fix(docker): run the oneAPI release image on Debian 13 with the pinned Intel GPU runtime

[lusoris]

Summary

The published oneAPI image crashed every vmaf --backend sycl run on an Arc B580 (exit 139 right after device selection); a UHD 770 worked. The cause is the Intel GPU compute runtime (NEO 25.18) that Intel's oneapi-runtime:2025.3.1 image carries. In the unchanged image, swapping only that runtime for NEO 26.35 stops the crash, and swapping only the Level Zero loader does not.

This PR moves the image to the design build-config.env already described (ADR-1368):

• Builder and final stage start from the release track's debian:13-slim, like the CPU image.
• Intel's oneAPI 2026.1 compiler (builder) and SYCL runtime plus UMF (final stage) come from Intel's apt repository at one exact build (2026.1.1-325), through the new scripts/ci/install-intel-oneapi.sh. The repository key is pinned by fingerprint.
• The NEO GPU runtime at INTEL_NEO_VERSION (the package set the dev container installs) and the Level Zero loader at LEVEL_ZERO_VERSION come from the existing scripts/ci/install-intel-ocloc.sh, which gains --components build|runtime. The fetcher checks the loader against GitHub's asset digests.
• The image is published as -oneapi2026. The -oneapi2025 tag and the final-oneapi2025 stage stay as aliases of the same image (HISS-14).
• The base-image gate now requires ONEAPI_BUILDER and ONEAPI_RUNTIME to equal RELEASE_BUILDER_BASE, and its distro exemption list is empty.

It also fixes a second break found on the way: on current master the 2025.3.2 builder no longer links the unit tests. libsycl-devicelib-host.a needs libm after --as-needed has dropped it. The 2026.1.1 compiler links them.

Closes T-RELEASE-ONEAPI-IMAGE-B580-SIGSEGV-2026-09-29.

Type

• fix — bug fix
• build / ci — tooling / infra

Checklist

• Commits follow Conventional Commits (the commit-msg hook enforces this).
• make format && make lint is green locally. The repository's pre-commit framework passes on this diff in a Linux container (every hook, REUSE included), plus hadolint 2.14.0, shellcheck 0.11.0, shfmt 3.13.1 and actionlint. praetorctl governance was not available on this host; CI runs it.
• Unit tests pass: python3 scripts/ci/run_meson_test.py -- -C build. Not run separately; the image builder compiles and links every unit test with the 2026.1.1 compiler. The changed Python and shell contracts pass (fetcher 21 tests, base-image single-source 77, dev-container secret 31, CUDA installer 18, image runtime and publish source-binding contracts).
• If I touched any SIMD/GPU code path, I ran /cross-backend-diff and the worst ULP is ≤ 2. No kernel code changed. The image's SYCL scores were compared with its CPU backend under the parity-gate tolerances (table below).
• If I touched a feature extractor with SIMD/GPU twins, I either updated every twin or listed the gap under "Known follow-ups" below. No extractor touched.
• If I added a new .c / .cpp / .cu / .h / .hpp, it has the appropriate license header (see CONTRIBUTING.md). None added; the new shell script carries the EUPL-1.2 header.
• If this is a breaking change, the commit message uses ! or BREAKING CHANGE: and the migration path is documented below. Not breaking: both old names keep working.
• If this PR adds an ADR, the ADR row lives in docs/adr/_index_fragments/<NNNN-slug>.md and the slug is appended to docs/adr/_index_fragments/_order.txt.

Bug-status hygiene (ADR-0165)

• docs/state.md updated in this PR: T-RELEASE-ONEAPI-IMAGE-B580-SIGSEGV-2026-09-29 moved to "Recently closed", with the evidence and a copy-paste check for a native Linux host.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.
• If I believe a golden value must change, I have explained why below AND pinged @lusoris for a CODEOWNERS exception. No golden value changes.

Cross-backend numerical results

--backend sycl in the rebuilt image against --backend cpu in the same image. Windows 11 host, Docker Desktop WSL 2 backend, /dev/dxg. Every GPU run held flock /f/gpu.lock. Tolerances are the parity gate's (FEATURE_TOLERANCE, metric_delta, area_tolerance_factor; the VMAF score at places=4), checked per frame and per metric. Each JSON's feature_backends confirms the SYCL twin ran.

Image built at this branch's head (final-oneapi2026, AOT image check: 30 fat binaries, 19 targets).

