-
Notifications
You must be signed in to change notification settings - Fork 536
Puzletron v2 dockerfile #2077
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: feature/puzzletron_v2
Are you sure you want to change the base?
Puzletron v2 dockerfile #2077
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| ARG CUDA_VERSION=12.9.2 | ||
| ARG BUILD_BASE_IMAGE=nvidia/cuda:${CUDA_VERSION}-cudnn-devel-ubuntu24.04 | ||
|
|
||
| FROM ${BUILD_BASE_IMAGE} AS base | ||
|
|
||
| ARG DEBIAN_FRONTEND=noninteractive | ||
|
|
||
| ARG MODEL_OPT_ROOT=/workspace/modelopt | ||
| ARG VLLM_ROOT=/workspace/vllm | ||
| ARG AUTOMODEL_ROOT=/workspace/Automodel | ||
|
|
||
| # Copy only the setup script first so that the expensive dep-install layer | ||
| # stays cached as long as the script hasn't changed, regardless of source edits. | ||
| COPY puzzletron_setup/docker/setup_env.sh /tmp/setup_env.sh | ||
|
|
||
| # Tell the build system to proceed without a live GPU | ||
| ARG FORCE_CUDA=1 | ||
| # Avoid GPU detection at compile time | ||
| ARG TORCH_CUDA_ARCH_LIST="8.0;8.6;9.0;10.0" | ||
|
|
||
| RUN MODEL_OPT_ROOT="${MODEL_OPT_ROOT}" \ | ||
| VLLM_ROOT="${VLLM_ROOT}" \ | ||
| AUTOMODEL_ROOT="${AUTOMODEL_ROOT}" \ | ||
| bash /tmp/setup_env.sh --deps | ||
|
|
||
| ENV VIRTUAL_ENV=/venv | ||
| ENV PATH=/venv/bin/:$PATH | ||
|
|
||
| # Copy the full repo after deps so source changes don't bust the cache above. | ||
| COPY . "${MODEL_OPT_ROOT}"/ | ||
|
|
||
| RUN MODEL_OPT_ROOT="${MODEL_OPT_ROOT}" bash /tmp/setup_env.sh --modelopt | ||
|
Comment on lines
+26
to
+32
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- Dockerfile ---'
cat -n puzzletron_setup/docker/Dockerfile
printf '%s\n' '--- Related container configuration ---'
rg -n --glob '!*node_modules*' --glob '!*.lock' \
'puzzletron_setup/docker|docker compose|docker run|--user|user:|USER |/workspace|MODEL_OPT_ROOT' \
README.md .github puzzletron_setup 2>/dev/null | head -250Repository: NVIDIA/Model-Optimizer Length of output: 2875 🏁 Script executed: #!/bin/bash
set -eu
cat -n puzzletron_setup/docker/Dockerfile
rg -n --glob '!*node_modules*' --glob '!*.lock' \
'puzzletron_setup/docker|docker compose|docker run|--user|user:|USER |/workspace|MODEL_OPT_ROOT' \
README.md .github puzzletron_setup 2>/dev/null | head -250Repository: NVIDIA/Model-Optimizer Length of output: 2816 🌐 Web query:
💡 Result: The nvidia/cuda:12.9.2-cudnn-devel-ubuntu24.04 Docker image, like the official NVIDIA CUDA container images generally, runs as the root user by default [1]. The Dockerfile for these images does not contain a USER instruction to switch away from root [2][3], meaning the container inherits the default behavior of Docker and most container runtimes, which start processes as root [1]. If you require the container to run as a non-root user, you must define the user and group within your own Dockerfile (using RUN useradd or similar) and explicitly set the USER directive, while also ensuring the user has appropriate permissions for NVIDIA device access if needed [4][5]. Citations:
Security Misconfiguration (CWE-250) Exploitability: Moderate Run the final image as a non-root user. The NVIDIA CUDA base image runs as root by default, and this Dockerfile does not add a 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,120 @@ | ||
