a3b883
commit c6d404ffde
2 changed files with 50 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/comfyui_rocm.bats
+22 -15
View File
@@ -5,13 +5,16 @@
# - build from a Containerfile based on the gfx1151 ROCm torch image
# - pass /dev/kfd and /dev/dri to the container
# - NOT pass --cpu
# - add the video and render groups
# - grant GPU access via world-writable compute nodes (udev MODE 0666), not
# named-group membership, because systemd user-unit spawns carry NO
# supplementary groups at spawn time
#
# STATUS (2026-08-19): the GPU migration is applied. The compose builds
# STATUS (2026-08-31): the GPU migration is applied. The compose builds
# comfyui-rocm:gfx1151 from Containerfile.comfyui (AMD's gfx1151 torch base),
# passes /dev/kfd + /dev/dri, adds the video group (render is unmappable in
# rootless), and drops --cpu.
# The four compose-wiring tests below are active (un-skipped). See
# passes /dev/kfd + /dev/dri, and relies on the udev rule at
# dankclaw/udev/99-comfyui-gpu-access.rules (MODE 0666 on kfd + renderD*) for
# compute-node access; group_add is keep-groups only. The four compose-wiring
# tests below are active (un-skipped). See
# serverAppConfigs-docs/Research/ComfyUI ROCm and Vulkan.md.
load helpers
@@ -64,19 +67,23 @@ print("command OK:", cmd)
PYEOF
}
@test "comfyui adds the video group (render is unmappable in rootless)" {
python3 - "$REPO_ROOT/dankclaw/compose.yaml" <<'PYEOF'
@test "comfyui GPU access uses keep-groups + udev MODE 0666, not named groups" {
python3 - "$REPO_ROOT/dankclaw/compose.yaml" "$REPO_ROOT/dankclaw/udev/99-comfyui-gpu-access.rules" <<'PYEOF'
import sys, yaml
with open(sys.argv[1]) as fh:
data = yaml.safe_load(fh)
groups = data["services"]["comfyui"].get("group_add", [])
# 'video' is added (it resolves in the rootless namespace). 'render' (gid 990)
# is intentionally ABSENT: rootless podman cannot map it into the container
# namespace (the subgid range is 100000+), so --group-add render fails to start.
# GPU access comes from the /dev/kfd + /dev/dri passthrough, checked host-side
# (the run user is already a member of 'render' on the host).
assert "video" in groups, f"comfyui group_add must include video; got: {groups}"
assert "render" not in groups, f"comfyui group_add must NOT include render (unmappable in rootless); got: {groups}"
print("groups OK:", groups)
# User-unit spawns carry NO supplementary groups, so named group_add entries
# (video, render) can never be honored at spawn time. The deployed contract is
# keep-groups plus world-writable compute nodes via the udev rule; a future
# edit that drops either half must fail here.
assert list(groups) == ["keep-groups"], \
f"comfyui group_add must be exactly ['keep-groups']; got: {groups}"
rule = open(sys.argv[2]).read()
assert 'KERNEL=="kfd", MODE="0666"' in rule, \
"udev rule must grant MODE 0666 on kfd with NO SUBSYSTEM guard (misc-class devices have no subsystem to match)"
assert 'KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0666"' in rule, \
"udev rule must grant MODE 0666 on renderD* (SUBSYSTEM drm guard)"
print("GPU access contract OK")
PYEOF
}