Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions examples/puzzletron/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -294,6 +294,12 @@ python -m pip check
Record the three source revisions and verification output with the campaign.
Re-run verification after pulling either fork or rebuilding a CUDA extension.

### Build docker image
Building a docker image encapsulates the steps above. To build the image pelase run
```bash
docker build -f puzzletron_setup/docker/Dockerfile -t puzzletron_v2:26.08 .
```
Comment on lines +297 to +301

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Fix the Markdown spacing and build instruction text.

Add a blank line before the heading and before the fenced block to satisfy MD022 and MD031. Change pelase to please.

Proposed fix
+
 ### Build docker image
-Building a docker image encapsulates the steps above. To build the image pelase run 
+Building a docker image encapsulates the steps above. To build the image please run.
+
 ```bash
 docker build -f puzzletron_setup/docker/Dockerfile -t puzzletron_v2:26.08 .
</details>

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 markdownlint-cli2 (0.23.2)</summary>

[warning] 297-297: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below

(MD022, blanks-around-headings)

---

[warning] 299-299: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)

</details>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @examples/puzzletron/README.md around lines 297 - 301, Add a blank line
before the “Build docker image” heading and another before its fenced bash block
to satisfy Markdown spacing rules, and correct “pelase” to “please” in the build
instruction text.


</details>

<!-- fingerprinting:phantom:poseidon:tapir -->

<!-- cr-indicator-types:potential_issue -->

<!-- cr-comment:v1:4c0f181bcb926b179a0be1a7 -->

_Source: Linters/SAST tools_

<!-- This is an auto-generated comment by CodeRabbit -->


## Run with an agent

The canonical agent workflow is
Expand Down
33 changes: 33 additions & 0 deletions puzzletron_setup/docker/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
ARG CUDA_VERSION=12.9.2
ARG BUILD_BASE_IMAGE=nvidia/cuda:${CUDA_VERSION}-cudnn-devel-ubuntu24.04

FROM ${BUILD_BASE_IMAGE} AS base

ARG DEBIAN_FRONTEND=noninteractive

ARG MODEL_OPT_ROOT=/workspace/modelopt
ARG VLLM_ROOT=/workspace/vllm
ARG AUTOMODEL_ROOT=/workspace/Automodel

# Copy only the setup script first so that the expensive dep-install layer
# stays cached as long as the script hasn't changed, regardless of source edits.
COPY puzzletron_setup/docker/setup_env.sh /tmp/setup_env.sh

# Tell the build system to proceed without a live GPU
ARG FORCE_CUDA=1
# Avoid GPU detection at compile time
ARG TORCH_CUDA_ARCH_LIST="8.0;8.6;9.0;10.0"

RUN MODEL_OPT_ROOT="${MODEL_OPT_ROOT}" \
VLLM_ROOT="${VLLM_ROOT}" \
AUTOMODEL_ROOT="${AUTOMODEL_ROOT}" \
bash /tmp/setup_env.sh --deps

ENV VIRTUAL_ENV=/venv
ENV PATH=/venv/bin/:$PATH

