NVIDIA: userspace installation fails because exact-version dependencies are not pinned

Start with _setup_nvidia_gpu() in lib/hwaccel.func and trace how it selects the host driver version, pins packages, and handles the failed install. Reproduce the conflict with the listed apt-get --simulate command in a Debian 13 container. Done means installation handles the matching NVIDIA userspace dependencies successfully and validation does not report success when it fails.

Environment

• Proxmox VE: 9.2.3
• Container: Debian 13 (Trixie)
• GPU: NVIDIA RTX 3060
• Host NVIDIA driver: 595.112.07
• Affected installation: vLLM script
• Affected helper: lib/hwaccel.func, _setup_nvidia_gpu()

Summary

When creating a Debian 13 LXC with the vLLM script, the shared NVIDIA hardware-acceleration helper detects the host driver version correctly (595.112.07) and finds matching 595.112.07-1 userspace packages in the NVIDIA repository.

However, it pins only four packages:

• libcuda1
• libnvcuvid1
• libnvidia-encode1
• libnvidia-ml1

It does not pin the exact-version dependencies required by those packages:

• libnvidia-ptxjitcompiler1
• libnvidia-pkcs11-openssl3
• libnvidia-gpucomp

APT therefore selects newer 620.70.06-1 dependency candidates, while the requested packages must be 595.112.07-1. The installation fails.

How the issue was found

A fresh Debian 13 LXC was created with the vLLM script. During creation, the hardware-acceleration setup reported:

Version-pinned install failed - keeping libcuda1 at 595.112.07-1, the rest unpinned

No underlying APT error was shown because the fallback redirects stderr to /dev/null and ignores the failure with || true.

After creation, the container was inspected with:

pct exec 101 -- bash -c '
  apt-cache policy libcuda1 libnvidia-ptxjitcompiler1 libnvidia-pkcs11-openssl3 libnvidia-gpucomp
  apt-cache madison libcuda1
'

This showed that the repository contained the host-matching 595.112.07-1 packages, but the default candidates for the dependencies were 620.70.06-1.

Reproduction

The helper selects the host driver version and attempts:

apt-get -y -o Dpkg::Options::="--force-confold" install --no-install-recommends \
  libcuda1=595.112.07-1 \
  libnvcuvid1=595.112.07-1 \
  libnvidia-encode1=595.112.07-1 \
  libnvidia-ml1=595.112.07-1

However, it does not pin the exact-version dependencies required by those packages:

• libnvidia-ptxjitcompiler1
• libnvidia-pkcs11-openssl3
• libnvidia-gpucomp

APT therefore selects newer 620.70.06-1 dependency candidates, while the requested packages must be 595.112.07-1. The installation fails.

Diagnostic tests

The following command reproduced the dependency conflict:

pct exec 101 -- apt-get --simulate --no-install-recommends install \
  libcuda1=595.112.07-1 \
  libnvcuvid1=595.112.07-1 \
  libnvidia-encode1=595.112.07-1 \
  libnvidia-ml1=595.112.07-1

APT selected:

libnvidia-ptxjitcompiler1 620.70.06-1
libnvidia-pkcs11-openssl3 620.70.06-1
libnvidia-gpucomp 620.70.06-1

A real installation attempt then failed with a version conflict.

Successful manual simulation

Explicitly selecting the matching dependency versions succeeds:

pct exec 101 -- apt-get --simulate --no-install-recommends install \
  libcuda1=595.112.07-1 \
  libnvidia-ptxjitcompiler1=595.112.07-1 \
  libnvidia-pkcs11-openssl3=595.112.07-1 \
  libnvidia-gpucomp=595.112.07-1

The simulation resolved cleanly, confirming that the matching packages are available and that the issue is the incomplete version pinning.

Observed behavior

The helper reports:

Version-pinned install failed - keeping libcuda1 at 595.112.07-1, the rest unpinned

The fallback only pins libcuda1:

"libcuda1=${available_version}" libnvcuvid1 libnvidia-encode1 libnvidia-ml1

It also suppresses APT errors:

2>/dev/null || true

As a result, the actual dependency conflict is hidden.

Expected behavior

The helper should either:

1. Install the complete matching NVIDIA userspace package set, including exact-version dependencies; or
2. Let APT resolve dependencies naturally instead of pinning only a subset; or
3. Surface the failed APT command and its error instead of suppressing it.

Additional issue

setup_hwaccel() prints Setup Hardware Acceleration as successful even when NVIDIA validation fails. It does set HWACCEL_VENDOR="none" in this case, but the final success message is misleading.