Resolving dynamic linker failures like libcublas.so.12 in containerized AI inference typically forces an unpalatable trade-off: bundle hundreds of un-cached C++ derivations via blanket CUDA flags, or accept opaque, non-reproducible container base images. Decoupling runtime user-space shared libraries from downstream compile-time toolchains in Nixpkgs eliminated dynamic linker aborts while dropping CI pipeline runtimes from 21m 54s to 2m 23s.

Executive Telemetry & Verification Proofs

Local Runner Emulation (act)

• act -j build-and-validate --container-architecture linux/amd64: success
• nix build .#dockerImage (cold assembly): 9m 24s
• docker load < result: 54s
• docker run --rm faster-whisper:latest: 612ms

Remote GitHub Actions Telemetry

• GitHub Actions Run #35459761178 (job 105941397356): 8m 59s
• GitHub Actions Run #35460471844 (Cold): 21m 54s
• GitHub Actions Run #35461703995 (Cached): 2m 23s

Symptoms, Root Causes and Remediations

• Symptom: Library libcublas.so.12 is not found or cannot be loaded | Root Cause: Imperative host-dependent dynamic link resolution across Python virtualenv boundaries | Remediation: Package pkgs.cudaPackages.libcublas directly into layered image runtime closure with explicit LD_LIBRARY_PATH entrypoint injection
• Symptom: error: sphinx-9.1.0 not supported for interpreter python3.11 | Root Cause: python311Packages evaluation triggering unsupported documentation dependency in pyopenssl -> trustme -> anyio chain | Remediation: Pin package set derivation to default python3Packages (Python 3.13)
• Symptom: Local compilation of magma and opencv triggered during container packaging | Root Cause: Top-level cudaSupport = true configuration invalidating Hydra binary cache substituters on nixpkgs-unstable | Remediation: Remove global cudaSupport = true and consume pre-built binary store paths directly via pkgs.cudaPackages.* under allowUnfree = true

Implementation Artifacts

 nixpkgs.legacyPackages.${system} = import nixpkgs {
   inherit system;
   config = {
     allowUnfree = true;
-    cudaSupport = true;
   };
 };

-pythonEnv = pkgs.python311.withPackages (ps: with ps; [ pip setuptools wheel pytest virtualenv ]);
+pythonEnv = pkgs.python3.withPackages (ps: [
+  (ps.buildPythonPackage {
+    pname = "faster-whisper";
+    version = "1.2.1";
+    src = ./.;
+    propagatedBuildInputs = with ps; [
+      ctranslate2
+      huggingface-hub
+      tokenizers
+      onnxruntime
+      av
+      tqdm
+    ];
+  })
+]);

 runtimeLibs = [
   pkgs.stdenv.cc.cc.lib
   pkgs.zlib
   pkgs.ffmpeg-headless
   pkgs.libsndfile
+  pkgs.cudaPackages.cudatoolkit
+  pkgs.cudaPackages.cudnn
+  pkgs.cudaPackages.libcublas
+  pkgs.cudaPackages.libcufft
+  pkgs.cudaPackages.libcurand
 ];

Platform Rules of Engagement

• Prohibit blanket cudaSupport = true in nixpkgs configurations.
• Require allowUnfree = true targeting individual pkgs.cudaPackages.* to maintain Hydra substitutability.
• Evaluate derivations via nix eval and ephemeral devShells before invoking container serializers.
• Prohibit nix build .#dockerImage as an iterative debugging command.
• Halt execution if Hydra binary substitution drops and local compilation of upstream C/C++ dependencies begins.

Local Reproduction Sequence

# Ensure .gitignore does not untrack flake.nix, source code, or required assets.
git add -N .
nix flake check
nix eval .#dockerImage.drvPath
nix develop --command python3 -c "import faster_whisper; print('Import OK:', faster_whisper.__file__)"
nix build .#dockerImage --dry-run
nix build .#dockerImage
docker load < result
docker run --rm faster-whisper:latest
act -j build-and-validate --container-architecture linux/amd64
gh repo set-default ajgreengrove/faster-whisper-ci-poc
gh run watch 35461703995

Reproduction Repository & Iteration Economics

A 19-minute delta on CI runs is rarely just a compute billing problem—it is a compounding tax on engineering focus, deployment frequency, and debugging cycles. Decoupling CUDA library ingestion from compilation inputs protects binary substituter cache hits while keeping container closures mathematically deterministic.

• Reproduction Repository: github.com/ajgreengrove/faster-whisper-ci-poc
• Verified CI Execution: Workflow Run #35461703995 (2m 23s completed runtime)
• Inquiries & Architecture Advisory: contact@ajgreengrove.com