# Copy the full repo after deps so source changes don't bust the cache above.
COPY . "${MODEL_OPT_ROOT}"/

RUN MODEL_OPT_ROOT="${MODEL_OPT_ROOT}" bash /tmp/setup_env.sh --modelopt
Comment on lines +26 to +32

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- Dockerfile ---'
cat -n puzzletron_setup/docker/Dockerfile
printf '%s\n' '--- Related container configuration ---'
rg -n --glob '!*node_modules*' --glob '!*.lock' \
  'puzzletron_setup/docker|docker compose|docker run|--user|user:|USER |/workspace|MODEL_OPT_ROOT' \
  README.md .github puzzletron_setup 2>/dev/null | head -250

Repository: NVIDIA/Model-Optimizer

Length of output: 2875


🏁 Script executed:

#!/bin/bash
set -eu
cat -n puzzletron_setup/docker/Dockerfile
rg -n --glob '!*node_modules*' --glob '!*.lock' \
  'puzzletron_setup/docker|docker compose|docker run|--user|user:|USER |/workspace|MODEL_OPT_ROOT' \
  README.md .github puzzletron_setup 2>/dev/null | head -250

Repository: NVIDIA/Model-Optimizer

Length of output: 2816


🌐 Web query:

nvidia/cuda:12.9.2-cudnn-devel-ubuntu24.04 Docker image default USER root metadata

💡 Result:

The nvidia/cuda:12.9.2-cudnn-devel-ubuntu24.04 Docker image, like the official NVIDIA CUDA container images generally, runs as the root user by default [1]. The Dockerfile for these images does not contain a USER instruction to switch away from root [2][3], meaning the container inherits the default behavior of Docker and most container runtimes, which start processes as root [1]. If you require the container to run as a non-root user, you must define the user and group within your own Dockerfile (using RUN useradd or similar) and explicitly set the USER directive, while also ensuring the user has appropriate permissions for NVIDIA device access if needed [4][5].

Citations:


Security Misconfiguration (CWE-250)

Exploitability: Moderate

Run the final image as a non-root user.

The NVIDIA CUDA base image runs as root by default, and this Dockerfile does not add a USER directive. Create a runtime user, grant access only to required paths, and set USER after installation. Align its UID and GID with the mount policy.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@puzzletron_setup/docker/Dockerfile` around lines 26 - 32, Add runtime-user
setup to the Dockerfile after the installation step: create a non-root user and
group using the project’s mount-policy UID/GID, grant ownership or access only
to required runtime paths, then set the final USER directive so the image runs
as that user.

Source: Linters/SAST tools


120 changes: 120 additions & 0 deletions puzzletron_setup/docker/setup_env.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,120 @@
#!/usr/bin/env bash
# Shared setup script for the Nemotron3 Puzzletron environment.
#
# Used by the Dockerfile (--deps before COPY, --modelopt after COPY) and
# can be run standalone to set up a bare-metal environment (no arguments).
#
# Usage:
# ./setup_env.sh [--deps | --modelopt]
# --deps System packages, git clones, venv, pip deps — safe to Docker-cache
# --modelopt Install the local ModelOpt source only (run after --deps)
# (no args) Full setup — suitable for bare-metal
#
# Configurable via environment variables (all have defaults):
# MODEL_OPT_ROOT Path to the ModelOpt repo root
# Default: 5 directories above this script
# VLLM_ROOT Where to clone vLLM (default: /workspace/vllm)
# AUTOMODEL_ROOT Where to clone Automodel (default: /workspace/Automodel)
# VIRTUAL_ENV Python venv path (default: /venv)
# SKIP_APT Set to 1 to skip apt-get (default: 0)
# FORCE_CUDA Build CUDA exts without a live GPU (default: 1)
# TORCH_CUDA_ARCH_LIST Architectures to compile for
# (default: "8.0;8.6;9.0;10.0")

set -euo pipefail

MODE="${1:-all}"

# ── Paths ──────────────────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# puzzletron_setup/docker → 2 levels up to repo root
MODEL_OPT_ROOT="${MODEL_OPT_ROOT:-$(cd "${SCRIPT_DIR}/../.." && pwd)}"
VLLM_ROOT="${VLLM_ROOT:-/workspace/vllm}"
AUTOMODEL_ROOT="${AUTOMODEL_ROOT:-/workspace/Automodel}"
VIRTUAL_ENV="${VIRTUAL_ENV:-/venv}"

# ── Build flags ────────────────────────────────────────────────────────────────
SKIP_APT="${SKIP_APT:-0}"
export FORCE_CUDA="${FORCE_CUDA:-1}"
export TORCH_CUDA_ARCH_LIST="${TORCH_CUDA_ARCH_LIST:-8.0;8.6;9.0;10.0}"

activate_venv() {
export VIRTUAL_ENV
export PATH="${VIRTUAL_ENV}/bin:${PATH}"
}

