From 241d1b73d68df685b865c7e316c2c24571aeea62 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Thu, 9 Jul 2026 20:24:59 +0200 Subject: [PATCH 1/3] RHAIENG-287: fix(Dockerfiles): wrap remaining RUN && chains in bash heredocs Convert workbench Dockerfiles (excluding datascience and rstudio) to RUN /bin/bash <<'EOF' blocks so hadolint accepts source and multiline install steps stay readable. Co-authored-by: Cursor --- .../ubi9-python-3.12/Dockerfile.konflux.cpu | 60 +++++--- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 60 +++++--- .../ubi9-python-3.12/Dockerfile.konflux.rocm | 73 ++++++---- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 87 +++++++---- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 87 +++++++---- .../ubi9-python-3.12/Dockerfile.konflux.rocm | 53 +++++-- .../ubi9-python-3.12/Dockerfile.konflux.rocm | 107 +++++++++----- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 87 +++++++---- .../ubi9-python-3.12/Dockerfile.konflux.cpu | 136 +++++++++++------- .../ubi9-python-3.12/Dockerfile.konflux.cpu | 56 +++++--- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 44 ++++-- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 44 ++++-- .../ubi9-python-3.12/Dockerfile.konflux.rocm | 34 +++-- .../ubi9-python-3.12/Dockerfile.konflux.rocm | 57 +++++--- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 44 ++++-- 15 files changed, 681 insertions(+), 348 deletions(-) diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu index 82c2e2af84..df75a89c1e 100644 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -25,12 +25,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -40,10 +49,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end #################### @@ -81,21 +94,24 @@ USER 1001 COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ # Install Python dependencies from requirements.txt file -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +EOF WORKDIR /opt/app-root/src diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda index 864f800a65..88db2f6845 100644 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -27,12 +27,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -42,10 +51,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################### @@ -81,21 +94,24 @@ USER 1001 COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ # Install Python dependencies from requirements.txt file -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +EOF WORKDIR /opt/app-root/src diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm index 0d827ecce0..cd92527e87 100644 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -25,12 +25,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -40,10 +49,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################## @@ -69,23 +82,30 @@ USER 1001 COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ # Install Python dependencies from Pipfile.lock file -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh - -# Fix permissions to support pip in Openshift environments \ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +EOF + +# Fix permissions to support pip in Openshift environments USER 0 -RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF + USER 1001 # Workaround for https://issues.redhat.com/browse/AIPCC-8152 @@ -93,7 +113,12 @@ ENV ROCM_PATH=/opt/rocm # Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds # https://issues.redhat.com/browse/AIPCC-5882 USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs +dnf clean all +EOF + USER 1001 WORKDIR /opt/app-root/src diff --git a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda index 7e289ea329..e717ad2aba 100644 --- a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -16,10 +16,14 @@ FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip +cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ +CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +EOF + #################### # cuda-base # @@ -40,12 +44,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -55,10 +68,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################### @@ -100,7 +117,12 @@ WORKDIR /opt/app-root/bin USER root # Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Copy dynamically-linked mongocli built in earlier build stage COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ @@ -126,25 +148,28 @@ WORKDIR /opt/app-root/bin # Install Python packages and Jupyterlab extensions from requirements.txt COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# setup path for runtime configuration +mkdir /opt/app-root/runtimes +# Remove default Elyra runtime-images +rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF WORKDIR /opt/app-root/src diff --git a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda index 8bb086da7e..7ecd6d733a 100644 --- a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -16,10 +16,14 @@ FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip +cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ +CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +EOF + #################### # cuda-base # @@ -40,12 +44,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -55,10 +68,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################### @@ -100,7 +117,12 @@ WORKDIR /opt/app-root/bin USER root # Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Copy dynamically-linked mongocli built in earlier build stage COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ @@ -126,25 +148,28 @@ WORKDIR /opt/app-root/bin # Install Python packages and Jupyterlab extensions from requirements.txt COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# setup path for runtime configuration +mkdir /opt/app-root/runtimes +# Remove default Elyra runtime-images +rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF WORKDIR /opt/app-root/src diff --git a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm index f38c8187f6..49c9df62c9 100644 --- a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -14,10 +14,14 @@ FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip +cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ +CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +EOF + #################### # rocm-base # @@ -38,12 +42,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -53,10 +66,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################## @@ -98,7 +115,12 @@ WORKDIR /opt/app-root/bin USER root # Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Copy dynamically-linked mongocli built in earlier build stage COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ @@ -161,7 +183,12 @@ ENV ROCM_PATH=/opt/rocm # Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds # https://issues.redhat.com/browse/AIPCC-5882 USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs +dnf clean all +EOF + USER 1001 WORKDIR /opt/app-root/src diff --git a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm index c3f876d6e6..3008443c9b 100644 --- a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -14,10 +14,14 @@ FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip +cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ +CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +EOF + #################### # rocm-base # @@ -38,12 +42,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -53,10 +66,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################## @@ -98,7 +115,12 @@ WORKDIR /opt/app-root/bin USER root # Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y jq unixODBC postgresql git-lfs libsndfile +dnf clean all +rm -rf /var/cache/yum +EOF # Copy dynamically-linked mongocli built in earlier build stage COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ @@ -128,42 +150,57 @@ ENV HDF5_PLUGIN_PATH=disable COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - # Not using --build-constraints=./requirements.txt because error: Unnamed requirements are not allowed as constraints (found: `https://repo.radeon.com/rocm/manylinux/rocm-rel-6.4/ - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh - -# Fix permissions to support pip in Openshift environments \ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +# Not using --build-constraints=./requirements.txt because error: Unnamed requirements are not allowed as constraints (found: `https://repo.radeon.com/rocm/manylinux/rocm-rel-6.4/ +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# setup path for runtime configuration +mkdir /opt/app-root/runtimes +# Remove default Elyra runtime-images +rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +EOF + +# Fix permissions to support pip in Openshift environments USER 0 -RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF + USER 1001 COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ USER 0 COPY ${TENSORFLOW_SOURCE_CODE}/utils/link-solibs.sh /tmp/link-solibs.sh -RUN /tmp/link-solibs.sh && rm /tmp/link-solibs.sh +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +/tmp/link-solibs.sh && rm /tmp/link-solibs.sh +EOF # Workaround for https://issues.redhat.com/browse/AIPCC-8152 ENV ROCM_PATH=/opt/rocm # Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds # https://issues.redhat.com/browse/AIPCC-5882 USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs +dnf clean all +EOF + USER 1001 WORKDIR /opt/app-root/src diff --git a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda index 4c31d03943..66c20c954a 100644 --- a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -16,10 +16,14 @@ FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip +cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ +CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +EOF + #################### # cuda-base # @@ -40,12 +44,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -55,10 +68,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################### @@ -100,7 +117,12 @@ WORKDIR /opt/app-root/bin USER root # Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Copy dynamically-linked mongocli built in earlier build stage COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ @@ -131,25 +153,28 @@ ENV HDF5_PLUGIN_PATH=disable # Install Python packages and Jupyterlab extensions from requirements.txt COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# setup path for runtime configuration +mkdir /opt/app-root/runtimes +# Remove default Elyra runtime-images +rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ diff --git a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu index 02254eabb6..140983a3b0 100644 --- a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -14,10 +14,14 @@ FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip +cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ +CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ +EOF + #################### # wheel-cache-base # #################### @@ -69,12 +73,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -84,10 +97,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end #################### @@ -129,7 +146,12 @@ WORKDIR /opt/app-root/bin USER root # Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Copy dynamically-linked mongocli built in earlier build stage COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ @@ -163,56 +185,66 @@ LABEL name="rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9" \ USER 0 # Install jre that is needed to run the trustyai library -RUN INSTALL_PKGS="java-17-openjdk" && \ - dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \ - dnf -y clean all --enablerepo='*' +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +INSTALL_PKGS="java-17-openjdk" +dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS +dnf -y clean all --enablerepo='*' +EOF # Install Python packages and Jupyterlab extensions from requirements.txt COPY ${TRUSTYAI_SOURCE_CODE}/pylock.toml ./ COPY ${TRUSTYAI_SOURCE_CODE}/pyproject.toml ./ # install openblas for ppc64le -RUN --mount=type=cache,from=whl-cache,source=/root/OpenBLAS/,target=/OpenBlas/,rw \ - bash -c ' \ - if [[ $(uname -m) == "ppc64le" ]]; then \ - PREFIX=/usr/ make install -C /OpenBlas; \ - fi ' +RUN --mount=type=cache,from=whl-cache,source=/root/OpenBLAS/,target=/OpenBlas/,rw /bin/bash <<'EOF' +set -Eeuxo pipefail +if [[ $(uname -m) == "ppc64le" ]]; then + PREFIX=/usr/ make install -C /OpenBlas +fi +EOF # Install packages and cleanup # install packages as USER 0 (this will allow us to consume uv cache) -RUN --mount=type=cache,from=whl-cache,source=/wheelsdir/,target=/wheelsdir/,rw \ - --mount=type=cache,target=/root/.cache/uv \ - bash -c ' \ - if [[ $(uname -m) == "ppc64le" ]]; then \ - UV_LINK_MODE=copy uv pip install /wheelsdir/*.whl accelerate --cache-dir /root/.cache/uv; \ - fi ' -RUN --mount=type=cache,target=/root/.cache/uv \ - echo "Installing softwares and packages" && \ - # RHAIENG-5986: pandas 1.5.3 needs setuptools/pkg_resources at build time; pyproject.toml - # supplies [tool.uv] extra-build-dependencies and must remain discoverable (no --no-config). - printf '%s\n' 'setuptools>=80.9.0,<82' > build_constraints.txt && \ - # we can ensure wheels are consumed from the cache only by restricting internet access for uv install with '--offline' flag - UV_LINK_MODE=copy uv pip install --cache-dir /root/.cache/uv --requirements=./pylock.toml --build-constraint build_constraints.txt && \ - # Note: debugpy wheel availabe on pypi (in uv cache) is none-any but bundles amd64.so files - # Build debugpy from source instead - UV_LINK_MODE=copy uv pip install --no-cache git+https://github.com/microsoft/debugpy.git@v$(grep -A1 '\"debugpy\"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b') && \ - # change ownership to default user (all packages were installed as root and has root:root ownership \ - chown -R 1001:0 /opt/app-root/ +RUN --mount=type=cache,from=whl-cache,source=/wheelsdir/,target=/wheelsdir/,rw --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF' +set -Eeuxo pipefail +if [[ $(uname -m) == "ppc64le" ]]; then + UV_LINK_MODE=copy uv pip install /wheelsdir/*.whl accelerate --cache-dir /root/.cache/uv +fi +EOF + +RUN --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# RHAIENG-5986: pandas 1.5.3 needs setuptools/pkg_resources at build time; pyproject.toml +# supplies [tool.uv] extra-build-dependencies and must remain discoverable (no --no-config). +printf '%s\n' 'setuptools>=80.9.0,<82' > build_constraints.txt +# we can ensure wheels are consumed from the cache only by restricting internet access for uv install with '--offline' flag +UV_LINK_MODE=copy uv pip install --cache-dir /root/.cache/uv --requirements=./pylock.toml --build-constraint build_constraints.txt +# Note: debugpy wheel availabe on pypi (in uv cache) is none-any but bundles amd64.so files +# Build debugpy from source instead +UV_LINK_MODE=copy uv pip install --no-cache git+https://github.com/microsoft/debugpy.git@v$(grep -A1 '\"debugpy\"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b') +# change ownership to default user (all packages were installed as root and has root:root ownership +chown -R 1001:0 /opt/app-root/ +EOF USER 1001 # setup path for runtime configuration -RUN mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +mkdir /opt/app-root/runtimes +# Remove default Elyra runtime-images +rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json +# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y +sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json +# copy jupyter configuration +cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter +# Disable announcement plugin of jupyterlab +jupyter labextension disable "@jupyterlab/apputils-extension:announcements" +# Apply JupyterLab addons +/opt/app-root/bin/utils/addons/apply.sh +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF diff --git a/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu index 3913bec0c2..3fb1d1fed8 100644 --- a/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -25,19 +25,26 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN ARCH=$(uname -m) && \ - echo "Detected architecture: $ARCH" && \ - PACKAGES="perl mesa-libGL skopeo" && \ - if [ "$ARCH" = "s390x" ] || [ "$ARCH" = "ppc64le" ]; then \ - PACKAGES="$PACKAGES gcc g++ make openssl-devel autoconf automake libtool cmake"; \ - fi && \ - dnf install -y $PACKAGES && \ - dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +ARCH=$(uname -m) +echo "Detected architecture: $ARCH" +PACKAGES="perl mesa-libGL skopeo" +if [ "$ARCH" = "s390x" ] || [ "$ARCH" = "ppc64le" ]; then +PACKAGES="$PACKAGES gcc g++ make openssl-devel autoconf automake libtool cmake"; +fi +dnf install -y $PACKAGES +dnf clean all && rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -47,10 +54,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end #################### @@ -67,13 +78,16 @@ COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ./ # Copy Elyra dependencies for air-gapped enviroment COPY ${MINIMAL_SOURCE_CODE}/utils ./utils/ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF WORKDIR /opt/app-root/src diff --git a/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda index 9837967d08..1863227540 100644 --- a/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -27,12 +27,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -42,10 +51,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################### @@ -62,13 +75,16 @@ COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ # Copy Elyra dependencies for air-gapped enviroment COPY ${PYTORCH_SOURCE_CODE}/utils ./utils/ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF WORKDIR /opt/app-root/src diff --git a/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda index 73169b4a63..49e02070a0 100644 --- a/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -27,12 +27,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -42,10 +51,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################### @@ -62,13 +75,16 @@ COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ # Copy Elyra dependencies for air-gapped enviroment COPY ${PYTORCH_SOURCE_CODE}/utils ./utils/ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF WORKDIR /opt/app-root/src diff --git a/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm b/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm index 5e56e76ce7..8502b40c3f 100644 --- a/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -25,12 +25,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -40,10 +49,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ######################## @@ -88,7 +101,12 @@ ENV ROCM_PATH=/opt/rocm # Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds # https://issues.redhat.com/browse/AIPCC-5882 USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs +dnf clean all +EOF + USER 1001 WORKDIR /opt/app-root/src diff --git a/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm b/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm index 4a7ce7ce47..acecfc4fc8 100644 --- a/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -25,12 +25,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -40,10 +49,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ########################### @@ -61,16 +74,23 @@ COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ # Copy Elyra dependencies for air-gapped enviroment COPY ${TENSORFLOW_SOURCE_CODE}/utils ./utils/ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - # Not using --build-constraints=./requirements.txt because error: Unnamed requirements are not allowed as constraints (found: `https://repo.radeon.com/rocm/manylinux/rocm-rel-6.4/ - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +# Not using --build-constraints=./requirements.txt because error: Unnamed requirements are not allowed as constraints (found: `https://repo.radeon.com/rocm/manylinux/rocm-rel-6.4/ +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +EOF -# Fix permissions to support pip in Openshift environments \ +# Fix permissions to support pip in Openshift environments USER 0 -RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF + USER 1001 COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ @@ -80,7 +100,12 @@ ENV ROCM_PATH=/opt/rocm # Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds # https://issues.redhat.com/browse/AIPCC-5882 USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs +dnf clean all +EOF + USER 1001 WORKDIR /opt/app-root/src diff --git a/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda index 62d6bc55a6..a9ba870c02 100644 --- a/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -29,12 +29,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo # Problem: The operation would result in removing the following protected packages: systemd # (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) # Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 +dnf clean all -y +EOF + # upgrade first to avoid fixable vulnerabilities end # Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +dnf install -y perl mesa-libGL skopeo libxcrypt-compat +dnf clean all +rm -rf /var/cache/yum +EOF # Other apps and tools installed as default user USER 1001 @@ -44,10 +53,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install micropipenv and uv to deploy packages from requirements.txt end # Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ + -o /tmp/openshift-client-linux.tar.gz +tar -xzvf /tmp/openshift-client-linux.tar.gz oc +rm -f /tmp/openshift-client-linux.tar.gz +EOF + # Install the oc client end ############################ @@ -69,13 +82,16 @@ COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ # Copy Elyra dependencies for air-gapped enviroment COPY ${TENSORFLOW_SOURCE_CODE}/utils ./utils/ -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P +RUN /bin/bash <<'EOF' +set -Eeuxo pipefail +echo "Installing softwares and packages" +# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, +# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. +uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml +# Fix permissions to support pip in Openshift environments +chmod -R g+w /opt/app-root/lib/python3.12/site-packages +fix-permissions /opt/app-root -P +EOF COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ From 1ec7bf924ef74f6560b136302a3c47b352cda383 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Mon, 27 Jul 2026 13:43:39 +0200 Subject: [PATCH 2/3] fix(Dockerfiles): fail openshift client curl on HTTP errors Use curl --fail --location --show-error so 4xx/5xx responses abort the heredoc before tar runs with a misleading error page tarball. Co-authored-by: Cursor --- jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu | 2 +- jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda | 2 +- jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm | 2 +- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 2 +- jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda | 2 +- jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm | 2 +- .../rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm | 2 +- jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda | 2 +- jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu | 2 +- runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu | 2 +- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 2 +- runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda | 2 +- runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm | 2 +- .../rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm | 2 +- runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu index df75a89c1e..ebade91e55 100644 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -51,7 +51,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda index 88db2f6845..1a271a91bf 100644 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -53,7 +53,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm index cd92527e87..1aa57099b5 100644 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -51,7 +51,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda index e717ad2aba..5408e95973 100644 --- a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -70,7 +70,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda index 7ecd6d733a..9b02713d88 100644 --- a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -70,7 +70,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm index 49c9df62c9..b7a2efe9d8 100644 --- a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -68,7 +68,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm index 3008443c9b..8279f8b6ca 100644 --- a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -68,7 +68,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda index 66c20c954a..e2f821fbae 100644 --- a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -70,7 +70,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu index 140983a3b0..ce8da87268 100644 --- a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -99,7 +99,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu index 3fb1d1fed8..8601027bca 