Hardened NVIDIA CUDA on Rocky Linux 9

This is a repackaged open source software product wherein additional charges apply for a pre-hardened, AWS-optimized image with verifiable compliance evidence and maintenance. NVIDIA CUDA runs on a Rocky Linux 9.8 base hardened following DISA STIG guidelines, tuned for Amazon EC2 workloads, and shipped with a complete OpenSCAP evidence pack and Software Bill of Materials (SBOM).

NVIDIA CUDA Deployment:

1. Complete GPU Toolchain: The full CUDA Toolkit is installed with nvcc and the GPU math, communication, and profiling libraries on PATH, paired with the NVIDIA open kernel module driver built through DKMS, so CUDA C++ code compiles out of the box.

2. Container and Fabric Stack Included: Docker CE with the NVIDIA Container Toolkit, NCCL and gdrcopy for GPU communication, the AWS EFA stack with libfabric, Open MPI, and the NCCL OFI plugin, plus DCGM and Fabric Manager.

3. Framework-Neutral by Design: A Python data stack (JupyterLab, NumPy, pandas, SciPy, boto3) and AWS CLI v2 are included, while cuDNN and the deep learning frameworks are intentionally left out, so you pick the framework and version yourself.

Hardened Operating System Base:

1. DISA STIG Alignment: 339 security controls applied to the Rocky Linux 9.8 base via the SCAP Security Guide, including auditd logging, SSH hardening, kernel command line and module blocklist restrictions, and strict password policy enforcement.

2. Fully Patched at Release: Zero packages with a pending update at build time, verified. The complete CVE scan ships inside the image.

3. Documented Exceptions: Every STIG rule not applied is itemized with a technical justification, so the delivered posture is auditable.

Comprehensive Evidence Pack:

Every AMI carries an OpenSCAP evidence pack generated against DISA STIG guidance, under /opt/hardening-report/:

• Base_Report.html: Pre-hardening scan report, the initial baseline.
• Tailored_Profile_Report.html: Post-hardening report against the tailored profile shipped in this image.
• Raw_STIG_Report.html: Post-hardening report against the unmodified baseline DISA STIG profile.
• Exceptions.txt: Itemized unapplied STIG rules with technical justifications (AWS compatibility, site-specific policies, CSP service conflicts).
• Tuning_Parameters.txt: Every tuning parameter applied on top of the hardening, each shown against its base-image value.
• compliance_mapping.csv: Rule-by-rule mapping to NIST SP 800-53 controls and DISA STIG identifiers with pass/fail statuses.
• package_changes.txt: Package delta against the minimal stock installation.
• sbom.spdx.json: Software Bill of Materials in SPDX format, generated from the RPM database.
• cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan reports categorizing CVEs by upstream patch availability.
• key_files.sha256: SHA-256 checksums of the key configuration files changed by the hardening, so the delivered state can be verified.
• README.txt: Index of artifact contents, operational guidelines, and configuration defaults.

Reliability Validation:

1. Validation Testing: Functional verification on clean AMI launches through multi-round integration testing, covering the complete GPU software lifecycle with SELinux enforcing.

AWS Network & Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, increased connection backlogs, buffer adjustments, and MTU probing enabled.

2. System Tuning: Red Hat tuned daemon active with a custom cloud profile, transparent hugepages set to madvise, and modified memory/EBS writeback parameters.

3. EC2 Integration: NVMe I/O timeouts, Amazon Time Sync (chrony), IRQ balance daemon, and size-capped persistent journald logging.

Operational Tools:

1. Preinstalled Tools: AWS SSM Session Manager enabled, CloudWatch Agent installed (disabled by default).

Maintenance:

1. Maintenance Specifications: Rebuilt and updated bi-weekly to monthly incorporating upstream NVIDIA CUDA and Rocky Linux 9.8 security updates, with artifact documentation refreshed per release.

About NVIDIA CUDA

A framework-neutral GPU compute base in which the driver, the CUDA Toolkit, the container runtime, and the multi-node fabric libraries are assembled and verified together, so accelerated workloads run immediately instead of requiring hours of reconciling kernel modules and toolkit versions. It suits AI and HPC stacks built on CUDA, PyTorch, TensorFlow, Docker, and Kubernetes.

About Rocky Linux 9

Built directly from RHEL 9 source code for binary compatibility with the Red Hat 9 ecosystem, with predictable update cadences and a maintenance lifecycle through 2032. Any application compiled, certified, or documented for RHEL 9 runs without modification, and the platform is structurally aligned with AlmaLinux, CentOS Stream, and legacy CentOS deployments.