·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 1. Review findings remaining: 7.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open |
1 finding
Use legate.io.hdf5 to read and write cuPyNumeric arrays as HDF5 files. Reach for it whenever a cuPyNumeric array must land in — or load from — an .h5/.hdf5 file: every rank reads and writes its own tile in parallel, so never funnel a large array through a single process.
Activate when the user asks about: saving a cuPyNumeric array to an .h5 / .hdf5 file, loading an HDF5 dataset into a cuPyNumeric array, reading a large HDF5 dataset in chunks, producing a single file for an HPC post-processing pipeline, or speeding up HDF5 disk I/O with GPUDirect Storage.
Redirect these requests elsewhere instead of reaching for legate.io.hdf5:
legate.io.hdf5 covers single-file HDF5 only..npz or pickled archives with NumPy (np.load), then bridge with cn.asarray(...) — legate.io.hdf5 reads HDF5 only, and cupynumeric.load reads single .npy only.with h5py.File(path, "r") as f: arr = f["dataset"][:].Install h5py before importing anything from legate.io.hdf5:
Expect from legate.io.hdf5 import ... to raise ModuleNotFoundError until you do — the module imports h5py at load time. (h5py · conda-forge build)
| Function | Signature | Purpose |
|---|---|---|
|
| Write a cuPyNumeric array / |
|
| Read one HDF5 dataset into a distributed array. |
|
| Read a dataset in chunks — chunks the file read, not the assembled array. |
Import all three from legate.io.hdf5. Always pass dataset_name as the full path to a single array inside the file (e.g. "/data" or "/group/x"), never a group.
Run assets/hdf5_roundtrip.py to verify (optional — not needed to answer).
Use from_file_batched to read the source file in chunks instead of pulling it into host memory all at once. It yields one LogicalArray per chunk plus that chunk's offsets in the global shape. Expect clipped boundary chunks (an axis of length 5 with chunk_size=2 yields 2, 2, 1), so place each chunk by its actual shape, not the requested chunk_size. Note that this chunks the file read, not the result — the assembled array (out) still has to fit in distributed memory:
Keep every chunk_size entry positive and its length equal to the dataset's rank, or from_file_batched raises ValueError. Run assets/hdf5_batched_read.py to verify (optional).
to_file - it implements __legate_data_interface__, which to_file accepts as LogicalArrayLike. Skip any np.array(...) round-trip.cn.asarray(...). from_file and each from_file_batched chunk return a Legate LogicalArray; wrap it with cn.asarray(la) to get a cuPyNumeric ndarray (zero-copy, no host bounce).to_file only queues the write. Insert get_legate_runtime().issue_execution_fence(block=True) before h5py, a subprocess, or another tool opens the file. Skip the fence for a from_file
issued later in the same Legate program — the runtime preserves that ordering.sys.path, so an in-tree cupynumeric/ directory shadows the installed package (ModuleNotFoundError: cupynumeric.install_info).path. The program runs on every rank (SPMD), so pass to_file/from_file an identical path on each — a per-rank tempfile.mkstemp() name breaks the collective I/O. When the program creates the file itself, write it with the collective to_file, not a per-rank h5py write.to_file behavior to plan aroundto_file as destructive — it overwrites path if it already exists, so guard any file you must not clobber.to_file create missing parent directories; do not pre-create them.path a file name (/path/to/file.h5), never a directory — a directory raises ValueError. Pass a bound array (one with a known shape); to_file raises ValueError on an unbound array — a Legate array created without a shape (e.g. create_array(dtype, ndim=n)) whose extent a producing task fills in later. cuPyNumeric ndarrays are always bound — even lazy/deferred ones — so this only affects raw LogicalArrays.Always set LEGATE_IO_USE_VFD_GDS=1 for runs that read HDF5 into GPU memory — whether or not the cluster has GPUDirect-capable storage:
=1 even without GPUDirect-capable storage — cuFile falls back to compatibility mode automatically (set export CUFILE_ALLOW_COMPAT_MODE=true if it is not already on), and =1 still avoids the ZCMEM abort.H5FD__gds_open: Successfully opened file w/GDS VFD.| Symptom | Cause and fix |
|---|---|
| h5py is missing — |
File looks empty/truncated to h5py right after | The async write hasn't landed — add |
|
|
| Running inside the source tree — (any directory outside the repo). |
Abort/crash reading a GPU array ≳128 MB | Default 128 MB ZCMEM staging buffer — set |
| Expected — wrap it with |
legate.io.hdf5 (Legate 26.01+); rewrite any legate.core.io.hdf5 import left over from the 25.03 line (e.g. the 25.03 launch blog still shows the old path).dataset_name at a single array, never a group; traverse groups with h5py first to discover dataset paths.LEGATE_IO_USE_VFD_GDS=1 (see GPUDirect Storage) — the default path aborts on GPU arrays larger than the 128 MB ZCMEM buffer. Leave it unset for CPU reads.Expect HDF5 ROUND TRIP OK and HDF5 BATCHED READ OK. Add --gpus 1 (and LEGATE_IO_USE_VFD_GDS=1) to exercise the GPU / GDS path.
Get started with chainctlchainctl skill install public/nvidia/cupynumeric-hdf5:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.chainreg.biz/public/github.com/nvidia/skills/cupynumeric-hdf5:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
assets/hdf5_batched_read.py
assets/hdf5_roundtrip.py
evals/evals.json
skill-card.md
skill.oms.sig