doca-container-deployment

Deploy DOCA service containers on BlueField DPUs using kubelet standalone mode.

3.2k|370|Updated Feb 25, 2026
One-click install
npx skills add https://github.com/NVIDIA/skills --skill doca-container-deployment
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: doca-container-deployment
Source: https://github.com/NVIDIA/skills/tree/main/skills/doca-container-deployment
Command: npx skills add https://github.com/NVIDIA/skills --skill doca-container-deployment

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Deploying DOCA service containers (Argus, DMS, Firefly, UROM service) on a BlueField DPU involves a non-obvious runtime: a kubelet running in standalone mode watching a static-pod manifests directory, with no full Kubernetes control plane. This Skill guides agents through the correct deployment workflow and prevents common failures like invented image tags, wrong pod-spec fields, and misdiagnosed restart loops.

Core Features & Use Cases

  • Guided deployment workflow: Step-by-step configure, modify, run, test, and debug verbs for dropping YAML pod specs into the documented static-pod manifests directory on the BlueField Arm.
  • Eight-layer error taxonomy: Diagnose failures across pod-spec syntax, scheduling, image pull, container runtime, volume mounts, network policy, version mismatch, and host layers.
  • Smoke-before-bulk safety policy: Verify pod Running state, clean ENTRYPOINT logs, and per-service liveness signals before putting the BlueField under real workload.
  • Use Case: An operator drops a Firefly pod-spec YAML onto a BlueField but the pod is stuck in ImagePullBackOff; the Skill walks the layered debug ladder to confirm the NGC image string, tag, and nvcr.io reachability.

Quick Start

Ask your agent to deploy the DMS container on my BlueField and verify the service is healthy before sending gNMI traffic.

Frequently Asked Questions about doca-container-deployment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy a DOCA service container on a BlueField DPU?

Drop a YAML pod spec into the documented static-pod manifests directory on the BlueField Arm, where a standalone kubelet watches and schedules it. Quote the pod-spec shape, image string, and tag from the public DOCA Container Deployment Guide and the per-service guide rather than inventing them.

Why is my DOCA service pod stuck in ImagePullBackOff?

ImagePullBackOff is a layer-3 image-pull failure: the image string or tag may be wrong, or the BlueField cannot reach nvcr.io due to a proxy, firewall, or air-gap. Re-quote the image from the per-service public guide and verify NGC reachability independently of the pod.

Does DOCA container deployment use a full Kubernetes cluster?

No. The BlueField runs kubelet in standalone mode with no cluster API server, scheduler, or etcd, so kubectl against a cluster does not apply. The operator's unit of input is a YAML pod-spec file placed in the documented static-pod manifests directory.

Which DOCA services does this container deployment pattern support?

The shared runtime covers the four in-bundle services: Argus, DMS, Firefly, and UROM service, each with a per-service skill supplying its config schema and liveness signal. External NVIDIA services like BlueMan, HBN, SNAP, and Virtio-net are out of scope and route to public NVIDIA docs.

Should I let kubelet keep restarting a crashed DOCA service pod?

No. A pod that crashes twice with the same exit signature is high-stakes: stop the retry loop, read the container's full ENTRYPOINT log, and walk the layered error taxonomy to clear the root cause before re-enabling scheduling.

How do I verify a DOCA service container is actually ready for workload?

Run the smoke-before-bulk sequence: confirm the pod is Running with stable restart count, the ENTRYPOINT log shows clean config parsing and bring-up lines, and the per-service liveness signal is healthy. Pod Running alone does not prove the service inside is ready.