Skip to main content

What the NVIDIA Container Toolkit Is: The Component in 100% of GPU Containers

For executives​

Every GPU container in production depends on a single software component: the NVIDIA Container Toolkit (NCT). Without it, containers cannot access GPU hardware. When the Container Toolkit has a critical vulnerability — as it has, repeatedly, since September 2024 — the vulnerability affects every organisation running GPU workloads in containers. This article explains what the toolkit is, what it does, and why it is the single most important software component to keep patched in AI infrastructure.

The problem the Container Toolkit solves​

A container is isolated from the host by default. It cannot access GPU devices, GPU drivers, or CUDA libraries. An AI workload that needs a GPU is therefore stuck. The NVIDIA Container Toolkit solves this by performing a controlled bridging operation every time a GPU container starts.

What the toolkit actually does at container start​

When a container with the NVIDIA runtime starts:

  • The container runtime detects that the NVIDIA runtime is requested.
  • The runtime calls the NVIDIA Container Runtime shim, which calls nvidia-ctk.
  • The toolkit registers OCI hooks that will run at specific container lifecycle points.
  • The createContainer hook runs before the container's namespace is fully established. It configures the CUDA compatibility layer.
  • The prestart hooks run after namespace setup. They bind-mount GPU device files and CUDA libraries into the container.
  • The update-ldcache hook updates the container's dynamic linker cache to include the newly mounted GPU libraries.
  • The container's process starts with GPU device access and CUDA libraries available.

Steps 4, 5, and 6 are the specific steps where Container Toolkit vulnerabilities have been found. The createContainer hook was vulnerable via CVE-2025-23266 (LD_PRELOAD injection). The mount operations were vulnerable via CVE-2024-0132 (TOCTOU) and CVE-2025-23359 (TOCTOU bypass). The update-ldcache hook was vulnerable via CVE-2025-23267 (symlink following).

Why it is in 100% of GPU containers​

There is no alternative. CUDA requires the NVIDIA GPU driver, which is on the host. CUDA programs require driver libraries that are on the host. The device files that represent the GPU are on the host. Getting all of these into a container requires the Container Toolkit's bridging operation.

CDI (Container Device Interface) is a newer approach that achieves similar results through a different mechanism — device specification files rather than runtime hooks. CDI mode bypasses the specific code paths that CVE-2024-0132, CVE-2025-23359, and CVE-2025-23266 exploit. But CDI is not universally deployed — the OCI hook-based default mode remains the standard configuration across the vast majority of GPU container deployments.

Component versions and the patching cadence​

The Container Toolkit has its own version, separate from the NVIDIA GPU driver. Since September 2024, the Container Toolkit has received security bulletins in September 2024, November 2024, January 2025, February 2025, and July 2025. An organisation that patches the GPU driver but not the Container Toolkit is running a current driver on a vulnerable container runtime.