@Override
  public List<PrivilegedOperation> preStart(Container container)
      throws ResourceHandlerException {
    // 1. Get requested FPGA type and count, choose corresponding FPGA plugin(s)
    // 2. Use allocator.assignFpga(type, count) to get FPGAAllocation
    // 3. If required, download to ensure IP file exists and configure IP file for all devices
    List<PrivilegedOperation> ret = new ArrayList<>();
    String containerIdStr = container.getContainerId().toString();
    Resource requestedResource = container.getResource();

    // Create device cgroups for the container
    cGroupsHandler.createCGroup(CGroupsHandler.CGroupController.DEVICES,
      containerIdStr);

    long deviceCount = requestedResource.getResourceValue(FPGA_URI);
    LOG.info(containerIdStr + " requested " + deviceCount + " Intel FPGA(s)");
    String ipFilePath = null;
    try {

      // allocate even request 0 FPGA because we need to deny all device numbers for this container
      final String requestedIPID = getRequestedIPID(container);
      String localizedIPIDHash = null;
      ipFilePath = vendorPlugin.retrieveIPfilePath(
          requestedIPID, container.getWorkDir(),
          container.getResourceSet().getLocalizedResources());
      if (ipFilePath != null) {
        try (FileInputStream fis = new FileInputStream(ipFilePath)) {
          localizedIPIDHash = DigestUtils.sha256Hex(fis);
        } catch (IOException e) {
          throw new ResourceHandlerException("Could not calculate SHA-256", e);
        }
      }

      FpgaResourceAllocator.FpgaAllocation allocation = allocator.assignFpga(
          vendorPlugin.getFpgaType(), deviceCount,
          container, localizedIPIDHash);
      LOG.info("FpgaAllocation:" + allocation);

      PrivilegedOperation privilegedOperation =
          new PrivilegedOperation(PrivilegedOperation.OperationType.FPGA,
          Arrays.asList(CONTAINER_ID_CLI_OPTION, containerIdStr));
      if (!allocation.getDenied().isEmpty()) {
        List<Integer> denied = new ArrayList<>();
        allocation.getDenied().forEach(device -> denied.add(device.getMinor()));
        privilegedOperation.appendArgs(Arrays.asList(EXCLUDED_FPGAS_CLI_OPTION,
            StringUtils.join(",", denied)));
      }
      privilegedOperationExecutor.executePrivilegedOperation(
          privilegedOperation, true);

      if (deviceCount > 0) {
        /**
         * We only support flashing one IP for all devices now. If user don't set this
         * environment variable, we assume that user's application can find the IP file by
         * itself.
         * Note that the IP downloading and reprogramming in advance in YARN is not necessary because
         * the OpenCL application may find the IP file and reprogram device on the fly. But YARN do this
         * for the containers will achieve the quickest reprogram path
         *
         * For instance, REQUESTED_FPGA_IP_ID = "matrix_mul" will make all devices
         * programmed with matrix multiplication IP
         *
         * In the future, we may support "matrix_mul:1,gzip:2" format to support different IP
         * for different devices
         *
         * */
        ipFilePath = vendorPlugin.retrieveIPfilePath(
            getRequestedIPID(container),
            container.getWorkDir(),
            container.getResourceSet().getLocalizedResources());
        if (ipFilePath == null) {
          LOG.warn("FPGA plugin failed to downloaded IP, please check the" +
              " value of environment viable: " + REQUEST_FPGA_IP_ID_KEY +
              " if you want YARN to program the device");
        } else {
          LOG.info("IP file path:" + ipFilePath);
          List<FpgaDevice> allowed = allocation.getAllowed();
          String majorMinorNumber;
          for (int i = 0; i < allowed.size(); i++) {
            FpgaDevice device = allowed.get(i);
            majorMinorNumber = device.getMajor() + ":" + device.getMinor();
            String currentHash = allowed.get(i).getAocxHash();
            if (currentHash != null &&
                currentHash.equalsIgnoreCase(localizedIPIDHash)) {
              LOG.info("IP already in device \""
                  + allowed.get(i).getAliasDevName() + "," +
                  majorMinorNumber + "\", skip reprogramming");
              continue;
            }
            if (vendorPlugin.configureIP(ipFilePath, device)) {
              // update the allocator that we update an IP of a device
              allocator.updateFpga(containerIdStr, allowed.get(i),
                  requestedIPID, localizedIPIDHash);
              //TODO: update the node constraint label
            }
          }
        }
      }
    } catch (ResourceHandlerException re) {
      allocator.cleanupAssignFpgas(containerIdStr);
      cGroupsHandler.deleteCGroup(CGroupsHandler.CGroupController.DEVICES,
          containerIdStr);
      throw re;
    } catch (PrivilegedOperationException e) {
      allocator.cleanupAssignFpgas(containerIdStr);
      cGroupsHandler.deleteCGroup(CGroupsHandler.CGroupController.DEVICES,
          containerIdStr);
      LOG.warn("Could not update cgroup for container", e);
      throw new ResourceHandlerException(e);
    }
    //isolation operation
    ret.add(new PrivilegedOperation(
        PrivilegedOperation.OperationType.ADD_PID_TO_CGROUP,
        PrivilegedOperation.CGROUP_ARG_PREFIX
        + cGroupsHandler.getPathForCGroupTasks(
        CGroupsHandler.CGroupController.DEVICES, containerIdStr)));
    return ret;
  }
@Test
  public void testSha256CalculationFails() throws ResourceHandlerException {
    expected.expect(ResourceHandlerException.class);
    expected.expectMessage("Could not calculate SHA-256");

    dummyAocx.delete();
    fpgaResourceHandler.preStart(mockContainer(0, 1, "GEMM"));
  }