[Syakyr]

What this is

A deployable Intel Arc container image, and the one thing the Intel port needed to make that possible: a way to run
the SYCL engine without a Docker daemon inside the container.

The port's existing runtime is docker-in-docker. sycl/serve/strata-sycl.sh starts the engine with docker run
inside the strata-sycl-dev image, with the folder above the checkout mounted at /work. That is the right shape
for a host install where only the engine needs oneAPI. It is the wrong shape for an image you ship: you cannot nest
it. This branch adds the other shape — engine, oneAPI runtime and Arc compute runtime in one image, the GPU coming
in through --device /dev/dri.

Target hardware: Intel Arc Pro B60 (24 GB), single or dual, per Niko1221#870 and
bench/results/2026-10-04-community-2x-arc-pro-b60.

This branch includes someone else's work - please read before reviewing

The SYCL port at 0.1.40 does not build as shipped. This PR did not introduce that; it is reported upstream:

• #1113 - sycl: the v0.1.40.1 port does not build as
  shipped (3 compile errors, 12 undefined symbols)
• #1248 - the same two errors on an Arc A770, same commit

Upstream main has no CI at all (no .github/workflows directory), so the port is never compiled before release
and has drifted from the shared headers every cycle - Niko1221#784 did this same job for 0.1.39.

So this branch merges PR #1111 "Intel arc 0.1.40" by
@maxfridbe (merge commit e4db92e, 19 commits). That PR re-migrates the port with dpct and 3-way merges it
against 5047172, the commit it was migrated from: 175 conflicts resolved, three files hand-ported
(verify.cpp, mtp.cpp, native_expert_parity.cpp), and dpct's mistranslations documented in docs/INTEL.md.

The port refresh is maxfridbe's, not ours. We are the ones who needed it, not the ones who made it. If you are
reviewing this PR: the port-correctness review belongs on Niko1221#1111. What is ours is the Docker packaging, the native
run mode, the workflow and the docs.

Conflict resolution in that merge: the only two conflicts were sycl/src/core/expert_source.cpp and
sycl/src/kernels/cuda/fused_gr.dp.cpp - the two files this branch had hand-patched to get past the first errors
before Niko1221#1111 was found. We took theirs in both, because their re-migration supersedes our stopgap signature
edits. Verified after the merge: fused_gr_read_multi is bool (matches fused_gr.hpp:59) and
load_experts_gguf takes the header's 6th const std::atomic<int>* ready parameter. sycl/setup_intel.py
auto-merged with this branch's native-mode changes intact.

Changes

sycl/setup_intel.py — native mode. STRATA_SYCL_NATIVE=1 runs the engine in the current process' own
environment: it skips the docker/image checks, uses paths as they are instead of remapping them to /work, and
makes the config's exe the native wrapper. STRATA_INTEL_GPUS="Arc Pro B60:24,Arc Pro B60:24" names the cards
without sysfs — for a container that does not show the host's /sys/class/drm, and for CI, which has no Arc at
all. The default (docker) path is unchanged; that is regression-tested.

sycl/serve/strata-native.sh — the exe for that mode. Sets the port's runtime defaults from
docs/INTEL.md (SYCL_CACHE_PERSISTENT=0, ZES_ENABLE_SYSMAN=1, ONEAPI_DEVICE_SELECTOR=level_zero:*) without
clobbering anything the config set, and execs STRATA_SYCL_BIN.

Dockerfile.arc — two stages.

• Builder: oneAPI compiler + MKL + ocloc, builds only the strata target (STRATA_SYCL_PARITY=OFF — the
  kernel tests run on a card and the card is not there), AOT for bmg-g21. No GPU needed: ocloc
  cross-compiles on the CPU.
• Runtime: oneAPI runtime + Arc compute runtime, engine copied in.

The compiler packages come from Intel's oneAPI apt repo. ocloc and the compute runtime are not in that repo
and come from the kobuk-team/intel-graphics
PPA that Intel's client-GPU guide points at. Neither oneAPI runtime package writes an ld.so.conf.d entry, so the
image writes one from the trees that actually got installed, and then fails the build if any shared object the
engine needs does not resolve.

docker-entrypoint-arc.sh — setup on first start, serve after. It relinks the persisted config on every
start rather than only when /opt/strata has none. See the note on Niko1221#1244 below.

sycl/tools/test_arc_image.py — the checks a machine with no Intel GPU can answer. Runs in CI, and can be run
on the card before trusting the image:

docker run --rm ghcr.io/syakyr/strata-arc:0.1.40-bmg-g21 .venv/bin/python sycl/tools/test_arc_image.py

docs/ARC_DOCKER.md — host requirements, the env reference, the AOT choice, troubleshooting. Plus pointers
from docs/INTEL_ARC.md.

Relation to Niko1221#870

Niko1221#870 is the first B60 report, and its four fixes are already in 0.1.40 — checked against this checkout:

Niko1221#870 fix	state here
e211 → ("Arc Pro B60", 24.0) in INTEL_ARC	present (sycl/setup_intel.py:58)
ThreadAffinity for SessionLoopScratch::pinned_core (Niko1221#626 drift)	present
NativeDense::load layer range (Niko1221#559 drift)	present
write_run_script takes 4 args	present (sycl/setup_intel.py:278)

So this branch adds nothing to those. What it does take from Niko1221#870 is the device-selector gotcha: that report's
box had a B60 and a B580, and setup's config "gpu": 1 never reaches the SYCL path, so the engine had to be
pinned by hand with ONEAPI_DEVICE_SELECTOR=level_zero:1. The image pins ONEAPI_DEVICE_SELECTOR=level_zero:*
instead, so a two-card host sees both cards without the user knowing the bus order.