| #!/usr/bin/env bash | ||
| # Shared setup script for the Nemotron3 Puzzletron environment. | ||
| # | ||
| # Used by the Dockerfile (--deps before COPY, --modelopt after COPY) and | ||
| # can be run standalone to set up a bare-metal environment (no arguments). | ||
| # | ||
| # Usage: | ||
| # ./setup_env.sh [--deps | --modelopt] | ||
| # --deps System packages, git clones, venv, pip deps — safe to Docker-cache | ||
| # --modelopt Install the local ModelOpt source only (run after --deps) | ||
| # (no args) Full setup — suitable for bare-metal | ||
| # | ||
| # Configurable via environment variables (all have defaults): | ||
| # MODEL_OPT_ROOT Path to the ModelOpt repo root | ||
| # Default: 5 directories above this script | ||
| # VLLM_ROOT Where to clone vLLM (default: /workspace/vllm) | ||
| # AUTOMODEL_ROOT Where to clone Automodel (default: /workspace/Automodel) | ||
| # VIRTUAL_ENV Python venv path (default: /venv) | ||
| # SKIP_APT Set to 1 to skip apt-get (default: 0) | ||
| # FORCE_CUDA Build CUDA exts without a live GPU (default: 1) | ||
| # TORCH_CUDA_ARCH_LIST Architectures to compile for | ||
| # (default: "8.0;8.6;9.0;10.0") | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| MODE="${1:-all}" | ||
|
|
||
| # ── Paths ────────────────────────────────────────────────────────────────────── | ||
| SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" | ||
| # puzzletron_setup/docker → 2 levels up to repo root | ||
| MODEL_OPT_ROOT="${MODEL_OPT_ROOT:-$(cd "${SCRIPT_DIR}/../.." && pwd)}" | ||
| VLLM_ROOT="${VLLM_ROOT:-/workspace/vllm}" | ||
| AUTOMODEL_ROOT="${AUTOMODEL_ROOT:-/workspace/Automodel}" | ||
| VIRTUAL_ENV="${VIRTUAL_ENV:-/venv}" | ||
|
|
||
| # ── Build flags ──────────────────────────────────────────────────────────────── | ||
| SKIP_APT="${SKIP_APT:-0}" | ||
| export FORCE_CUDA="${FORCE_CUDA:-1}" | ||
| export TORCH_CUDA_ARCH_LIST="${TORCH_CUDA_ARCH_LIST:-8.0;8.6;9.0;10.0}" | ||
|
|
||
| activate_venv() { | ||
| export VIRTUAL_ENV | ||
| export PATH="${VIRTUAL_ENV}/bin:${PATH}" | ||
| } | ||
|
|
||
| # ══════════════════════════════════════════════════════════════════════════════ | ||
| # DEPS phase — nothing here depends on the local ModelOpt source. | ||
| # In Docker this runs before `COPY .` so it stays cached across source changes. | ||
| # ══════════════════════════════════════════════════════════════════════════════ | ||
| install_deps() { | ||
| if [[ "${SKIP_APT}" != "1" ]]; then | ||
| apt-get update | ||
| apt-get install -y build-essential cmake curl git ninja-build \ | ||
| python3 python3-dev python3-pip python3-venv | ||
| fi | ||
|
|
||
| # Clone external repos (idempotent) | ||
| [[ -d "${VLLM_ROOT}" ]] || \ | ||
| git clone --branch feature/add_anymodel_to_vllm --single-branch \ | ||
| https://github.com/Separius/vllm.git "${VLLM_ROOT}" | ||
| [[ -d "${AUTOMODEL_ROOT}" ]] || \ | ||
| git clone --branch puzzletron --single-branch \ | ||
| https://github.com/Separius/Automodel.git "${AUTOMODEL_ROOT}" | ||
|
Comment on lines
+57
to
+63
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- setup_env.sh relevant sections ---'
sed -n '45,105p' puzzletron_setup/docker/setup_env.sh
printf '%s\n' '--- repository references ---'
