From 8f612f68d916fdda8a39836fe90ac12dfc5748e4 Mon Sep 17 00:00:00 2001
From: Abrar Shivani <ashivani@nvidia.com>
Date: Fri, 24 Jul 2026 15:56:11 -0700
Subject: [PATCH] Use upstream Rocky Linux base images instead of CUDA images

The rocky8/9/10 driver images were built on nvcr.io/nvidia/cuda:*-base-
rockylinux*, which coupled Rocky driver builds to the CUDA image release
cadence. That coupling is already biting: no 13.2.1 or 13.3.0
base-rockylinux10 tag was ever published, which is why rocky10 was pinned
to 13.2.0 while rocky8/9 moved to 13.3.0.

Point the rocky targets at Rocky Linux's own images instead, mirroring how
the rhel targets build on registry.access.redhat.com/ubi*. The -ubi flavor
is used because its package set matches the Red Hat UBI images that the
rhel Dockerfiles are written against - notably it ships `which` and
systemd, which the default Rocky image does not.

This drops nothing the driver container used. The CUDA base only added
cuda-cudart, cuda-compat and the cuda-toolkit-*-config-common packages on
top of the plain Rocky image; none are referenced by the rhel Dockerfiles,
which do not even declare ARG CUDA_VERSION. The CUDA package repository
that supplies fabricmanager, nscq, nvsdm and imex is unaffected: it is
added explicitly by install.sh setup_cuda_repo at build time and is
independent of the base image. The base image's own cuda.repo was already
being deleted before the final layer.

Renovate needs new guards because all three Rocky majors share a single
image repository, so an unconstrained bump could move rocky9 onto a Rocky
10 tag. The previous nvcr.io tags were implicitly protected by docker
versioning's suffix compatibility.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
---
 .github/renovate.json | 43 +++++++++++++++++++++++++++++++++++++++++++
 Makefile              | 10 +++++++---
 2 files changed, 50 insertions(+), 3 deletions(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index 4c85c906a..131e65bc0 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -36,6 +36,49 @@
             "commitMessageTopic": "RHEL UBI base images",
             "commitMessageSuffix": ""
         },
+        {
+            "matchDatasources": [
+                "docker"
+            ],
+            "matchPackageNames": [
+                "rockylinux/rockylinux"
+            ],
+            "groupName": "Rocky Linux base images",
+            "groupSlug": "rocky-base-images",
+            "additionalBranchPrefix": "",
+            "commitMessageTopic": "Rocky Linux base images",
+            "commitMessageSuffix": ""
+        },
+        {
+            "matchDatasources": [
+                "docker"
+            ],
+            "matchPackageNames": [
+                "rockylinux/rockylinux"
+            ],
+            "matchCurrentValue": "/^8\\./",
+            "allowedVersions": "/^8\\.\\d+-ubi$/"
+        },
+        {
+            "matchDatasources": [
+                "docker"
+            ],
+            "matchPackageNames": [
+                "rockylinux/rockylinux"
+            ],
+            "matchCurrentValue": "/^9\\./",
+            "allowedVersions": "/^9\\.\\d+-ubi$/"
+        },
+        {
+            "matchDatasources": [
+                "docker"
+            ],
+            "matchPackageNames": [
+                "rockylinux/rockylinux"
+            ],
+            "matchCurrentValue": "/^10\\./",
+            "allowedVersions": "/^10\\.\\d+-ubi$/"
+        },
         {
             "matchDatasources": [
                 "docker"
diff --git a/Makefile b/Makefile
index 2eba4a253..a6f5f40c3 100644
--- a/Makefile
+++ b/Makefile
@@ -183,14 +183,18 @@ $(DRIVER_BUILD_TARGETS):
 
 build-rhcos%: SUBDIR = rhel9
 
+# The rocky targets reuse the rhel Dockerfiles with a Rocky Linux base image.
+# We use the -ubi image flavor published by the Rocky Enterprise Software
+# Foundation: its package set mirrors the Red Hat UBI images that the rhel
+# Dockerfiles are written against, so the same Dockerfile works unmodified.
 build-rocky8%: SUBDIR = rhel8
-build-rocky8%: DOCKER_BUILD_ARGS = --build-arg BASE_IMAGE=nvcr.io/nvidia/cuda:13.3.0-base-rockylinux8
+build-rocky8%: DOCKER_BUILD_ARGS = --build-arg BASE_IMAGE=rockylinux/rockylinux:8.10-ubi
 
 build-rocky9%: SUBDIR = rhel9
-build-rocky9%: DOCKER_BUILD_ARGS = --build-arg BASE_IMAGE=nvcr.io/nvidia/cuda:13.3.0-base-rockylinux9
+build-rocky9%: DOCKER_BUILD_ARGS = --build-arg BASE_IMAGE=rockylinux/rockylinux:9.8-ubi
 
 build-rocky10%: SUBDIR = rhel10
-build-rocky10%: DOCKER_BUILD_ARGS = --build-arg BASE_IMAGE=nvcr.io/nvidia/cuda:13.2.0-base-rockylinux10
+build-rocky10%: DOCKER_BUILD_ARGS = --build-arg BASE_IMAGE=rockylinux/rockylinux:10.2-ubi
 
 # ubuntu22.04 Precompiled Driver
 build-signed_ubuntu22.04%: DIST = ubuntu22.04