# ══════════════════════════════════════════════════════════════════════════════
# DEPS phase — nothing here depends on the local ModelOpt source.
# In Docker this runs before `COPY .` so it stays cached across source changes.
# ══════════════════════════════════════════════════════════════════════════════
install_deps() {
if [[ "${SKIP_APT}" != "1" ]]; then
apt-get update
apt-get install -y build-essential cmake curl git ninja-build \
python3 python3-dev python3-pip python3-venv
fi

# Clone external repos (idempotent)
[[ -d "${VLLM_ROOT}" ]] || \
git clone --branch feature/add_anymodel_to_vllm --single-branch \
https://github.com/Separius/vllm.git "${VLLM_ROOT}"
[[ -d "${AUTOMODEL_ROOT}" ]] || \
git clone --branch puzzletron --single-branch \
https://github.com/Separius/Automodel.git "${AUTOMODEL_ROOT}"
Comment on lines +57 to +63

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- setup_env.sh relevant sections ---'
sed -n '45,105p' puzzletron_setup/docker/setup_env.sh
printf '%s\n' '--- repository references ---'
rg -n --glob '!node_modules' --glob '!dist' 'feature/add_anymodel_to_vllm|Separius/vllm|Separius/Automodel|pip install' puzzletron_setup examples README.md 2>/dev/null | head -120

Repository: NVIDIA/Model-Optimizer

Length of output: 14343


Mutable Third-party Dependency Pin (CWE-494): Download of Code Without Integrity Check

Reachability: External · Exploitability: Difficult

Pin the external repository revisions.

Lines 57-63 clone mutable branches, and lines 76 and 79 install from those checkouts. Pin both repositories to reviewed full commit hashes before installation.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@puzzletron_setup/docker/setup_env.sh` around lines 57 - 63, Update the
repository setup around the VLLM_ROOT and AUTOMODEL_ROOT clone commands to check
out reviewed, immutable full commit hashes instead of mutable branches before
the existing installation steps at lines 76 and 79. Preserve the idempotent
directory checks and ensure both external repositories are pinned before
installation.

Source: Coding guidelines


[[ -d "${VIRTUAL_ENV}" ]] || python3 -m venv "${VIRTUAL_ENV}"
activate_venv

python -m pip install --upgrade pip \
"setuptools>=80,<81" "setuptools-scm>=8" setuptools-rust wheel \
"packaging>=24.2" "cmake>=3.26.1" ninja jinja2 hydra-core immutabledict pytest-cov pytest-instafail

python -m pip install \
torch==2.11.0 torchvision==0.26.0 torchaudio==2.11.0 \
--index-url https://download.pytorch.org/whl/cu129

VLLM_PRECOMPILED_WHEEL_VARIANT=cu129 \
python -m pip install --no-build-isolation -e "${VLLM_ROOT}"

python -m pip install -e "${AUTOMODEL_ROOT}"
python -m pip install aiperf

# CUDA extension packages placed here (before COPY .) so they stay cached
# across ModelOpt source changes in Docker builds.
python -m pip install --no-build-isolation \
"git+https://github.com/fanshiqing/grouped_gemm@v1.1.4"
python -m pip install "mamba-ssm[causal-conv1d]" --no-build-isolation
python -m pip install "flash-linear-attention[cuda]"
}

# ══════════════════════════════════════════════════════════════════════════════
# MODELOPT phase — installs the local ModelOpt source.
# In Docker this runs after `COPY .` and re-runs on every source change.
# ══════════════════════════════════════════════════════════════════════════════
install_modelopt() {
activate_venv
python -m pip install -e "${MODEL_OPT_ROOT}[hf]"
}

# ── Dispatch ───────────────────────────────────────────────────────────────────
case "${MODE}" in
--deps)
install_deps
;;
--modelopt)
install_modelopt
;;
all)
install_deps
install_modelopt
echo ""
echo "Setup complete. Activate your environment with:"
echo " source ${VIRTUAL_ENV}/bin/activate"
;;
*)
echo "Unknown argument: ${MODE}" >&2
echo "Usage: $0 [--deps | --modelopt]" >&2
exit 1
;;
esac

Loading