rg -n --glob '!node_modules' --glob '!dist' 'feature/add_anymodel_to_vllm|Separius/vllm|Separius/Automodel|pip install' puzzletron_setup examples README.md 2>/dev/null | head -120Repository: NVIDIA/Model-Optimizer Length of output: 14343 Mutable Third-party Dependency Pin (CWE-494): Download of Code Without Integrity Check Reachability: External · Exploitability: Difficult Pin the external repository revisions. Lines 57-63 clone mutable branches, and lines 76 and 79 install from those checkouts. Pin both repositories to reviewed full commit hashes before installation. 🤖 Prompt for AI AgentsSource: Coding guidelines |
||
|
|
||
| [[ -d "${VIRTUAL_ENV}" ]] || python3 -m venv "${VIRTUAL_ENV}" | ||
| activate_venv | ||
|
|
||
| python -m pip install --upgrade pip \ | ||
| "setuptools>=80,<81" "setuptools-scm>=8" setuptools-rust wheel \ | ||
| "packaging>=24.2" "cmake>=3.26.1" ninja jinja2 hydra-core immutabledict pytest-cov pytest-instafail | ||
|
|
||
| python -m pip install \ | ||
| torch==2.11.0 torchvision==0.26.0 torchaudio==2.11.0 \ | ||
| --index-url https://download.pytorch.org/whl/cu129 | ||
|
|
||
| VLLM_PRECOMPILED_WHEEL_VARIANT=cu129 \ | ||
| python -m pip install --no-build-isolation -e "${VLLM_ROOT}" | ||
|
|
||
| python -m pip install -e "${AUTOMODEL_ROOT}" | ||
| python -m pip install aiperf | ||
|
|
||
| # CUDA extension packages placed here (before COPY .) so they stay cached | ||
| # across ModelOpt source changes in Docker builds. | ||
| python -m pip install --no-build-isolation \ | ||
| "git+https://github.com/fanshiqing/grouped_gemm@v1.1.4" | ||
| python -m pip install "mamba-ssm[causal-conv1d]" --no-build-isolation | ||
| python -m pip install "flash-linear-attention[cuda]" | ||
| } | ||
|
|
||
| # ══════════════════════════════════════════════════════════════════════════════ | ||
| # MODELOPT phase — installs the local ModelOpt source. | ||
| # In Docker this runs after `COPY .` and re-runs on every source change. | ||
| # ══════════════════════════════════════════════════════════════════════════════ | ||
| install_modelopt() { | ||
| activate_venv | ||
| python -m pip install -e "${MODEL_OPT_ROOT}[hf]" | ||
| } | ||
|
|
||
| # ── Dispatch ─────────────────────────────────────────────────────────────────── | ||
| case "${MODE}" in | ||
| --deps) | ||
| install_deps | ||
| ;; | ||
| --modelopt) | ||
| install_modelopt | ||
| ;; | ||
| all) | ||
| install_deps | ||
| install_modelopt | ||
| echo "" | ||
| echo "Setup complete. Activate your environment with:" | ||
| echo " source ${VIRTUAL_ENV}/bin/activate" | ||
| ;; | ||
| *) | ||
| echo "Unknown argument: ${MODE}" >&2 | ||
| echo "Usage: $0 [--deps | --modelopt]" >&2 | ||
| exit 1 | ||
| ;; | ||
| esac | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the Markdown spacing and build instruction text.
Add a blank line before the heading and before the fenced block to satisfy MD022 and MD031. Change
pelasetoplease.Proposed fix
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
@examples/puzzletron/README.mdaround lines 297 - 301, Add a blank linebefore the “Build docker image” heading and another before its fenced bash block
to satisfy Markdown spacing rules, and correct “pelase” to “please” in the build
instruction text.