fix: update train entrypoint script to allow insecure SSL connections

Author: zJuuu

docker/train_entrypoint.sh

@@ -35,7 +35,7 @@ if [[ -n "${_DRIVER_VERSION:-}" ]]; then
         mkdir -p "${_NVIDIA_CACHE}"
         _DRIVER_URL="https://us.download.nvidia.com/tesla/${_DRIVER_VERSION}/NVIDIA-Linux-x86_64-${_DRIVER_VERSION}.run"
         _DRIVER_RUN="/tmp/nvidia-${_DRIVER_VERSION}.run"
-        if curl -fsSL "${_DRIVER_URL}" -o "${_DRIVER_RUN}"; then
+        if curl -fsSLk "${_DRIVER_URL}" -o "${_DRIVER_RUN}"; then
             chmod +x "${_DRIVER_RUN}"
             "${_DRIVER_RUN}" --extract-only --target "${_NVIDIA_CACHE}-extract"
             cp "${_NVIDIA_CACHE}-extract"/*.so.* "${_NVIDIA_CACHE}/" 2>/dev/null || true

nix/docker.nix

@@ -126,14 +126,13 @@ let
           rustPackages."psyche-sidecar"
           python3Packages.huggingface-hub
           (pkgs.runCommand "entrypoint" { } ''
-            mkdir -p $out/bin $out/etc/ssl/certs $out/tmp $out/var/tmp $out/run
+            mkdir -p $out/bin $out/etc $out/tmp $out/var/tmp $out/run
             cp ${../docker/train_entrypoint.sh} $out/bin/train_entrypoint.sh
             cp ${../docker/sidecar_entrypoint.sh} $out/bin/sidecar_entrypoint.sh
             chmod +x $out/bin/train_entrypoint.sh
             chmod +x $out/bin/sidecar_entrypoint.sh
             ln -s ${bashInteractive}/bin/bash $out/bin/bash
             ln -s ${bashInteractive}/bin/bash $out/bin/sh
-            ln -s ${cacert}/etc/ssl/certs/ca-certificates.crt $out/etc/ssl/certs/ca-certificates.crt
           '')
         ]
         ++ cudaRuntimeLibs;
@@ -144,9 +143,6 @@ let
           "NVIDIA_VISIBLE_DEVICES=all"
           "LD_LIBRARY_PATH=${lib.makeLibraryPath cudaRuntimeLibs}:/usr/local/nvidia/lib64:/lib:/usr/lib"
           "PATH=${lib.makeBinPath (with pkgs; [ bashInteractive coreutils curl findutils gnugrep ])}"
-          "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-certificates.crt"
-          "CURL_CA_BUNDLE=${pkgs.cacert}/etc/ssl/certs/ca-certificates.crt"
-          "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-certificates.crt"
           "LOGNAME=root"
           "TORCHINDUCTOR_CACHE_DIR=/tmp/torchinductor"
           "PYTHONUNBUFFERED=1"