From c67af84096dd2adec188d26f36ed9ebd9f47f249 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Mon, 3 Aug 2026 14:03:44 +0200 Subject: [PATCH 1/5] chore(jupyter-minimal): remove orphaned pdf-builder stage and scripts The Konflux minimal CPU Dockerfile had a pdf-builder stage that was never referenced by COPY --from; PDF export already uses install_pdf_deps.sh. Delete the unused stage and uninstall_texlive/install_pandoc helpers. Co-authored-by: Cursor --- .../ubi9-python-3.12/Dockerfile.konflux.cpu | 19 ---- jupyter/utils/install_pandoc.sh | 23 ----- jupyter/utils/install_texlive.sh | 87 ------------------- 3 files changed, 129 deletions(-) delete mode 100755 jupyter/utils/install_pandoc.sh delete mode 100755 jupyter/utils/install_texlive.sh diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu index abf5ed2540..82c2e2af84 100644 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -3,25 +3,6 @@ ######################### ARG BASE_IMAGE -############################ -# Stage 1: PDF Tool Build # -############################ -FROM registry.access.redhat.com/ubi9/python-312:latest AS pdf-builder - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -# hadolint ignore=DL3002 -USER 0 - -# Copy scripts -COPY jupyter/utils/install_texlive.sh ./install_texlive.sh -COPY jupyter/utils/install_pandoc.sh ./install_pandoc.sh -RUN chmod +x install_texlive.sh install_pandoc.sh - -RUN ./install_texlive.sh -RUN ./install_pandoc.sh - # External image alias for UBI repository configuration FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos diff --git a/jupyter/utils/install_pandoc.sh b/jupyter/utils/install_pandoc.sh deleted file mode 100755 index 1dcb12e70b..0000000000 --- a/jupyter/utils/install_pandoc.sh +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash -set -euxo pipefail - -# Mapping of `uname -m` values to equivalent GOARCH values -declare -A UNAME_TO_GOARCH -UNAME_TO_GOARCH["x86_64"]="amd64" -UNAME_TO_GOARCH["aarch64"]="arm64" -UNAME_TO_GOARCH["ppc64le"]="ppc64le" -UNAME_TO_GOARCH["s390x"]="s390x" - -ARCH="${UNAME_TO_GOARCH[$(uname -m)]}" - -if [[ "$ARCH" == "ppc64le" ]]; then - - # Install Pandoc from source - dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm - dnf install -y pandoc - mkdir -p /usr/local/pandoc/bin - ln -s /usr/bin/pandoc /usr/local/pandoc/bin/pandoc - export PATH="/usr/local/pandoc/bin:$PATH" - pandoc --version - -fi diff --git a/jupyter/utils/install_texlive.sh b/jupyter/utils/install_texlive.sh deleted file mode 100755 index 565d734234..0000000000 --- a/jupyter/utils/install_texlive.sh +++ /dev/null @@ -1,87 +0,0 @@ -#!/bin/bash -set -euxo pipefail - -# Mapping of `uname -m` values to equivalent GOARCH values -declare -A UNAME_TO_GOARCH -UNAME_TO_GOARCH["x86_64"]="amd64" -UNAME_TO_GOARCH["aarch64"]="arm64" -UNAME_TO_GOARCH["ppc64le"]="ppc64le" -UNAME_TO_GOARCH["s390x"]="s390x" - -ARCH="${UNAME_TO_GOARCH[$(uname -m)]}" - -if [[ "$ARCH" == "ppc64le" ]]; then - - echo "Installing TeX Live from source for $ARCH..." - - # Install build dependencies - dnf install -y gcc-toolset-13 perl make libX11-devel \ - zlib-devel freetype-devel libpng-devel ncurses-devel \ - gd-devel libtool wget tar xz \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libXmu-devel-1.1.3-8.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libXext-devel-1.3.4-8.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libICE-devel-1.0.10-8.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libSM-devel-1.2.3-10.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libXmu-1.1.3-8.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libXaw-devel-1.0.13-19.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libXaw-1.0.13-19.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/libXt-devel-1.2.0-6.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/flex-2.6.4-9.el9.ppc64le.rpm \ - https://mirror.stream.centos.org/9-stream/AppStream/ppc64le/os/Packages/bison-3.7.4-5.el9.ppc64le.rpm - - # Step 1: Download and extract the TeX Live source - wget https://ftp.math.utah.edu/pub/tex/historic/systems/texlive/2025/texlive-20250308-source.tar.xz - tar -xf texlive-20250308-source.tar.xz - cd texlive-20250308-source - - # Enable newer GCC toolchain - source /opt/rh/gcc-toolset-13/enable - - # Create build directory and build - mkdir -p ../texlive-build - cd ../texlive-build - ../texlive-20250308-source/configure --prefix=/usr/local/texlive - make -j"$(nproc)" - make install - - # Symlink for pdflatex - ln -sf pdftex /usr/local/texlive/bin/powerpc64le-unknown-linux-gnu/pdflatex - - # Cleanup sources to reduce image size - rm -rf /texlive-20250308-source /texlive-build - - # Step 2: Run TeX Live installer for runtime tree setup - # Pin to the TeX Live 2025 historic archive so the installer version and - # package repository version always match (mirror.ctan.org now serves 2026). - TEXLIVE_HISTORIC="https://ftp.math.utah.edu/pub/tex/historic/systems/texlive/2025/tlnet-final" - cd / - wget "${TEXLIVE_HISTORIC}/install-tl-unx.tar.gz" - tar -xzf install-tl-unx.tar.gz - cd install-tl-2*/ - - # Create a custom install profile - TEXLIVE_INSTALL_PREFIX="/usr/local/texlive" - cat < texlive.profile -selected_scheme scheme-small -TEXDIR $TEXLIVE_INSTALL_PREFIX -TEXMFCONFIG ~/.texlive2025/texmf-config -TEXMFVAR ~/.texlive2025/texmf-var -option_doc 0 -option_src 0 -EOF - - ./install-tl --profile=texlive.profile --custom-bin=$TEXLIVE_INSTALL_PREFIX/bin/powerpc64le-unknown-linux-gnu --repository="${TEXLIVE_HISTORIC}" - -# TeX Live binary directory -TEX_BIN_DIR="/usr/local/texlive/bin/powerpc64le-unknown-linux-gnu" - -# Create standard symlink 'linux' → arch-specific folder -ln -sf "$TEX_BIN_DIR" /usr/local/texlive/bin/linux - - - # Set up environment - export PATH="$TEXLIVE_INSTALL_PREFIX/bin/linux:$PATH" - pdflatex --version - tlmgr --version - -fi \ No newline at end of file From b722bc30ecffbc496ebf915424626d36b1bd0614 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Mon, 3 Aug 2026 14:11:55 +0200 Subject: [PATCH 2/5] chore: remove orphan non-Konflux workbench/runtime Dockerfiles Delete Dockerfile.cpu/cuda/rocm where Dockerfile.konflux.* is the build source of truth for Makefile, Tekton, and GHA. RStudio Dockerfile.cpu/cuda remain as Konflux symlink targets. Co-authored-by: Cursor --- .../ubi9-python-3.12/Dockerfile.cpu | 446 ------------------ .../minimal/ubi9-python-3.12/Dockerfile.cpu | 100 ---- .../minimal/ubi9-python-3.12/Dockerfile.cuda | 102 ---- .../minimal/ubi9-python-3.12/Dockerfile.rocm | 111 ----- .../ubi9-python-3.12/Dockerfile.cuda | 159 ------- .../pytorch/ubi9-python-3.12/Dockerfile.cuda | 159 ------- .../pytorch/ubi9-python-3.12/Dockerfile.rocm | 177 ------- .../ubi9-python-3.12/Dockerfile.rocm | 179 ------- .../ubi9-python-3.12/Dockerfile.cuda | 166 ------- .../trustyai/ubi9-python-3.12/Dockerfile.cpu | 222 --------- .../ubi9-python-3.12/Dockerfile.cpu | 442 ----------------- .../minimal/ubi9-python-3.12/Dockerfile.cpu | 88 ---- .../ubi9-python-3.12/Dockerfile.cuda | 83 ---- .../pytorch/ubi9-python-3.12/Dockerfile.cuda | 83 ---- .../ubi9-python-3.12/Dockerfile.rocm | 104 ---- .../ubi9-python-3.12/Dockerfile.rocm | 96 ---- .../ubi9-python-3.12/Dockerfile.cuda | 92 ---- 17 files changed, 2809 deletions(-) delete mode 100644 jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu delete mode 100644 jupyter/minimal/ubi9-python-3.12/Dockerfile.cpu delete mode 100644 jupyter/minimal/ubi9-python-3.12/Dockerfile.cuda delete mode 100644 jupyter/minimal/ubi9-python-3.12/Dockerfile.rocm delete mode 100644 jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda delete mode 100644 jupyter/pytorch/ubi9-python-3.12/Dockerfile.cuda delete mode 100644 jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.rocm delete mode 100644 jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.rocm delete mode 100644 jupyter/tensorflow/ubi9-python-3.12/Dockerfile.cuda delete mode 100644 jupyter/trustyai/ubi9-python-3.12/Dockerfile.cpu delete mode 100644 runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu delete mode 100644 runtimes/minimal/ubi9-python-3.12/Dockerfile.cpu delete mode 100644 runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda delete mode 100644 runtimes/pytorch/ubi9-python-3.12/Dockerfile.cuda delete mode 100644 runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.rocm delete mode 100644 runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.rocm delete mode 100644 runtimes/tensorflow/ubi9-python-3.12/Dockerfile.cuda diff --git a/jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu b/jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu deleted file mode 100644 index ad08e84068..0000000000 --- a/jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu +++ /dev/null @@ -1,446 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -###################################################### -# mongocli-builder (build stage only, not published) # -###################################################### -FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder - -ARG MONGOCLI_VERSION=2.0.4 - -WORKDIR /tmp/ - -ARG TARGETARCH - -# Keep s390x special-case from original (create dummy binary) but -# include explicit curl/unzip steps from the delta for non-s390x. -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -arch="${TARGETARCH:-$(uname -m)}" -arch=$(echo "$arch" | cut -d- -f1) -if [ "$arch" = "s390x" ]; then - echo "Skipping mongocli build for ${arch}, creating dummy binary" - mkdir -p /tmp && printf '#!/bin/sh\necho "mongocli not supported on s390x"' > /tmp/mongocli - chmod +x /tmp/mongocli -else - echo "Building mongocli for ${arch}" - curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip - unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip - cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ - CGO_ENABLED=1 GOOS=linux GOARCH=${arch} GO111MODULE=on go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ -fi -EOF - -#################### -# cpu-base # -#################### -FROM ${BASE_IMAGE} AS cpu-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root -ARG TARGETARCH -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -COPY ${DATASCIENCE_SOURCE_CODE}/pylock.toml /tmp/pylock.toml -COPY scripts/pylock_version.py /tmp/pylock_version.py - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 -dnf clean all -y -EOF - -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN --mount=type=cache,target=/var/cache/dnf /bin/bash <<'EOF' -set -Eeuxo pipefail -echo "Building for architecture: ${TARGETARCH}" -if [ "$TARGETARCH" = "s390x" ]; then - PACKAGES="perl mesa-libGL skopeo gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel" -else - PACKAGES="perl mesa-libGL skopeo" -fi -echo "Installing: $PACKAGES" -dnf install -y $PACKAGES -dnf clean all && rm -rf /var/cache/yum -EOF - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -# Rust is needed to build libcst from source (a build dep of pyarrow's requirements-build.txt); -# no prebuilt libcst wheel exists for these architectures. -if [ "$TARGETARCH" = "s390x" ] || [ "$TARGETARCH" = "ppc64le" ]; then - # Install Rust and set up environment - mkdir -p /opt/.cargo /opt/.rustup - export HOME=/root - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o rustup-init.sh - chmod +x rustup-init.sh - # RUSTUP_HOME must be set explicitly too: the base image ships a pre-existing - # /root/.rustup/settings.toml, which makes rustup-init skip configuring a default - # toolchain ("rustup could not choose a version of rustc to run"). Isolating - # RUSTUP_HOME (like CARGO_HOME) and pinning --default-toolchain avoids that. - CARGO_HOME=/opt/.cargo RUSTUP_HOME=/opt/.rustup HOME=/root ./rustup-init.sh -y --no-modify-path \ - --default-toolchain stable --profile minimal - rm -f rustup-init.sh - chown -R 1001:0 /opt/.cargo /opt/.rustup - # Set environment variables - cat > /etc/profile.d/cargo.sh <<'CARGO_EOF' -export PATH=/opt/.cargo/bin:$PATH -export CARGO_HOME=/opt/.cargo -export RUSTUP_HOME=/opt/.rustup -export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 -CARGO_EOF -fi -EOF - -# Set python alternatives only for s390x (not needed for other arches) -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "s390x" ]; then - alternatives --install /usr/bin/python python /usr/bin/python3.12 1 - alternatives --install /usr/bin/python3 python3 /usr/bin/python3.12 1 - python --version && python3 --version -fi -EOF - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz -tar -xzvf /tmp/openshift-client-linux.tar.gz oc -rm -f /tmp/openshift-client-linux.tar.gz -EOF - -# Install the oc client end - -############################## -# wheel-builder stage # -# NOTE: Only used in ppc64le and s390x -############################## -FROM cpu-base AS pyarrow-builder - -ARG TARGETARCH -# hadolint ignore=DL3002 -USER 0 -WORKDIR /tmp/build-wheels - -# Build pyarrow on ppc64le and s390x -RUN --mount=type=cache,target=/root/.cache/pip \ - --mount=type=cache,target=/root/.cache/dnf /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then - # /etc/profile.d scripts aren't sourced by non-login RUN shells; source explicitly for cargo/rustc. - source /etc/profile.d/cargo.sh - PYARROW_VERSION=$(python3 /tmp/pylock_version.py /tmp/pylock.toml pyarrow --platform "$TARGETARCH") - # pylock_version prints raw PEP 440; git tags need apache-arrow- prefix (no +local segment today). - ARROW_BRANCH="apache-arrow-${PYARROW_VERSION}" - # Install build dependencies (shared for pyarrow and onnx) - # ninja-build is required by scikit-build-core (pyarrow's PEP 517 build backend) to drive - # the CMake build; `python -m build` fails with "Missing dependencies: ninja>=1.5" without it. - dnf install -y cmake make gcc-c++ pybind11-devel wget ninja-build - dnf clean all - # Build and collect pyarrow wheel - git clone --depth 1 --branch "${ARROW_BRANCH}" https://github.com/apache/arrow.git - cd arrow/cpp - mkdir release && cd release - # Pin to a fixed archive.apache.org URL instead of Arrow's default closer.lua mirror redirect, - # which is unreliable in CI. Version must match ARROW_ORC_BUILD_VERSION in - # arrow/cpp/thirdparty/versions.txt for the pinned PYARROW_VERSION, or the bundled ORC build - # fails a checksum mismatch. - export ARROW_ORC_URL="https://archive.apache.org/dist/orc/orc-2.2.1/orc-2.2.1.tar.gz" - cmake -DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_INSTALL_PREFIX=/usr/local \ - -DARROW_PYTHON=ON \ - -DARROW_PARQUET=ON \ - -DARROW_ORC=ON \ - -DARROW_FILESYSTEM=ON \ - -DARROW_JSON=ON \ - -DARROW_CSV=ON \ - -DARROW_DATASET=ON \ - -DARROW_DEPENDENCY_SOURCE=BUNDLED \ - -DARROW_WITH_LZ4=OFF \ - -DARROW_WITH_ZSTD=OFF \ - -DARROW_WITH_SNAPPY=OFF \ - -DARROW_BUILD_TESTS=OFF \ - -DARROW_BUILD_BENCHMARKS=OFF \ - .. - make -j$(nproc) VERBOSE=1 - make install -j$(nproc) - cd ../../python - pip install --no-cache-dir -r requirements-build.txt - pip install --upgrade pip - # RHAIENG-5986: requirements-build.txt may pull setuptools 82+ (no pkg_resources) - pip install --force-reinstall setuptools==80.9.0 wheel - # Arrow 25.0.0 dropped python/setup.py for a PEP 517 (scikit-build-core) build; - # `python -m build` replaces `python setup.py build_ext ... bdist_wheel`. The - # PYARROW_WITH_*/PYARROW_BUNDLE_ARROW_CPP env vars are still read directly by - # python/CMakeLists.txt, so they carry over unchanged; PYARROW_PARALLEL is gone - # (Ninja/scikit-build-core parallelize automatically). - PYARROW_WITH_PARQUET=1 \ - PYARROW_WITH_DATASET=1 \ - PYARROW_WITH_FILESYSTEM=1 \ - PYARROW_WITH_JSON=1 \ - PYARROW_WITH_CSV=1 \ - PYARROW_BUNDLE_ARROW_CPP=1 \ - python -m build --wheel --no-isolation --outdir dist . - mkdir -p /tmp/wheels - cp dist/pyarrow-*.whl /tmp/wheels/ - chmod -R 777 /tmp/wheels - # Ensure wheels directory exists and has content - ls -la /tmp/wheels/ -else - # Create empty wheels directory for non-s390x - mkdir -p /tmp/wheels -fi -EOF - -####################################################### -# common-builder (for Power-only) -####################################################### -FROM cpu-base AS common-builder -ARG TARGETARCH -# hadolint ignore=DL3002 -USER root -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "${TARGETARCH}" = "ppc64le" ]; then - dnf install -y gcc-toolset-13 cmake ninja-build git wget unzip - dnf clean all -else - echo "Skipping common-builder package install on non-Power" -fi -EOF - -####################################################### -# onnx-builder (Power-only) -####################################################### -FROM common-builder AS onnx-builder -ARG TARGETARCH -WORKDIR /root -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "${TARGETARCH}" = "ppc64le" ]; then - ONNX_VERSION=$(python3 /tmp/pylock_version.py /tmp/pylock.toml onnx --platform ppc64le) - # pylock_version prints raw PEP 440; ONNX git tags use v prefix (no +local segment today). - ONNX_TAG="v${ONNX_VERSION}" - source /opt/rh/gcc-toolset-13/enable - git clone --recursive https://github.com/onnx/onnx.git - cd onnx - git checkout "${ONNX_TAG}" - git submodule update --init --recursive - # numpy from requirements-min.txt builds from sdist on ppc64le (no PyPI wheel); needs BLAS. - dnf install -y openblas-devel - dnf clean all - pip install --no-cache-dir -r requirements-min.txt - CMAKE_ARGS="-DPython3_EXECUTABLE=$(which python3.12)" - export CMAKE_ARGS - pip wheel . -w /root/onnx_wheel -else - echo "Skipping ONNX build on non-Power" - mkdir -p /root/onnx_wheel -fi -EOF - -####################################################### -# openblas-builder (Power-only) -####################################################### -FROM common-builder AS openblas-builder -ARG TARGETARCH -ARG OPENBLAS_VERSION=0.3.30 -WORKDIR /root -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "${TARGETARCH}" = "ppc64le" ]; then - wget --progress=dot:giga https://github.com/OpenMathLib/OpenBLAS/releases/download/v${OPENBLAS_VERSION}/OpenBLAS-${OPENBLAS_VERSION}.zip - unzip OpenBLAS-${OPENBLAS_VERSION}.zip - cd OpenBLAS-${OPENBLAS_VERSION} - make -j$(nproc) TARGET=POWER9 BINARY=64 USE_OPENMP=1 USE_THREAD=1 NUM_THREADS=120 DYNAMIC_ARCH=1 INTERFACE64=0 -else - mkdir -p OpenBLAS-${OPENBLAS_VERSION} - echo "Skipping OpenBLAS build on non-Power" -fi -EOF - -#################### -# jupyter-minimal # -#################### -FROM cpu-base AS jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ -COPY ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] - - -######################## -# jupytyer-datascience # -######################## -FROM jupyter-minimal AS jupyter-datascience -ARG TARGETARCH - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -ARG OPENBLAS_VERSION=0.3.30 -ARG TARGETARCH - -LABEL name="odh-notebook-jupyter-datascience-ubi9-python-3.12" \ - summary="Jupyter data science notebook image for ODH notebooks" \ - description="Jupyter data science notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Jupyter data science notebook image for ODH notebooks" \ - io.k8s.description="Jupyter data science notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/datascience/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:jupyter-datascience-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Install useful OS packages -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -dnf install -y jq unixODBC unixODBC-devel postgresql git-lfs libsndfile libxcrypt-compat -dnf clean all && rm -rf /var/cache/yum -EOF - -# Copy dynamically-linked mongocli built in earlier build stage -COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ - -# Other apps and tools installed as default user -USER 1001 - -ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ - -# Copy wheels from build stage (ppc64le and s390x only) -COPY --from=pyarrow-builder /tmp/wheels /tmp/wheels -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then - pip install --no-cache-dir /tmp/wheels/*.whl -else - echo "Skipping wheel install for $TARGETARCH" -fi -EOF - -# Copy OpenBLAS,ONNX wheels for Power -COPY --from=openblas-builder /root/OpenBLAS-${OPENBLAS_VERSION} /openblas -COPY --from=onnx-builder /root/onnx_wheel/ /onnxwheels/ - -# Power-specific ONNX/OpenBLAS installation -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "${TARGETARCH}" = "ppc64le" ]; then - pip install --no-cache-dir /onnxwheels/*.whl -else - echo "Skipping ONNX/OpenBLAS install on non-Power" -fi -EOF - -USER root -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "${TARGETARCH}" = "ppc64le" ]; then - rm -rf /onnxwheels -else - echo "Skipping ONNX/OpenBLAS install on non-Power" -fi -EOF - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "${TARGETARCH}" = "ppc64le" ]; then - PREFIX=/usr/local make -C /openblas install - rm -rf /openblas -else - echo "Skipping ONNX/OpenBLAS install on non-Power" -fi -EOF - -USER 1001:0 - -# Install Python packages and Jupyterlab extensions from pylock.toml -COPY ${DATASCIENCE_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra setup to utils so that it's sourced at startup -COPY ${DATASCIENCE_SOURCE_CODE}/setup-elyra.sh ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -RUN --mount=type=cache,target=/root/.cache/pip \ - echo "Installing software and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - # RHOAIENG-58277: Meson 1.11.0 breaks pandas 2.3.3 source builds - echo "meson<1.11" > build_constraints.txt && \ - if [ "$TARGETARCH" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then \ - # We need special flags and environment variables when building packages - GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \ - CFLAGS="-O3" CXXFLAGS="-O3" \ - uv pip install --strict --no-deps --no-cache --no-config --no-progress \ - --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match \ - --build-constraint build_constraints.txt \ - --requirements=./pylock.toml; \ - else \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress \ - --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match \ - --requirements=./pylock.toml; \ - fi && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - mkdir /opt/app-root/pipeline-runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" \ - /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - install -D -m 0644 /opt/app-root/bin/utils/jupyter_server_config.py \ - /opt/app-root/etc/jupyter/jupyter_server_config.py && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -WORKDIR /opt/app-root/src diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.cpu b/jupyter/minimal/ubi9-python-3.12/Dockerfile.cpu deleted file mode 100644 index 5e78e6577b..0000000000 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.cpu +++ /dev/null @@ -1,100 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# cpu-base # -#################### -FROM ${BASE_IMAGE} AS cpu-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -#################### -# jupyter-minimal # -#################### -FROM cpu-base AS jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -LABEL name="odh-notebook-jupyter-minimal-ubi9-python-3.12" \ - summary="Minimal Jupyter notebook image for ODH notebooks" \ - description="Minimal Jupyter notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Minimal Jupyter notebook image for ODH notebooks" \ - io.k8s.description="Minimal Jupyter notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/minimal/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:jupyter-minimal-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -# Install Python dependencies from requirements.txt file -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.cuda b/jupyter/minimal/ubi9-python-3.12/Dockerfile.cuda deleted file mode 100644 index a208cd51f0..0000000000 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.cuda +++ /dev/null @@ -1,102 +0,0 @@ -ARG TARGETARCH - -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# cuda-base # -#################### -FROM ${BASE_IMAGE} AS cuda-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################### -# cuda-jupyter-minimal # -######################### -FROM cuda-base AS cuda-jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -LABEL name="odh-notebook-jupyter-cuda-minimal-ubi9-python-3.12" \ - summary="Minimal Jupyter CUDA notebook image for ODH notebooks" \ - description="Minimal Jupyter CUDA notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Minimal Jupyter CUDA notebook image for ODH notebooks" \ - io.k8s.description="Minimal Jupyter CUDA notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/minimal/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:cuda-jupyter-minimal-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -# Install Python dependencies from requirements.txt file -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.rocm b/jupyter/minimal/ubi9-python-3.12/Dockerfile.rocm deleted file mode 100644 index 2daf05a4d8..0000000000 --- a/jupyter/minimal/ubi9-python-3.12/Dockerfile.rocm +++ /dev/null @@ -1,111 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# rocm-base # -#################### -FROM ${BASE_IMAGE} AS rocm-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################## -# rocm-jupyter-minimal # -######################## -FROM rocm-base AS rocm-jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -LABEL name="odh-notebook-jupyter-rocm-minimal-ubi9-python-3.12" \ - summary="Minimal Jupyter ROCm notebook image for ODH notebooks" \ - description="Minimal Jupyter ROCm notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Minimal Jupyter ROCm notebook image for ODH notebooks" \ - io.k8s.description="Minimal Jupyter ROCm notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/minimal/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:rocm-jupyter-minimal-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -# Install Python dependencies from Pipfile.lock file -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh - -# Fix permissions to support pip in Openshift environments \ -USER 0 -RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P -USER 1001 - -# Workaround for https://issues.redhat.com/browse/AIPCC-8152 -ENV ROCM_PATH=/opt/rocm -# Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds -# https://issues.redhat.com/browse/AIPCC-5882 -USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all -USER 1001 - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] diff --git a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda deleted file mode 100644 index 7f4cdcba1b..0000000000 --- a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda +++ /dev/null @@ -1,159 +0,0 @@ -ARG TARGETARCH - -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -###################################################### -# mongocli-builder (build stage only, not published) # -###################################################### -FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder - -ARG MONGOCLI_VERSION=2.0.4 - -WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ - -#################### -# cuda-base # -#################### -FROM ${BASE_IMAGE} AS cuda-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################### -# cuda-jupyter-minimal # -######################### -FROM cuda-base AS cuda-jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -COPY ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] - -############################# -# cuda-jupyter-datascience # -############################# -FROM cuda-jupyter-minimal AS cuda-jupyter-datascience - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Copy dynamically-linked mongocli built in earlier build stage -COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ - -# Other apps and tools installed as default user -USER 1001 - -# Copy Elyra setup to utils so that it's sourced at startup -COPY ${DATASCIENCE_SOURCE_CODE}/setup-elyra.sh ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -WORKDIR /opt/app-root/src - -############################# -# cuda-jupyter-pytorch # -############################# -FROM cuda-jupyter-datascience AS cuda-jupyter-pytorch - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -ARG PYTORCH_SOURCE_CODE=jupyter/pytorch+llmcompressor/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -LABEL name="odh-notebook-jupyter-cuda-pytorch-llmcompressor-ubi9-python-3.12" \ - summary="Jupyter CUDA pytorch-llmcompressor notebook image for ODH notebooks" \ - description="Jupyter CUDA pytorch-llmcompressor notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Jupyter CUDA pytorch-llmcompressor notebook image for ODH notebooks" \ - io.k8s.description="Jupyter CUDA pytorch-llmcompressor notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/pytorch+llmcompressor/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:cuda-jupyter-pytorch-llmcompressor-ubi9-python-3.12" - -# Install Python packages and Jupyterlab extensions from requirements.txt -COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -WORKDIR /opt/app-root/src diff --git a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.cuda b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.cuda deleted file mode 100644 index edf6b12475..0000000000 --- a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.cuda +++ /dev/null @@ -1,159 +0,0 @@ -ARG TARGETARCH - -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -###################################################### -# mongocli-builder (build stage only, not published) # -###################################################### -FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder - -ARG MONGOCLI_VERSION=2.0.4 - -WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ - -#################### -# cuda-base # -#################### -FROM ${BASE_IMAGE} AS cuda-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################### -# cuda-jupyter-minimal # -######################### -FROM cuda-base AS cuda-jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -COPY ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] - -############################# -# cuda-jupyter-datascience # -############################# -FROM cuda-jupyter-minimal AS cuda-jupyter-datascience - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Copy dynamically-linked mongocli built in earlier build stage -COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ - -# Other apps and tools installed as default user -USER 1001 - -# Copy Elyra setup to utils so that it's sourced at startup -COPY ${DATASCIENCE_SOURCE_CODE}/setup-elyra.sh ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -WORKDIR /opt/app-root/src - -############################# -# cuda-jupyter-pytorch # -############################# -FROM cuda-jupyter-datascience AS cuda-jupyter-pytorch - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -ARG PYTORCH_SOURCE_CODE=jupyter/pytorch/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -LABEL name="odh-notebook-jupyter-cuda-pytorch-ubi9-python-3.12" \ - summary="Jupyter CUDA pytorch notebook image for ODH notebooks" \ - description="Jupyter CUDA pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Jupyter CUDA pytorch notebook image for ODH notebooks" \ - io.k8s.description="Jupyter CUDA pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/pytorch/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:cuda-jupyter-pytorch-ubi9-python-3.12" - -# Install Python packages and Jupyterlab extensions from requirements.txt -COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -WORKDIR /opt/app-root/src diff --git a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.rocm b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.rocm deleted file mode 100644 index 4b8eee1ff2..0000000000 --- a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.rocm +++ /dev/null @@ -1,177 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -###################################################### -# mongocli-builder (build stage only, not published) # -###################################################### -FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder - -ARG MONGOCLI_VERSION=2.0.4 - -WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ - -#################### -# rocm-base # -#################### -FROM ${BASE_IMAGE} AS rocm-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################## -# rocm-jupyter-minimal # -######################## -FROM rocm-base AS rocm-jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -COPY ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] - -############################ -# rocm-jupyter-datascience # -############################ -FROM rocm-jupyter-minimal AS rocm-jupyter-datascience - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Copy dynamically-linked mongocli built in earlier build stage -COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ - -# Other apps and tools installed as default user -USER 1001 - -# Copy Elyra setup to utils so that it's sourced at startup -COPY ${DATASCIENCE_SOURCE_CODE}/setup-elyra.sh ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -WORKDIR /opt/app-root/src - -######################## -# rocm-jupyter-pytorch # -######################## -FROM rocm-jupyter-datascience AS rocm-jupyter-pytorch - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -ARG PYTORCH_SOURCE_CODE=jupyter/rocm/pytorch/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -LABEL name="odh-notebook-jupyter-rocm-pytorch-ubi9-python-3.12" \ - summary="Jupyter ROCm pytorch notebook image for ODH notebooks" \ - description="Jupyter ROCm pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Jupyter ROCm pytorch notebook image for ODH notebooks" \ - io.k8s.description="Jupyter ROCm pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/rocm/pytorch/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:rocm-jupyter-pytorch-ubi9-python-3.12" - -COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ${PYTORCH_SOURCE_CODE}/de-vendor-torch.sh ./ - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -echo "Installing softwares and packages" -# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, -# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. -uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml -# setup path for runtime configuration -mkdir /opt/app-root/runtimes -# Remove default Elyra runtime-images -rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json -# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y -sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json -# copy jupyter configuration -cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter -# Disable announcement plugin of jupyterlab -jupyter labextension disable "@jupyterlab/apputils-extension:announcements" -# Apply JupyterLab addons -/opt/app-root/bin/utils/addons/apply.sh -# De-vendor ROCm libs embedded in Pytorch (same layer as pip — shrinks commit peak) -./de-vendor-torch.sh -rm ./de-vendor-torch.sh -EOF - -USER 0 -# Fix permissions to support pip in Openshift environments -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -chmod -R g+w /opt/app-root/lib/python3.12/site-packages || true -fix-permissions /opt/app-root -P -EOF - -USER 1001 - -# Workaround for https://issues.redhat.com/browse/AIPCC-8152 -ENV ROCM_PATH=/opt/rocm -# Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds -# https://issues.redhat.com/browse/AIPCC-5882 -USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all -USER 1001 - -WORKDIR /opt/app-root/src diff --git a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.rocm b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.rocm deleted file mode 100644 index ae36ce3711..0000000000 --- a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.rocm +++ /dev/null @@ -1,179 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -###################################################### -# mongocli-builder (build stage only, not published) # -###################################################### -FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder - -ARG MONGOCLI_VERSION=2.0.4 - -WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ - -#################### -# rocm-base # -#################### -FROM ${BASE_IMAGE} AS rocm-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################## -# rocm-jupyter-minimal # -######################## -FROM rocm-base AS rocm-jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -COPY ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] - -############################ -# rocm-jupyter-datascience # -############################ -FROM rocm-jupyter-minimal AS rocm-jupyter-datascience - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile && dnf clean all && rm -rf /var/cache/yum - -# Copy dynamically-linked mongocli built in earlier build stage -COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ - -# Other apps and tools installed as default user -USER 1001 - -# Copy Elyra setup to utils so that it's sourced at startup -COPY ${DATASCIENCE_SOURCE_CODE}/setup-elyra.sh ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -WORKDIR /opt/app-root/src - -########################### -# rocm-jupyter-tensorflow # -########################### -FROM rocm-jupyter-datascience AS rocm-jupyter-tensorflow - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -ARG TENSORFLOW_SOURCE_CODE=jupyter/rocm/tensorflow/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# CVE-2026-2492: Disable HDF5 plugin loading to prevent local privilege escalation -# via unsecured plugin search path in TensorFlow's h5py integration -ENV HDF5_PLUGIN_PATH=disable - -LABEL name="odh-notebook-jupyter-rocm-tensorflow-ubi9-python-3.12" \ - summary="Jupyter AMD tensorflow notebook image for ODH notebooks" \ - description="Jupyter AMD tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Jupyter AMD tensorflow notebook image for ODH notebooks" \ - io.k8s.description="Jupyter AMD tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/rocm/tensorflow/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:rocm-jupyter-tensorflow-ubi9-python-3.12" - -COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - # Not using --build-constraints=./requirements.txt because error: Unnamed requirements are not allowed as constraints (found: `https://repo.radeon.com/rocm/manylinux/rocm-rel-6.4/ - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh - -# Fix permissions to support pip in Openshift environments \ -USER 0 -RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P -USER 1001 - -COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ - -USER 0 -COPY ${TENSORFLOW_SOURCE_CODE}/utils/link-solibs.sh /tmp/link-solibs.sh -RUN /tmp/link-solibs.sh && rm /tmp/link-solibs.sh - -# Workaround for https://issues.redhat.com/browse/AIPCC-8152 -ENV ROCM_PATH=/opt/rocm -# Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds -# https://issues.redhat.com/browse/AIPCC-5882 -USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all -USER 1001 - -WORKDIR /opt/app-root/src diff --git a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.cuda b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.cuda deleted file mode 100644 index 8ba9aea7d6..0000000000 --- a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.cuda +++ /dev/null @@ -1,166 +0,0 @@ -ARG TARGETARCH - -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -###################################################### -# mongocli-builder (build stage only, not published) # -###################################################### -FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder - -ARG MONGOCLI_VERSION=2.0.4 - -WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ - -#################### -# cuda-base # -#################### -FROM ${BASE_IMAGE} AS cuda-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################### -# cuda-jupyter-minimal # -######################### -FROM cuda-base AS cuda-jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ - -COPY ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] - -############################# -# cuda-jupyter-datascience # -############################# -FROM cuda-jupyter-minimal AS cuda-jupyter-datascience - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Copy dynamically-linked mongocli built in earlier build stage -COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ - -# Other apps and tools installed as default user -USER 1001 - -# Copy Elyra setup to utils so that it's sourced at startup -COPY ${DATASCIENCE_SOURCE_CODE}/setup-elyra.sh ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -WORKDIR /opt/app-root/src - -############################ -# cuda-jupyter-tensorflow # -############################ -FROM cuda-jupyter-datascience AS cuda-jupyter-tensorflow - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -ARG TENSORFLOW_SOURCE_CODE=jupyter/tensorflow/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# CVE-2026-2492: Disable HDF5 plugin loading to prevent local privilege escalation -# via unsecured plugin search path in TensorFlow's h5py integration -ENV HDF5_PLUGIN_PATH=disable - -LABEL name="odh-notebook-cuda-jupyter-tensorflow-ubi9-python-3.12" \ - summary="Jupyter CUDA tensorflow notebook image for ODH notebooks" \ - description="Jupyter CUDA tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Jupyter CUDA tensorflow notebook image for ODH notebooks" \ - io.k8s.description="Jupyter CUDA tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/tensorflow/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:cuda-jupyter-tensorflow-ubi9-python-3.12" - -# Install Python packages and Jupyterlab extensions from requirements.txt -COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # setup path for runtime configuration - mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ - -WORKDIR /opt/app-root/src diff --git a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.cpu b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.cpu deleted file mode 100644 index 78e49fe6e4..0000000000 --- a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.cpu +++ /dev/null @@ -1,222 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -###################################################### -# mongocli-builder (build stage only, not published) # -###################################################### -FROM registry.access.redhat.com/ubi9/go-toolset:latest AS mongocli-builder - -ARG MONGOCLI_VERSION=2.0.4 - -WORKDIR /tmp/ -RUN curl -Lo mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip https://github.com/mongodb/mongodb-cli/archive/refs/tags/mongocli/v${MONGOCLI_VERSION}.zip -RUN unzip ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}.zip -RUN cd ./mongodb-cli-mongocli-v${MONGOCLI_VERSION}/ && \ - CGO_ENABLED=1 GOOS=linux go build -a -tags strictfipsruntime -o /tmp/mongocli ./cmd/mongocli/ -#################### -# wheel-cache-base # -#################### -FROM ${BASE_IMAGE} AS whl-cache - -# hadolint ignore=DL3002 -USER root -ENV HOME=/root -WORKDIR /root - -ARG TRUSTYAI_SOURCE_CODE=jupyter/trustyai/ubi9-python-3.12 - -COPY ${TRUSTYAI_SOURCE_CODE}/pylock.toml . -COPY ${TRUSTYAI_SOURCE_CODE}/pyproject.toml . -COPY ${TRUSTYAI_SOURCE_CODE}/devel_env_setup.sh . -COPY scripts/pylock_version.py ./pylock_version.py - -RUN --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF' -set -Eeuxo pipefail -pip install --no-cache-dir "uv==0.8.12" -# the devel script is ppc64le specific - sets up build-time dependencies -source ./devel_env_setup.sh -# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, -# RHAIENG-5986: cap setuptools version in isolated sdist builds (pkg_resources removed in 82+) -printf '%s\n' 'setuptools>=80.9.0,<82' > build_constraints.txt -# [tool.uv] extra-build-dependencies in pyproject.toml supplies setuptools for pandas; -# pylock.toml is the install input; pyproject.toml is copied for uv config only. -# do not use --no-config — uv must discover pyproject.toml in this directory. -# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. -UV_LINK_MODE=copy