Pair	Workload	Device	CPU pooled	SYCL pooled	Worst per-frame delta (tolerance)	Result
Netflix, 48 frames	default model (vmaf)	Arc B580	82.816059	82.816058	integer_motion2 1.2e-5 (5e-5)	pass
Netflix, 48 frames	default model (vmaf)	UHD 770	82.816059	82.816058	integer_motion2 1.2e-5 (5e-5)	pass
Netflix, 48 frames	--feature psnr_hvs	Arc B580	31.330446	31.330390	psnr_hvs_y 8.3e-5 (5e-4)	pass
Netflix, 48 frames	--feature psnr_hvs	UHD 770	31.330446	31.330390	psnr_hvs_y 8.3e-5 (5e-4)	pass
Netflix, 48 frames	--feature ssimulacra2	Arc B580	24.614428	24.614428	0 on every frame (5e-3)	pass
Netflix, 48 frames	--feature ssimulacra2	UHD 770	24.614428	24.614428	0 on every frame (5e-3)	pass
BBB 4K, 50 frames	default model (vmaf)	Arc B580	79.182228	79.182227	integer_motion2 5e-6 (5e-5)	pass
BBB 4K, 50 frames	default model (vmaf)	UHD 770	79.182228	79.182227	integer_motion2 5e-6 (5e-5)	pass
BBB 4K, 50 frames	--feature psnr_hvs	Arc B580	44.258029	44.257588	psnr_hvs_y 8.43e-4 (3.34e-3, area-scaled)	pass
BBB 4K, 50 frames	--feature psnr_hvs	UHD 770	44.258029	44.257588	psnr_hvs_y 8.43e-4 (3.34e-3, area-scaled)	pass
BBB 4K, 50 frames	--feature ssimulacra2	Arc B580	65.881933	65.881933	0 on every frame (5e-3)	pass
BBB 4K, 50 frames	--feature ssimulacra2	UHD 770	65.881933	65.881933	0 on every frame (5e-3)	pass

Root-cause probe

The same 2025-built binary (final-oneapi2025 at 2d9d5b069) in every row, with packages swapped. Default model, Netflix pair, 2 frames.

Variant	NEO	IGC	Level Zero loader	Arc B580	UHD 770
image as published	25.18.33578.15	2.11.12	1.21.9	exit 139	exit 0
loader only	25.18.33578.15	2.11.12	1.34.0	exit 139	exit 0
NEO only	26.35.39758.10	2.41.5	1.21.9	exit 0	exit 0
NEO + loader (dev container set)	26.35.39758.10	2.41.5	1.34.0	exit 0	exit 0

Image size

	before (final-oneapi2025, probe at 2d9d5b069)	after (final-oneapi2026)
Unpacked	5.86 GB	2.39 GB
docker save + gzip -6	1.42 GB	0.61 GB

Deep-dive deliverables (ADR-0108)

• Research digest — docs/research/2128-oneapi-release-image-runtime.md: the probe, Intel's apt repository layout and pins, the key, the rebuilt image and its scores.
• Decision matrix — in ADR-1368 ## Alternatives considered: overlay NEO on the 2025 images, Intel's 2026 images, Debian 13 with pinned packages (chosen), Debian's Level Zero loader, a second NEO installer, switching dev/Containerfile now, and four tag-naming options.
• AGENTS.md invariant note — docker/AGENTS.md (oneAPI bases and the image's load-bearing steps) and dev/AGENTS.md (the shared installer and fetcher).
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/fixed/release-oneapi-image-runtime.md and changelog.d/changed/release-oneapi-image-tag.md.
• Rebase note — docs/rebase-notes.md, "ADR-1368 — oneAPI release image on Debian 13 with pinned Intel packages".

Reproducer

On a Linux host with an Intel GPU:

docker build -f docker/Dockerfile.production-gpu --target final-oneapi2026 -t vmafx:oneapi2026-check .
for b in cpu sycl; do
  docker run --rm --device /dev/dri --group-add "$(getent group render | cut -d: -f3)" \
    -e ONEAPI_DEVICE_SELECTOR=level_zero:gpu -v "$PWD/testdata:/t:ro" vmafx:oneapi2026-check \
    --backend "$b" --reference /t/ref_576x324_48f.yuv --distorted /t/dis_576x324_48f.yuv \
    --width 576 --height 324 --pixel_format 420 --bitdepth 8 --json --output /dev/stdout \
    | jq -c '[.backend_used, .pooled_metrics.vmaf.mean]'
done

On Windows with Docker Desktop, pass --device /dev/dxg -v /usr/lib/wsl:/usr/lib/wsl:ro instead of /dev/dri, and append :/usr/lib/wsl/lib to the image's LD_LIBRARY_PATH (see docs/development/docker-production.md).

Known follow-ups

• Not verified on a native Linux host or on an Arc A380. WSL 2 reaches the GPU through /dev/dxg and the host driver's /usr/lib/wsl/lib, which is not the i915/xe render-node path. The state row carries the copy-paste check for the maintainer's RTX 4090 + Arc A380 box.
• dev/Containerfile keeps its own NEO and Level Zero steps. They install the same package set through the same fetcher, but their RUNs are bound to the BuildKit-secret contract (ADR-1271) and check-workflow-versions.py, so moving them onto the installer is a separate change.
• The CI SYCL legs still add Intel's apt repository inline and build the Level Zero loader from source. install-intel-oneapi.sh and --components build could replace both.
• A recovery dispatch (ADR-1347) that builds a pre-rc.3 tag with this recipe cannot build the oneAPI image, because the old tags lack the installers and knobs. This was already true since ADR-1360 added install-intel-ocloc.sh.
• node-sycl (unpublished) builds libvmaf without SYCL, so the runtime it copies is unused. Unchanged here; the target builds with the new runtime stage.

🤖 Generated with Claude Code