From fa9609d65918f21ad7ad57ae3da4109df444ff53 Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Sun, 24 May 2026 12:16:49 +0000
Subject: [PATCH] Dockerfile: arm64 install cu13 nvrtc/nvcc directly without
 cuda-keyring deb

The nvidia/cuda base image already registers the CUDA apt repo with its own
Signed-By keyring. Installing cuda-keyring_1.1-1_all.deb on top adds a
duplicate sources entry with a different Signed-By value, which makes
`apt-get update` refuse the entire repo:

  E: Conflicting values set for option Signed-By regarding source
  https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/

The repo URL is monolithic (every CUDA version is served from the same
path), so we can install cuda-nvrtc-13-0 + cuda-nvcc-13-0 directly without
touching the keyring. Empirically reproduced on the ubuntu-24.04-arm
GitHub Actions runner (staging-fork CI run 26360461375); fix verified via
the same staging-fork after force-push.
---
 docker/Dockerfile | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 8839b7a552..2b557345ea 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -313,12 +313,16 @@ COPY --from=builder /opt/unsloth-venv /opt/unsloth-venv
 # extra ~400 MB would be dead weight.
 RUN if [ "${TARGETARCH:-amd64}" = "arm64" ]; then \
         set -eux; \
-        # SBSA = Server Base System Architecture; the NVIDIA repo path for
-        # Grace / GH200 / GB200 / DGX Spark aarch64 hosts.
-        curl -fsSL "https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/sbsa/cuda-keyring_1.1-1_all.deb" \
-             -o /tmp/cuda-keyring.deb; \
-        dpkg -i /tmp/cuda-keyring.deb; \
-        rm /tmp/cuda-keyring.deb; \
+        # The nvidia/cuda base already configures the CUDA apt repo
+        # (sbsa for arm64) with its own Signed-By keyring at
+        # /usr/share/keyrings/cuda-archive-keyring.gpg. Installing
+        # cuda-keyring_1.1-1_all.deb on top adds a second sources file
+        # with a different Signed-By, which makes `apt-get update` refuse
+        # the entire repo ("Conflicting values set for option Signed-By").
+        # The base's repo URL is monolithic and serves every CUDA version
+        # including 13.x, so we install cu13 packages directly without
+        # touching the keyring at all. Empirically verified on the
+        # ubuntu-24.04-arm GitHub Actions runner.
         apt-get update; \
         apt-get install -y --no-install-recommends \
             cuda-nvrtc-13-0 \