feat(worker): grant IPC_LOCK and SYS_RESOURCE for Engram host memory (#777)

* refactor(pkg): unify json and stringx hash/base64 helpers across pkg

Signed-off-by: thxCode <thxcode0824@gmail.com>

* feat(worker): grant IPC_LOCK and SYS_RESOURCE for Engram host memory

Signed-off-by: thxCode <thxcode0824@gmail.com>

---------

Signed-off-by: thxCode <thxcode0824@gmail.com>

Author: thxCode

docs/modules/model-deployment/deployment.md

@@ -341,6 +341,17 @@ Changing the rendered capacity follows ordinary role rollout behavior.
 Existing Elastic members keep their mounts; new or replacement `Pod`s use the current value.
 Upgrading the operator adds the default mount to ordinary roles and triggers their recreate rollout.
 
+### Engram host memory
+
+When a non-privileged role (*`roles[].privileged`* unset or `false`) enables Engram host-memory
+offload, the operator grants `IPC_LOCK` and `SYS_RESOURCE` on the `main` container so the engine can
+pin host DRAM without running the whole `Pod` privileged:
+
+- `vLLM`: pass `--engram-config` (or a dotted `--engram-config.*` flag) in *`roles[].extraArgs`* or
+  *`roles[].command`* with `cpu_offload` left enabled (the default `true`). Passing `--engram-config`
+  is required even when keeping `vLLM`'s default settings so the operator can detect Engram offload.
+- `SGLang`: set `SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1` in *`roles[].env`*.
+
 ### Compilation cache and timeout
 
 An engine starts against a compilation cache and a startup budget.

pkg/devicemanager/allocator/ascend/rank_table.go

@@ -1,13 +1,13 @@
 package ascend
 
 import (
-	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 
 	"gpustack.ai/gpustack/pkg/device"
+	"gpustack.ai/gpustack/pkg/utils/json"
 )
 
 // rankTableCapability names the host ranktable in a preflight row, in HCCL's own vocabulary: the

pkg/devicemanager/allocator/cambricon/smlu.go

@@ -1,7 +1,6 @@
 package cambricon
 
 import (
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -14,6 +13,7 @@ import (
 	klog "k8s.io/klog/v2"
 
 	"gpustack.ai/gpustack/pkg/deviceplugin"
+	"gpustack.ai/gpustack/pkg/utils/json"
 	"gpustack.ai/gpustack/pkg/utils/osx"
 	"gpustack.ai/gpustack/pkg/utils/stringx"
 )

pkg/devicemanager/allocator/cambricon/smlu_test.go

@@ -1,7 +1,6 @@
 package cambricon
 
 import (
-	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -15,6 +14,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"gpustack.ai/gpustack/pkg/deviceplugin"
+	"gpustack.ai/gpustack/pkg/utils/json"
 )
 
 const (

pkg/devicemanager/allocator/hygon/mig.go

@@ -1,7 +1,6 @@
 package hygon
 
 import (
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -13,6 +12,7 @@ import (
 
 	workercore "gpustack.ai/gpustack/api/worker/v1alpha1"
 	"gpustack.ai/gpustack/pkg/deviceplugin"
+	"gpustack.ai/gpustack/pkg/utils/json"
 	"gpustack.ai/gpustack/pkg/utils/osx"
 )
 

pkg/devicemanager/allocator/metax/sgpu.go

@@ -1,7 +1,6 @@
 package metax
 
 import (
-	"encoding/json"
 	"fmt"
 	"io/fs"
 	"os"
@@ -14,6 +13,7 @@ import (
 	klog "k8s.io/klog/v2"
 
 	"gpustack.ai/gpustack/pkg/deviceplugin"
+	"gpustack.ai/gpustack/pkg/utils/json"
 	"gpustack.ai/gpustack/pkg/utils/osx"
 )
 

pkg/devicemanager/allocator/metax/sgpu_test.go

@@ -1,7 +1,6 @@
 package metax
 
 import (
-	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -13,6 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"gpustack.ai/gpustack/pkg/deviceplugin"
+	"gpustack.ai/gpustack/pkg/utils/json"
 )
 
 const (

pkg/devicemanager/allocator/nvidia/mig.go

@@ -3,7 +3,6 @@ package nvidia
 import (
 	"cmp"
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -18,6 +17,7 @@ import (
 	workercore "gpustack.ai/gpustack/api/worker/v1alpha1"
 	"gpustack.ai/gpustack/pkg/deviceplugin"
 	"gpustack.ai/gpustack/pkg/kubemeta"
+	"gpustack.ai/gpustack/pkg/utils/json"
 	"gpustack.ai/gpustack/pkg/utils/osx"
 )
 

pkg/devicemanager/allocator/nvidia/mig_test.go

@@ -2,7 +2,6 @@ package nvidia
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"maps"
 	"os"
@@ -21,6 +20,7 @@ import (
 
 	workercore "gpustack.ai/gpustack/api/worker/v1alpha1"
 	"gpustack.ai/gpustack/pkg/deviceplugin"
+	"gpustack.ai/gpustack/pkg/utils/json"
 )
 
 // fakeMigDriver is an in-memory migDriver: it records create/destroy calls and holds a

pkg/devicemanager/allocator/thead/mig.go

@@ -3,7 +3,6 @@ package thead
 import (
 	"cmp"
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -20,6 +19,7 @@ import (
 
 	workercore "gpustack.ai/gpustack/api/worker/v1alpha1"
 	"gpustack.ai/gpustack/pkg/deviceplugin"
+	"gpustack.ai/gpustack/pkg/utils/json"
 	"gpustack.ai/gpustack/pkg/utils/osx"
 )