A user wants to restrict a Docker container to use only GPUs 0 and 2. Which command achieves this?

The correct and modern method for restricting a Docker container to specific GPUs is by using the --gpus flag with a device filter. The syntax '"device=0,2"' explicitly instructs the NVIDIA Container Toolkit to expose only the GPUs with indices 0 and 2 to the container. This is the officially recommended approach as it is more declarative and integrates directly with the Docker runtime's device management capabilities. The double and single quotes are often used to ensure the shell correctly passes the string device=0,2 as a single argument to the --gpus flag.

B) Using the NVIDIAVISIBLEDEVICES environment variable is a legacy method; the --gpus flag is the current, preferred standard for GPU enumeration and isolation.

C) Manually mapping device files with --device is insecure, incomplete, and bypasses the NVIDIA Container Toolkit, likely resulting in a non-functional container.

D) --gpu-devices is not a valid command-line flag for the docker run command.

1. NVIDIA Container Toolkit Documentation. "User Guide", Section "Running a GPU Container". The documentation specifies the usage of the --gpus option. It provides the example docker run --rm --gpus '"device=0,1"' nvidia/cuda:11.0.3-base-ubuntu20.04 nvidia-smi to select specific GPUs by their index.

2. Docker Docs. "Runtime options with Memory, CPUs, and GPUs", Section "Configure GPU access". The official Docker documentation confirms that --gpus is the standard flag for controlling GPU access and describes the device request syntax, including selecting GPUs by index (device=ID).