In modern Linux, being root does not necessarily mean having ultimate permissions. Capabilities mechanism provides more fine-grained control over permissions by breaking root's power in parts which may be granted/revoked to/from specific task individually, and Docker uses this mechanism.
By default, Docker drops many dangerous capabilities when it starts the containerized process, even if this process runs on behalf of root user. This is because the host kernel is shared between all containers and the host system, thus, some system calls from the privileged containerized process may reveal information about (your case) or even affect the "outer world". That is why you see "Permission denied" even while you run
dmesg(1) as root.
syslog(2) system call to obtain the kernel log. As per
man capabilities, this system call requires specific capability -
CAP_SYSLOG (since Linux 2.6.37)
* Perform privileged syslog(2) operations.
See syslog(2) for information on which operations require privilege.
This capability is dropped in Docker containers by default, so,
dmesg(1) in your container fails.
If you trust the vendor of the image, or just don't care a lot about security, you may start the container with additional capability (
docker run -it --cap-add syslog nvcr.io/nvidia/cuda:9.0-devel-ubuntu16.04
This will solve your issue.