fix(multimodal): own NVDEC frame memory and CUDA-gate PyNvVideoCodec in the SGLang image (OPS-8040)

components/src/dynamo/common/multimodal/nvdec_decoder.py

@@ -156,22 +156,24 @@ def _gpu_id() -> int:
 
 
 def _frame_to_rgb_hwc(frame) -> np.ndarray:
-    """Copy a decoded (device) RGB frame to a host ``(H, W, 3)`` uint8 array.
-
-    A 2.x ``DecodedFrame`` (``output_color_type=RGB``) holds a CUDA buffer and
-    supports the DLPack protocol, so torch wraps it zero-copy on the GPU and
-    ``.cpu()`` copies to host. Validated on PyNvVideoCodec 2.1.1 for H.264/H.265.
+    """Copy a decoded RGB frame into an owned host ``(H, W, 3)`` uint8 array.
+
+    A 2.x ``DecodedFrame`` (``output_color_type=RGB``) supports the DLPack
+    protocol, so torch wraps its buffer zero-copy. The decoder is constructed
+    with ``use_device_memory=False``, so that buffer is already host memory:
+    ``.cpu()`` is a no-op and ``.numpy()`` would keep aliasing decoder-owned
+    memory, which the decoder is free to recycle for the next indexed read.
+    The explicit ``np.array(..., copy=True)`` is what guarantees every
+    collected frame owns its pixels (and normalizes dtype in the same step).
+    Validated on PyNvVideoCodec 2.1.1 for H.264/H.265.
     """
     import torch
 
     try:
         tensor = torch.from_dlpack(frame)
     except Exception:  # noqa: BLE001 - fall back to the CUDA-array-interface path
         tensor = torch.as_tensor(frame, device="cuda")
-    arr = tensor.cpu().numpy()
-    if arr.dtype != np.uint8:
-        arr = arr.astype(np.uint8)
-    return arr
+    return np.array(tensor.cpu().numpy(), dtype=np.uint8, copy=True)
 
 
 def _source_fps(decoder) -> float:

components/src/dynamo/common/tests/multimodal/test_nvdec_decoder.py

@@ -163,6 +163,23 @@ def test_should_use_nvdec_false_when_unavailable(monkeypatch):
     assert nd.should_use_nvdec("h264") is False
 
 
+def test_frame_to_rgb_hwc_copies_out_of_decoder_memory():
+    """The decoder hands over host frames (``use_device_memory=False``) and is
+    free to recycle the underlying buffer between indexed reads, so the
+    conversion must copy. numpy arrays export DLPack exactly like a
+    ``DecodedFrame`` does: without the copy, torch wraps the buffer zero-copy
+    and mutating the source would corrupt the already-collected frame.
+    """
+    source = np.full((4, 6, 3), 7, dtype=np.uint8)
+
+    converted = nd._frame_to_rgb_hwc(source)
+    source[:] = 99  # the decoder reuses its buffer for the next frame
+
+    assert converted.dtype == np.uint8
+    assert converted.shape == (4, 6, 3)
+    np.testing.assert_array_equal(converted, np.full((4, 6, 3), 7, dtype=np.uint8))
+
+
 def test_decode_matches_frame_contract(monkeypatch):
     monkeypatch.setitem(
         sys.modules, "PyNvVideoCodec", _fake_pynv(num_frames=10, h=4, w=6)

container/templates/sglang_runtime.Dockerfile

@@ -139,11 +139,29 @@ RUN --mount=type=bind,source=./container/deps/requirements.common.txt,target=/tm
 # Install SGLang-specific runtime dependencies without changing the upstream
 # dependency solution. imageio-ffmpeg is installed from source (no bundled
 # binary) for the VP9 video-encode path; see requirements.sglang.txt.
+{% if device == "cuda" %}
 RUN --mount=type=bind,source=./container/deps/requirements.sglang.txt,target=/tmp/requirements.sglang.txt \
     --mount=type=cache,target=/root/.cache/pip,sharing=locked \
     export PIP_CACHE_DIR=/root/.cache/pip && \
     pip install --break-system-packages --force-reinstall --no-deps \
         --requirement /tmp/requirements.sglang.txt
+{% else %}
+# PyNvVideoCodec decodes on NVDEC through libnvcuvid, so it is inert on a
+# non-NVIDIA device. Drop it from the shared requirements rather than ship an
+# unusable NVIDIA codec wheel in the Intel XPU image. The pattern is anchored
+# to the line start so it cannot match inside another requirement, and the
+# import check fails the build if the package arrives by another route -- a
+# filter that silently stopped matching would otherwise look like success.
+# Whole-RUN branches rather than a conditional inside one RUN, for the reasons
+# documented at the equivalent block in vllm_runtime.Dockerfile.
+RUN --mount=type=bind,source=./container/deps/requirements.sglang.txt,target=/tmp/requirements.sglang.txt \
+    --mount=type=cache,target=/root/.cache/pip,sharing=locked \
+    export PIP_CACHE_DIR=/root/.cache/pip && \
+    grep -v '^PyNvVideoCodec' /tmp/requirements.sglang.txt > /tmp/requirements.sglang.nonvidia.txt && \
+    pip install --break-system-packages --force-reinstall --no-deps \
+        --requirement /tmp/requirements.sglang.nonvidia.txt && \
+    ! python3 -c "import PyNvVideoCodec" 2>/dev/null
+{% endif %}
 
 # Remove the codec-bearing video-DECODE components from the upstream SGLang image
 # (PyAV, decord, OpenCV, torchcodec + any base ffmpeg/libav*), then copy the