Two other things worth carrying over from that report for B60 owners: 31 tok/s at setup's defaults, 33–36 tok/s
with the expert-cache/reserve tuning, and roughly 2 tok/s per GiB of expert set removed from the PCIe mirror —
sharper than the B70 numbers in docs/INTEL.md suggest, and the reason a 24 GB card is worth tuning for.

And Niko1221#1244, which this branch avoids rather than fixes

Niko1221#1244 is a live bug in the existing docker-entrypoint.sh: the persisted config is linked in only when
/opt/strata/strata-$tag.json is absent, so a regular file left there by an earlier setup pass survives
docker restart, the test is true, and edits to /data/config/strata-*.json are silently ignored.

I wrote that same line in the ARC entrypoint at first. It is fixed here — the ARC entrypoint relinks every start, and
adopts a pre-/data/config config if the volume copy is empty. The NVIDIA entrypoint still has the bug upstream;
that fix is split out separately so it can go in on its own.

What is verified, and what is not

Verified against the live repositories (2026-10-07): the oneAPI compiler/runtime/MKL versions; that ocloc and the
compute runtime are absent from the oneAPI repo and present in the PPA; that the PPA's intel-ocloc installs
ocloc-26.31.1 and links /usr/bin/ocloc through update-alternatives in postinst (so icpx's PATH lookup
works); that the SYCL runtime lands libsycl.so.9 + the UR Level Zero adapters in
/opt/intel/oneapi/compiler/2026.1/lib, the MKL runtime lands libmkl_sycl_blas.so.6 in
/opt/intel/oneapi/redist/lib, and neither writes an ld.so.conf.d entry.

Verified by running: the native-mode config transform (drops --resident-experts/--mmap-experts/--kv-resident,
emits the native wrapper and STRATA_SYCL_BIN, 128K context → --prefill 4096 and a 2048 MiB reserve); the
default docker path unchanged (regression test); the wrapper execs the engine and fails loudly on a bad binary;
the card list resolves from STRATA_INTEL_GPUS; the workflow YAML parses; shell syntax on both scripts.

Not verified: this image has never run on an Arc. There is no Docker in the environment
it was written in and no Intel GPU anywhere near it. The first build is the CI run on this branch; the first run on
a card is the next step. Build status: green, and published. ghcr.io/syakyr/strata-arc:0.1.40-bmg-g21 — 3.11 GB, manifest
digest sha256:d151e31c3cc59522f50c2537386d493a71847c9c47824db24c99b3c110ac1194, package visibility
public. Pushed via workflow_dispatch with push=true (run 37596190347, 24m43s - the extra time over the
12 min PR build is the image upload). Every check passes: engine compiles and links, every shared object
resolves, the device-free suite reports all checks passed, and the entrypoint's no-GPU guard fires correctly.

Note the latest tag is deliberately not applied - the workflow only adds it on a tag ref, not a branch
dispatch. Pull the version string explicitly.

Seven failures stood between the first attempt and that, and all seven were ours, not the port's:

failure	what it actually was
uppercase owner in the GHCR tag	github.repository_owner keeps its case; GHCR rejects it
guard job failing main red	a routine push should skip, not fail - split into its own job
ld.so.conf step died before ldconfig	[ -d "$d" ] && ... in a for returns 1 on a missed glob, killing the && chain
--help assumed device-free	the engine builds its SYCL context before printing usage
wrapper test asserted the engine's exit code	it was testing path resolution; now uses a stub and pins the resolved path
smoke step missing STRATA_INTEL_GPUS	the test's own guard fired correctly; the step just did not pass the flag
the entrypoint ignored its arguments	ENTRYPOINT with no CMD, so docker run IMAGE <cmd> discarded <cmd>

The last one cost ten minutes and a 29 GB model download before it was noticed: the smoke step asked for
test_arc_image.py and instead got the full setup-and-serve flow. The entrypoint now execs passed args, placed
before the GPU guard so a shell is available in a card-less container - which is exactly what you need when
debugging one.

The performance numbers quoted above are the community's, measured without Docker — a
container adds a --device passthrough and nothing else on the GPU path, but nobody has put a stopwatch on that.

Build / run

# registered on main so workflow_dispatch works; build from this branch:
gh workflow run docker-arc.yml --repo Syakyr/Strata --ref arc-docker -f aot=bmg-g21 -f push=true

# or locally
docker build -f Dockerfile.arc -t strata-arc .

# single B60
docker run --rm --device /dev/dri -p 8080:8080 -v strata-arc-data:/data \
  -e MODEL=IQ2_XS -e CONTEXT=32768 strata-arc

# two B60s, one model
docker run --rm --device /dev/dri -p 8080:8080 -v strata-arc-data:/data \
  -e MODEL=IQ1_M -e GPUS=all -e LAYER_SPLIT=24 strata-arc

The host kernel is the one thing the image cannot ship: Battlemage needs the kernel's xe driver, which on Ubuntu
24.04 means the HWE kernel. The image carries the userspace compute runtime and nothing else about the driver.

Note the image deliberately does not set STRATA_VERIFY_NO_HOST=1: it is only valid when every expert is
VRAM-resident, and on a card that mirrors part of them in RAM that is the path that has hung.