From c42bae02c55d27bacacd470b78d2fba90e02637a Mon Sep 17 00:00:00 2001 From: Dillon Cullinan Date: Tue, 9 Sep 2025 10:39:00 -0400 Subject: [PATCH 1/5] Mount secrets Signed-off-by: Dillon Cullinan --- container/Dockerfile | 14 +++++++++----- container/Dockerfile.vllm | 2 ++ container/build.sh | 4 ++-- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/container/Dockerfile b/container/Dockerfile index eb296eeaa7..6056aa852c 100644 --- a/container/Dockerfile +++ b/container/Dockerfile @@ -35,8 +35,6 @@ ARG ARCH_ALT=x86_64 ARG USE_SCCACHE ARG SCCACHE_BUCKET="" ARG SCCACHE_REGION="" -ARG AWS_ACCESS_KEY_ID="" -ARG AWS_SECRET_ACCESS_KEY="" # NIXL configuration ARG NIXL_UCX_REF=v1.19.0 @@ -164,7 +162,9 @@ ENV PATH=/usr/local/bin/etcd/:$PATH ################################## # Build and install UCX -RUN rm -rf /opt/hpcx/ucx && \ +RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ + --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ + rm -rf /opt/hpcx/ucx && \ rm -rf /usr/local/ucx && \ echo "Building UCX with reference $NIXL_UCX_REF" && \ cd /usr/local/src && \ @@ -214,7 +214,9 @@ ENV NIXL_SRC_DIR=/opt/nixl \ NIXL_PLUGIN_DIR=/opt/nvidia/nvda_nixl/lib/${ARCH_ALT}-linux-gnu/plugins # Build and install NIXL -RUN git clone --depth 1 --branch ${NIXL_REF} "https://github.com/ai-dynamo/nixl.git" ${NIXL_SRC_DIR} && \ +RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ + --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ + git clone --depth 1 --branch ${NIXL_REF} "https://github.com/ai-dynamo/nixl.git" ${NIXL_SRC_DIR} && \ cd ${NIXL_SRC_DIR} && \ if [ "$ARCH" = "arm64" ]; then \ nixl_build_args="-Ddisable_gds_backend=true"; \ @@ -317,7 +319,9 @@ COPY lib/ /opt/dynamo/lib/ COPY components/ /opt/dynamo/components/ # Build wheels -RUN uv build --wheel --out-dir /opt/dynamo/dist && \ +RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ + --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ + uv build --wheel --out-dir /opt/dynamo/dist && \ cd /opt/dynamo/lib/bindings/python && \ uv pip install maturin[patchelf] && \ if [ "$ENABLE_KVBM" = "true" ]; then \ diff --git a/container/Dockerfile.vllm b/container/Dockerfile.vllm index 1503da9a27..bbb47c665b 100644 --- a/container/Dockerfile.vllm +++ b/container/Dockerfile.vllm @@ -139,6 +139,8 @@ ENV SCCACHE_BUCKET=${USE_SCCACHE:+${SCCACHE_BUCKET}} \ # Install VLLM and related dependencies RUN --mount=type=bind,source=./container/deps/,target=/tmp/deps \ --mount=type=cache,target=/root/.cache/uv \ + --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ + --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ # TODO - split vllm, DeepEP, DeepGeMM, PPLX installs # Should be able to select how you want your build to go cp /tmp/deps/vllm/install_vllm.sh /tmp/install_vllm.sh && \ diff --git a/container/build.sh b/container/build.sh index 08849b3b02..2e22f30344 100755 --- a/container/build.sh +++ b/container/build.sh @@ -602,8 +602,8 @@ if [ "$USE_SCCACHE" = true ]; then BUILD_ARGS+=" --build-arg USE_SCCACHE=true" BUILD_ARGS+=" --build-arg SCCACHE_BUCKET=${SCCACHE_BUCKET}" BUILD_ARGS+=" --build-arg SCCACHE_REGION=${SCCACHE_REGION}" - BUILD_ARGS+=" --build-arg AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}" - BUILD_ARGS+=" --build-arg AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}" + BUILD_ARGS+=" --secret id=aws-key-id,env=AWS_ACCESS_KEY_ID" + BUILD_ARGS+=" --secret id=aws-key-id,env=AWS_SECRET_ACCESS_KEY" fi LATEST_TAG="--tag dynamo:latest-${FRAMEWORK,,}" From 979e876dabe2bd4f9f52c88c7b1f8a093cec008d Mon Sep 17 00:00:00 2001 From: Dillon Cullinan Date: Tue, 9 Sep 2025 10:49:20 -0400 Subject: [PATCH 2/5] Use more recent docker syntax Signed-off-by: Dillon Cullinan --- container/Dockerfile | 1 + container/Dockerfile.vllm | 1 + 2 files changed, 2 insertions(+) diff --git a/container/Dockerfile b/container/Dockerfile index 6056aa852c..b2a6fcb8ba 100644 --- a/container/Dockerfile +++ b/container/Dockerfile @@ -1,3 +1,4 @@ +# syntax=docker/dockerfile:1.10.0 # SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 diff --git a/container/Dockerfile.vllm b/container/Dockerfile.vllm index bbb47c665b..dad6fc7d26 100644 --- a/container/Dockerfile.vllm +++ b/container/Dockerfile.vllm @@ -1,3 +1,4 @@ +# syntax=docker/dockerfile:1.10.0 # SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 From 16a8e2ee1e4685413c89c6ec27d867f8b6c0c13e Mon Sep 17 00:00:00 2001 From: Dillon Cullinan Date: Tue, 9 Sep 2025 10:52:31 -0400 Subject: [PATCH 3/5] Change id for injections Signed-off-by: Dillon Cullinan --- container/Dockerfile | 6 +++--- container/Dockerfile.vllm | 2 +- container/build.sh | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/container/Dockerfile b/container/Dockerfile index b2a6fcb8ba..a801a9f091 100644 --- a/container/Dockerfile +++ b/container/Dockerfile @@ -164,7 +164,7 @@ ENV PATH=/usr/local/bin/etcd/:$PATH # Build and install UCX RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ - --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ + --mount=type=secret,id=aws-secret-id,env=AWS_SECRET_ACCESS_KEY \ rm -rf /opt/hpcx/ucx && \ rm -rf /usr/local/ucx && \ echo "Building UCX with reference $NIXL_UCX_REF" && \ @@ -216,7 +216,7 @@ ENV NIXL_SRC_DIR=/opt/nixl \ # Build and install NIXL RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ - --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ + --mount=type=secret,id=aws-secret-id,env=AWS_SECRET_ACCESS_KEY \ git clone --depth 1 --branch ${NIXL_REF} "https://github.com/ai-dynamo/nixl.git" ${NIXL_SRC_DIR} && \ cd ${NIXL_SRC_DIR} && \ if [ "$ARCH" = "arm64" ]; then \ @@ -321,7 +321,7 @@ COPY components/ /opt/dynamo/components/ # Build wheels RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ - --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ + --mount=type=secret,id=aws-secret-id,env=AWS_SECRET_ACCESS_KEY \ uv build --wheel --out-dir /opt/dynamo/dist && \ cd /opt/dynamo/lib/bindings/python && \ uv pip install maturin[patchelf] && \ diff --git a/container/Dockerfile.vllm b/container/Dockerfile.vllm index dad6fc7d26..52af001c94 100644 --- a/container/Dockerfile.vllm +++ b/container/Dockerfile.vllm @@ -141,7 +141,7 @@ ENV SCCACHE_BUCKET=${USE_SCCACHE:+${SCCACHE_BUCKET}} \ RUN --mount=type=bind,source=./container/deps/,target=/tmp/deps \ --mount=type=cache,target=/root/.cache/uv \ --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ - --mount=type=secret,id=aws-key-id,env=AWS_SECRET_ACCESS_KEY \ + --mount=type=secret,id=aws-secret-id,env=AWS_SECRET_ACCESS_KEY \ # TODO - split vllm, DeepEP, DeepGeMM, PPLX installs # Should be able to select how you want your build to go cp /tmp/deps/vllm/install_vllm.sh /tmp/install_vllm.sh && \ diff --git a/container/build.sh b/container/build.sh index 2e22f30344..1b37af7954 100755 --- a/container/build.sh +++ b/container/build.sh @@ -603,7 +603,7 @@ if [ "$USE_SCCACHE" = true ]; then BUILD_ARGS+=" --build-arg SCCACHE_BUCKET=${SCCACHE_BUCKET}" BUILD_ARGS+=" --build-arg SCCACHE_REGION=${SCCACHE_REGION}" BUILD_ARGS+=" --secret id=aws-key-id,env=AWS_ACCESS_KEY_ID" - BUILD_ARGS+=" --secret id=aws-key-id,env=AWS_SECRET_ACCESS_KEY" + BUILD_ARGS+=" --secret id=aws-secret-id,env=AWS_SECRET_ACCESS_KEY" fi LATEST_TAG="--tag dynamo:latest-${FRAMEWORK,,}" From 51fee37662a44b2301af6cf6fa135ecdfcb16894 Mon Sep 17 00:00:00 2001 From: Dillon Cullinan Date: Tue, 9 Sep 2025 10:59:30 -0400 Subject: [PATCH 4/5] Remove args Signed-off-by: Dillon Cullinan --- container/Dockerfile | 4 ---- container/Dockerfile.vllm | 4 ---- 2 files changed, 8 deletions(-) diff --git a/container/Dockerfile b/container/Dockerfile index a801a9f091..609308500c 100644 --- a/container/Dockerfile +++ b/container/Dockerfile @@ -57,8 +57,6 @@ ARG PYTHON_VERSION ARG USE_SCCACHE ARG SCCACHE_BUCKET ARG SCCACHE_REGION -ARG AWS_ACCESS_KEY_ID -ARG AWS_SECRET_ACCESS_KEY ARG NIXL_UCX_REF ARG NIXL_REF @@ -275,8 +273,6 @@ ARG ENABLE_KVBM ARG USE_SCCACHE ARG SCCACHE_BUCKET ARG SCCACHE_REGION -ARG AWS_ACCESS_KEY_ID -ARG AWS_SECRET_ACCESS_KEY WORKDIR /opt/dynamo diff --git a/container/Dockerfile.vllm b/container/Dockerfile.vllm index 52af001c94..9061c6607f 100644 --- a/container/Dockerfile.vllm +++ b/container/Dockerfile.vllm @@ -21,8 +21,6 @@ ARG TORCH_BACKEND="cu128" ARG USE_SCCACHE ARG SCCACHE_BUCKET="" ARG SCCACHE_REGION="" -ARG AWS_ACCESS_KEY_ID="" -ARG AWS_SECRET_ACCESS_KEY="" # Match 0.10.1.1 vLLM release # https://github.com/vllm-project/vllm/releases/tag/v0.10.1.1 @@ -122,8 +120,6 @@ ARG USE_SCCACHE ARG ARCH_ALT ARG SCCACHE_BUCKET ARG SCCACHE_REGION -ARG AWS_ACCESS_KEY_ID="" -ARG AWS_SECRET_ACCESS_KEY="" ENV ARCH_ALT=${ARCH_ALT} RUN if [ "$USE_SCCACHE" = "true" ]; then \ From ff653eb157121a1fbb64ac96206922a9e605b120 Mon Sep 17 00:00:00 2001 From: Dillon Cullinan Date: Tue, 9 Sep 2025 11:16:03 -0400 Subject: [PATCH 5/5] Add to nixl python build Signed-off-by: Dillon Cullinan --- container/Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/container/Dockerfile b/container/Dockerfile index 609308500c..3308c077bc 100644 --- a/container/Dockerfile +++ b/container/Dockerfile @@ -231,7 +231,9 @@ RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ # Build NIXL Python module # TODO OPS-590: Move gds_path selection based on arch into NIXL build and re-enable gds backend for arm64 -RUN if [ "$ARCH" = "arm64" ]; then \ +RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \ + --mount=type=secret,id=aws-secret-id,env=AWS_SECRET_ACCESS_KEY \ + if [ "$ARCH" = "arm64" ]; then \ cd ${NIXL_SRC_DIR} && uv build . --out-dir /opt/dynamo/wheelhouse/nixl \ --config-settings=setup-args="-Ddisable_gds_backend=true"; \ else \