100644 --- a/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -56,7 +56,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda index 1863227540..f83de1bb6e 100644 --- a/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -53,7 +53,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda index 49e02070a0..59baa2dfa8 100644 --- a/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -53,7 +53,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm b/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm index 8502b40c3f..ff081b148e 100644 --- a/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -51,7 +51,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm b/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm index acecfc4fc8..19cfdc18a8 100644 --- a/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -51,7 +51,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz diff --git a/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda index a9ba870c02..d9605e913b 100644 --- a/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -55,7 +55,7 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" # Install the oc client begin RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ +curl --fail --location --show-error https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ -o /tmp/openshift-client-linux.tar.gz tar -xzvf /tmp/openshift-client-linux.tar.gz oc rm -f /tmp/openshift-client-linux.tar.gz From 8b99c7a30ec34b5532b578d796fba6bafb0aa511 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Thu, 20 Aug 2026 11:52:34 +0200 Subject: [PATCH 3/3] fix(Dockerfiles): harden mongocli curl and clean up heredoc formatting Apply the same --fail hardening used for the oc-client curl in this PR to the mongocli-builder download, so an HTTP error page isn't silently written to the archive. Also fixes leftover formatting nits from the heredoc conversion: doubled blank line, lost if-block indentation, an unsplit dnf clean line, and a cramped multi --mount RUN line. Co-Authored-By: Claude Sonnet 5 --- .../ubi9-python-3.12/Dockerfile.konflux.cuda | 3 +-- jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda | 3 +-- .../rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm | 3 +-- .../rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm | 3 +-- jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda | 3 +-- jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu | 5 +++-- runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu | 5 +++-- 7 files changed, 11 insertions(+), 14 deletions(-) diff --git a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda index 5408e95973..58159ce6df 100644 --- a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -18,13 +18,12 @@ ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +curl --fail --location --show-error -o mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ EOF - #################### # cuda-base # #################### diff --git a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda index 9b02713d88..240f9d1933 100644 --- a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -18,13 +18,12 @@ ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +curl --fail --location --show-error -o mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ EOF - #################### # cuda-base # #################### diff --git a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm index b7a2efe9d8..7ce6772259 100644 --- a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -16,13 +16,12 @@ ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +curl --fail --location --show-error -o mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ EOF - #################### # rocm-base # #################### diff --git a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm index 8279f8b6ca..7626145c47 100644 --- a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm +++ b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm @@ -16,13 +16,12 @@ ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +curl --fail --location --show-error -o mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ EOF - #################### # rocm-base # #################### diff --git a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda index e2f821fbae..3399c0be3f 100644 --- a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda +++ b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda @@ -18,13 +18,12 @@ ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +curl --fail --location --show-error -o mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ EOF - #################### # cuda-base # #################### diff --git a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu index ce8da87268..fe5fc55b02 100644 --- a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -16,7 +16,7 @@ ARG MONGOCLI_VERSION=2.0.4 WORKDIR /tmp/ RUN /bin/bash <<'EOF' set -Eeuxo pipefail -curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip +curl --fail --location --show-error -o mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ @@ -206,7 +206,8 @@ EOF # Install packages and cleanup # install packages as USER 0 (this will allow us to consume uv cache) -RUN --mount=type=cache,from=whl-cache,source=/wheelsdir/,target=/wheelsdir/,rw --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF' +RUN --mount=type=cache,from=whl-cache,source=/wheelsdir/,target=/wheelsdir/,rw \ + --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF' set -Eeuxo pipefail if [[ $(uname -m) == "ppc64le" ]]; then UV_LINK_MODE=copy uv pip install /wheelsdir/*.whl accelerate --cache-dir /root/.cache/uv diff --git a/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu index 8601027bca..1956655357 100644 --- a/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -40,10 +40,11 @@ ARCH=$(uname -m) echo "Detected architecture: $ARCH" PACKAGES="perl mesa-libGL skopeo" if [ "$ARCH" = "s390x" ] || [ "$ARCH" = "ppc64le" ]; then -PACKAGES="$PACKAGES gcc g++ make openssl-devel autoconf automake libtool cmake"; + PACKAGES="$PACKAGES gcc g++ make openssl-devel autoconf automake libtool cmake"; fi dnf install -y $PACKAGES -dnf clean all && rm -rf /var/cache/yum +dnf clean all +rm -rf /var/cache/yum EOF # Other apps and tools installed as default user