fix: register all nvidia pip lib dirs with ldconfig; improve GPU warnings

The static LD_LIBRARY_PATH only covered cudnn and cuda_runtime — missing
cublas, cufft, curand, cusolver, cusparse, nvjitlink, etc. onnxruntime-gpu
needs libcublasLt.so at minimum, so GPU mode silently fell back to CPU.
Replace with a one-shot ldconfig call over every nvidia site-packages lib/
dir, which covers all packages regardless of what gets installed.

Also: remove the ambiguous directory="" from preload_dlls (use auto-search
default) and add a clear warning when CUDAExecutionProvider is absent so
the user sees actionable guidance instead of silent CPU fallback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -72,10 +72,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 COPY --from=build /app /app
 COPY --from=build /usr/local/bin/uv /usr/local/bin/uv
 
-# Expose CUDA/cuDNN libraries from pip packages so onnxruntime-gpu can find
-# libcublasLt.so.12 and libcudnn.so.9 at runtime (amd64-gpu only).
-# On cpu builds these paths don't exist; non-existent entries are ignored.
-ENV LD_LIBRARY_PATH="/app/.venv/lib/python3.13/site-packages/nvidia/cudnn/lib:/app/.venv/lib/python3.13/site-packages/nvidia/cuda_runtime/lib:${LD_LIBRARY_PATH}"
+# Register every nvidia pip-package lib/ directory with ldconfig so that
+# onnxruntime-gpu and torch can find libcudnn, libcublas, libcufft, etc.
+# without a hand-maintained LD_LIBRARY_PATH. Skipped silently on cpu builds.
+RUN find /app/.venv/lib/python3.13/site-packages/nvidia -type d -name "lib" \
+        2>/dev/null > /etc/ld.so.conf.d/nvidia-pip.conf && ldconfig || true
 
 RUN groupadd -g 568 apps && useradd -u 568 -g apps -m -s /bin/bash appuser \
     && mkdir -p /models/.insightface /models/huggingface \

winnow/embeddings.py

@@ -55,18 +55,14 @@ def _preload_cuda_libs() -> None:
     """Preload CUDA/cuDNN DLLs so onnxruntime-gpu registers CUDAExecutionProvider.
 
     Starting with onnxruntime-gpu 1.19+, CUDA/cuDNN libraries are no longer
-    bundled inside the ORT package. They must be loaded from the nvidia-*
-    pip packages (nvidia-cuda-runtime-cu12, nvidia-cudnn-cu12) before any
-    InferenceSession is created.
-
-    Calling preload_dlls() with directory="" searches NVIDIA site-packages
-    directories automatically.
+    bundled inside the ORT package — they come from the nvidia-* pip packages.
+    preload_dlls() locates them automatically via site-packages discovery.
     """
     try:
         import onnxruntime
         if hasattr(onnxruntime, "preload_dlls"):
-            onnxruntime.preload_dlls(cuda=True, cudnn=True, directory="")
-            logger.info("Preloaded CUDA/cuDNN DLLs for onnxruntime-gpu")
+            onnxruntime.preload_dlls(cuda=True, cudnn=True)
+            logger.debug("Preloaded CUDA/cuDNN DLLs for onnxruntime-gpu")
         else:
             logger.debug("onnxruntime.preload_dlls() not available (ORT < 1.21)")
     except Exception as e:
@@ -104,7 +100,15 @@ def get_insightface_app():
             "MPSExecutionProvider",
             "CoreMLExecutionProvider",
         }
-        ctx_id = -1 if _is_force_cpu() else (0 if gpu_providers & set(providers) else -1)
+        has_gpu_provider = bool(gpu_providers & set(providers))
+        ctx_id = -1 if _is_force_cpu() else (0 if has_gpu_provider else -1)
+
+        if not has_gpu_provider and not _is_force_cpu():
+            logger.warning(
+                "No GPU execution provider found — running InsightFace on CPU. "
+                "If you have an NVIDIA GPU, ensure the NVIDIA Container Toolkit is "
+                "installed and the container has GPU access (deploy.resources in compose)."
+            )
 
         device_str = "GPU" if ctx_id >= 0 else "CPU"
         logger.info(f"Loading InsightFace Buffalo_L on {device_str} (ctx_id={ctx_id})...")