nvidia-docker: wrapProgram to pickup needed runc executable

nixos/modules/virtualisation/podman.nix

@@ -2,6 +2,7 @@
 let
   cfg = config.virtualisation.podman;
   toml = pkgs.formats.toml { };
+  nvidia-docker = pkgs.nvidia-docker.override { containerRuntimePath = "${pkgs.runc}/bin/runc"; };
 
   inherit (lib) mkOption types;
 
@@ -99,8 +100,8 @@ in
         containersConf.extraConfig = lib.optionalString cfg.enableNvidia
           (builtins.readFile (toml.generate "podman.nvidia.containers.conf" {
             engine = {
-              conmon_env_vars = [ "PATH=${lib.makeBinPath [ pkgs.nvidia-docker ]}" ];
-              runtimes.nvidia = [ "${pkgs.nvidia-docker}/bin/nvidia-container-runtime" ];
+              conmon_env_vars = [ "PATH=${lib.makeBinPath [ nvidia-docker ]}" ];
+              runtimes.nvidia = [ "${nvidia-docker}/bin/nvidia-container-runtime" ];
             };
           }));
       };
@@ -117,7 +118,7 @@ in
       ];
     }
     (lib.mkIf cfg.enableNvidia {
-      environment.etc."nvidia-container-runtime/config.toml".source = "${pkgs.nvidia-docker}/etc/podman-config.toml";
+      environment.etc."nvidia-container-runtime/config.toml".source = "${nvidia-docker}/etc/podman-config.toml";
     })
   ]);
 }

pkgs/applications/virtualization/nvidia-docker/default.nix

@@ -6,12 +6,20 @@
 , makeWrapper
 , buildGoModule
 , buildGoPackage
-, git
 , glibc
+, docker
+, linkFarm
+, containerRuntimePath ? "${docker}/libexec/docker/runc"
 }:
 
 with lib; let
   libnvidia-container = callPackage ./libnvc.nix { };
+  isolatedContainerRuntimePath = linkFarm "isolated_container_runtime_path" [
+    {
+      name = "runc";
+      path = containerRuntimePath;
+    }
+  ];
 
   nvidia-container-runtime = buildGoPackage rec {
     pname = "nvidia-container-toolkit";
@@ -74,8 +82,13 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/{bin,etc}
     cp -r bin $out
+
     wrapProgram $out/bin/nvidia-container-cli \
       --prefix LD_LIBRARY_PATH : /run/opengl-driver/lib:/run/opengl-driver-32/lib
+
+    # nvidia-container-runtime invokes docker-runc or runc if that isn't available on PATH
+    wrapProgram $out/bin/nvidia-container-runtime --prefix PATH : ${isolatedContainerRuntimePath}
+
     cp ${./config.toml} $out/etc/config.toml
     substituteInPlace $out/etc/config.toml --subst-var-by glibcbin ${lib.getBin glibc}