uv pip install --strict --no-deps --refresh --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml --build-constraint build_constraints.txt -EOF - -#################### -# cpu-base # -#################### -FROM ${BASE_IMAGE} AS cpu-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -#################### -# jupyter-minimal # -#################### -FROM cpu-base AS jupyter-minimal - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -COPY ${JUPYTER_REUSABLE_UTILS} utils/ -COPY ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./ - -USER 0 - -# Dependencies for PDF export begin -RUN ./utils/install_pdf_deps.sh -# Dependencies for PDF export end - -USER 1001 - -WORKDIR /opt/app-root/src - -ENTRYPOINT ["start-notebook.sh"] - - -######################## -# jupyter-datascience # -######################## -FROM jupyter-minimal AS jupyter-datascience - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER root - -# Install useful OS packages -RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Copy dynamically-linked mongocli built in earlier build stage -COPY --from=mongocli-builder /tmp/mongocli /opt/app-root/bin/ - -# Other apps and tools installed as default user -USER 1001 - -# Copy Elyra setup to utils so that it's sourced at startup -COPY ${DATASCIENCE_SOURCE_CODE}/setup-elyra.sh ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -WORKDIR /opt/app-root/src - -#################### -# jupyter-trustyai # -#################### -FROM jupyter-datascience AS jupyter-trustyai - -ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12 -ARG TRUSTYAI_SOURCE_CODE=jupyter/trustyai/ubi9-python-3.12 - -ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib - -LABEL name="odh-notebook-jupyter-trustyai-ubi9-python-3.12" \ - summary="Jupyter trustyai notebook image for ODH notebooks" \ - description="Jupyter trustyai notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Jupyter trustyai notebook image for ODH notebooks" \ - io.k8s.description="Jupyter trustyai notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/trustyai/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:jupyter-trustyai-ubi9-python-3.12" - -USER 0 - -# Install jre that is needed to run the trustyai library -RUN INSTALL_PKGS="java-17-openjdk" && \ - dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \ - dnf -y clean all --enablerepo='*' - -# Install Python packages and Jupyterlab extensions from requirements.txt -COPY ${TRUSTYAI_SOURCE_CODE}/pylock.toml ./ -COPY ${TRUSTYAI_SOURCE_CODE}/pyproject.toml ./ - -# install openblas for ppc64le -RUN --mount=type=cache,from=whl-cache,source=/root/OpenBLAS/,target=/OpenBlas/,rw \ - bash -c ' \ - if [[ $(uname -m) == "ppc64le" ]]; then \ - dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm; \ - dnf install -y libraqm libimagequant; \ - PREFIX=/usr/ make install -C /OpenBlas; \ - fi ' - -# Install packages and cleanup -# install packages as USER 0 (this will allow us to consume uv cache) -RUN --mount=type=cache,from=whl-cache,source=/wheelsdir/,target=/wheelsdir/,rw \ - --mount=type=cache,target=/root/.cache/uv \ - bash -c ' \ - if [[ $(uname -m) == "ppc64le" ]]; then \ - UV_LINK_MODE=copy uv pip install /wheelsdir/*.whl accelerate --cache-dir /root/.cache/uv; \ - fi ' -RUN --mount=type=cache,target=/root/.cache/uv \ - echo "Installing softwares and packages" && \ - # RHAIENG-5986: pandas 1.5.3 needs setuptools/pkg_resources at build time; pyproject.toml - # supplies [tool.uv] extra-build-dependencies and must remain discoverable (no --no-config). - printf '%s\n' 'setuptools>=80.9.0,<82' > build_constraints.txt && \ - # we can ensure wheels are consumed from the cache only by restricting internet access for uv install with '--offline' flag - UV_LINK_MODE=copy uv pip install --cache-dir /root/.cache/uv --requirements=./pylock.toml --build-constraint build_constraints.txt && \ - # Note: debugpy wheel availabe on pypi (in uv cache) is none-any but bundles amd64.so files - # Build debugpy from source instead - UV_LINK_MODE=copy uv pip install --no-cache git+https://github.com/microsoft/debugpy.git@v$(grep -A1 '\"debugpy\"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b') && \ - # change ownership to default user (all packages were installed as root and has root:root ownership \ - chown -R 1001:0 /opt/app-root/ - -USER 1001 - -# setup path for runtime configuration -RUN mkdir /opt/app-root/runtimes && \ - # Remove default Elyra runtime-images \ - rm /opt/app-root/share/jupyter/metadata/runtime-images/*.json && \ - # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \ - sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \ - # copy jupyter configuration - cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \ - # Disable announcement plugin of jupyterlab \ - jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \ - # Apply JupyterLab addons \ - /opt/app-root/bin/utils/addons/apply.sh && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P diff --git a/runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu b/runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu deleted file mode 100644 index 27155152a3..0000000000 --- a/runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu +++ /dev/null @@ -1,442 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# cpu-base # -#################### -FROM ${BASE_IMAGE} AS cpu-base - -ARG TARGETARCH -ARG DATASCIENCE_SOURCE_CODE=runtimes/datascience/ubi9-python-3.12 -COPY ${DATASCIENCE_SOURCE_CODE}/pylock.toml /tmp/pylock.toml -COPY scripts/pylock_version.py /tmp/pylock_version.py - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -ARG TARGETARCH - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 -dnf clean all -y -EOF - -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN --mount=type=cache,target=/var/cache/dnf /bin/bash <<'EOF' -set -Eeuxo pipefail -echo "Building for architecture: ${TARGETARCH}" -PACKAGES="perl mesa-libGL skopeo libxcrypt-compat" -# Additional dev tools only for s390x -if [ "$TARGETARCH" = "s390x" ]; then - PACKAGES="$PACKAGES gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel openssl zlib-devel" -fi -if [ "$TARGETARCH" = "ppc64le" ]; then - PACKAGES="$PACKAGES git gcc-toolset-13 make wget unzip rust cargo unixODBC-devel cmake ninja-build" -fi -if [ -n "$PACKAGES" ]; then - echo "Installing: $PACKAGES" - dnf install -y $PACKAGES - dnf clean all && rm -rf /var/cache/yum -fi -EOF - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "ppc64le" ]; then - ONNX_VERSION=$(python3 /tmp/pylock_version.py /tmp/pylock.toml onnx --platform ppc64le) - PYARROW_VERSION=$(python3 /tmp/pylock_version.py /tmp/pylock.toml pyarrow --platform ppc64le) - # NB: unquoted heredoc — escape $ for vars that must expand at login - cat > /etc/profile.d/ppc64le.sh < /etc/profile.d/cargo.sh <<'CARGO_EOF' -export PATH=/opt/.cargo/bin:$PATH -export CARGO_HOME=/opt/.cargo -export RUSTUP_HOME=/opt/.rustup -export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 -CARGO_EOF -fi -EOF - -# Set python alternatives only for s390x (not needed for other arches) -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "s390x" ]; then - alternatives --install /usr/bin/python python /usr/bin/python3.12 1 - alternatives --install /usr/bin/python3 python3 /usr/bin/python3.12 1 - python --version && python3 --version -fi -EOF - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz -tar -xzvf /tmp/openshift-client-linux.tar.gz oc -rm -f /tmp/openshift-client-linux.tar.gz -EOF - -# Install the oc client end - -############################## -# wheel-builder stage # -# NOTE: Only used in s390x -############################## -FROM cpu-base AS s390x-builder - -ARG TARGETARCH -# hadolint ignore=DL3002 -USER 0 -WORKDIR /tmp/build-wheels - -# Build pyarrow optimized for s390x -RUN --mount=type=cache,target=/root/.cache/pip \ - --mount=type=cache,target=/root/.cache/dnf /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "s390x" ]; then - # /etc/profile.d scripts aren't sourced by non-login RUN shells; source explicitly for cargo/rustc - # (needed to build libcst from source, a build dep of pyarrow's requirements-build.txt). - source /etc/profile.d/cargo.sh - PYARROW_VERSION=$(python3 /tmp/pylock_version.py /tmp/pylock.toml pyarrow --platform s390x) - # Install build dependencies - dnf install -y cmake make gcc-c++ pybind11-devel wget git \ - openssl-devel zlib-devel bzip2-devel lz4-devel \ - ninja-build - dnf clean all - # Clone specific version of arrow - git clone -b apache-arrow-${PYARROW_VERSION} https://github.com/apache/arrow.git - cd arrow - # Set environment variables for build - export ARROW_HOME=/usr/local - export LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} - export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:/usr/local/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH} - # Build C++ library first - cd cpp - mkdir build && cd build - # Pin to a fixed archive.apache.org URL instead of Arrow's default closer.lua mirror redirect, - # which is unreliable in CI. Version must match ARROW_ORC_BUILD_VERSION in - # arrow/cpp/thirdparty/versions.txt for the pinned PYARROW_VERSION, or the bundled ORC build - # fails a checksum mismatch. - export ARROW_ORC_URL="https://archive.apache.org/dist/orc/orc-2.2.1/orc-2.2.1.tar.gz" - cmake -DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_INSTALL_PREFIX=$ARROW_HOME \ - -DARROW_PYTHON=ON \ - -DARROW_PARQUET=ON \ - -DARROW_ORC=ON \ - -DARROW_FILESYSTEM=ON \ - -DARROW_JSON=ON \ - -DARROW_CSV=ON \ - -DARROW_DATASET=ON \ - -DARROW_WITH_LZ4=ON \ - -DARROW_WITH_ZSTD=ON \ - -DARROW_WITH_SNAPPY=OFF \ - -DARROW_WITH_BZ2=ON \ - -DARROW_WITH_ZLIB=ON \ - -DARROW_BUILD_TESTS=OFF \ - -DARROW_BUILD_BENCHMARKS=OFF \ - -DARROW_USE_CCACHE=OFF \ - -GNinja \ - .. - ninja install - cd ../../python - # Install Python build requirements - pip install --no-cache-dir -r requirements-build.txt - pip install --upgrade pip - # RHAIENG-5986: requirements-build.txt may pull setuptools 82+ (no pkg_resources) - pip install --force-reinstall setuptools==80.9.0 wheel - # Build Python package - # Arrow 25.0.0 dropped python/setup.py for a PEP 517 (scikit-build-core) build; - # `python -m build` replaces `python setup.py build_ext ... bdist_wheel`. The - # PYARROW_WITH_*/PYARROW_BUNDLE_ARROW_CPP env vars are still read directly by - # python/CMakeLists.txt, so they carry over unchanged; PYARROW_PARALLEL is gone - # (Ninja/scikit-build-core parallelize automatically). - PYARROW_WITH_PARQUET=1 \ - PYARROW_WITH_DATASET=1 \ - PYARROW_WITH_FILESYSTEM=1 \ - PYARROW_WITH_JSON=1 \ - PYARROW_WITH_CSV=1 \ - PYARROW_WITH_LZ4=1 \ - PYARROW_WITH_ZSTD=1 \ - PYARROW_WITH_BZ2=1 \ - PYARROW_BUNDLE_ARROW_CPP=1 \ - python -m build --wheel --no-isolation --outdir dist . - mkdir -p /tmp/wheels - cp dist/pyarrow-*.whl /tmp/wheels/ - # Ensure wheels directory exists and has content - ls -la /tmp/wheels/ -else - # Create empty wheels directory for non-s390x - mkdir -p /tmp/wheels -fi -EOF - -################################### -# openblas builder stage for ppc64le -################################## - -FROM cpu-base AS openblas-builder -# hadolint ignore=DL3002 -USER root -WORKDIR /root - -ARG TARGETARCH - -ENV OPENBLAS_VERSION=0.3.30 - -RUN echo "openblas-builder stage TARGETARCH: ${TARGETARCH}" - -# Download and build OpenBLAS -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "ppc64le" ]; then - source /opt/rh/gcc-toolset-13/enable - wget --progress=dot:giga https://github.com/OpenMathLib/OpenBLAS/releases/download/v${OPENBLAS_VERSION}/OpenBLAS-${OPENBLAS_VERSION}.zip - unzip OpenBLAS-${OPENBLAS_VERSION}.zip && cd OpenBLAS-${OPENBLAS_VERSION} - make -j$(nproc) TARGET=POWER9 BINARY=64 USE_OPENMP=1 USE_THREAD=1 NUM_THREADS=120 DYNAMIC_ARCH=1 INTERFACE64=0 -else - echo "Not ppc64le, skipping OpenBLAS build" - mkdir -p /root/OpenBLAS-dummy -fi -EOF - -################################### -# onnx builder stage for ppc64le -################################### - -FROM cpu-base AS onnx-builder -# hadolint ignore=DL3002 -USER root -WORKDIR /root - -ARG TARGETARCH - -RUN echo "onnx-builder stage TARGETARCH: ${TARGETARCH}" - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "ppc64le" ]; then - source /etc/profile.d/ppc64le.sh - source /opt/rh/gcc-toolset-13/enable - git clone --recursive https://github.com/onnx/onnx.git - cd onnx && git checkout "v${ONNX_VERSION}" - git submodule update --init --recursive - # numpy from requirements-min.txt builds from sdist on ppc64le (no PyPI wheel); needs BLAS. - dnf install -y openblas-devel - dnf clean all - pip install --no-cache-dir -r requirements-min.txt - CMAKE_ARGS="-DPython3_EXECUTABLE=$(which python3.12)" - export CMAKE_ARGS - pip wheel . -w /onnx_wheels -else - echo "Not ppc64le, skipping ONNX build" - mkdir -p /onnx_wheels -fi -EOF - -################################### -# pyarrow builder stage for ppc64le -################################## - -FROM cpu-base AS arrow-builder -# hadolint ignore=DL3002 -USER root -WORKDIR /root - -ARG TARGETARCH - -RUN echo "arrow-builder stage TARGETARCH: ${TARGETARCH}" - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "ppc64le" ]; then - source /etc/profile.d/ppc64le.sh - git clone -b apache-arrow-${PYARROW_VERSION} https://github.com/apache/arrow.git --recursive - cd arrow && rm -rf .git && mkdir dist - pip3 install --no-cache-dir -r python/requirements-build.txt - ARROW_HOME=$(pwd)/dist - export ARROW_HOME - LD_LIBRARY_PATH=$(pwd)/dist/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} - export LD_LIBRARY_PATH - export CMAKE_PREFIX_PATH=${ARROW_HOME}${CMAKE_PREFIX_PATH:+:$CMAKE_PREFIX_PATH} - export PARQUET_TEST_DATA="${PWD}/cpp/submodules/parquet-testing/data" - export ARROW_TEST_DATA="${PWD}/testing/data" - cmake -S cpp -B cpp/build \ - -DCMAKE_INSTALL_PREFIX=$ARROW_HOME \ - -DCMAKE_BUILD_TYPE=release \ - -DARROW_WITH_BZ2=ON \ - -DARROW_WITH_ZLIB=ON \ - -DARROW_WITH_ZSTD=ON \ - -DARROW_WITH_LZ4=ON \ - -DARROW_WITH_SNAPPY=ON \ - -DARROW_WITH_BROTLI=ON \ - -DARROW_DATASET=ON \ - -DARROW_FILESYSTEM=ON \ - -DARROW_COMPUTE=ON \ - -DARROW_JSON=ON \ - -DARROW_CSV=ON \ - -DARROW_PYTHON=ON \ - -DARROW_PARQUET=ON \ - -DARROW_BUILD_SHARED=ON \ - -DARROW_BUILD_TESTS=OFF - cd cpp/build - make -j20 install - export PYARROW_WITH_PARQUET=1 - export PYARROW_WITH_DATASET=1 - export PYARROW_BUNDLE_ARROW_CPP=1 - pip3 install --upgrade pip - # RHAIENG-5986: requirements-build.txt may pull setuptools 82+ (no pkg_resources) - pip3 install --force-reinstall setuptools==80.9.0 wheel - cd ../../python - # Arrow 25.0.0 dropped python/setup.py for a PEP 517 (scikit-build-core) build; - # `python -m build` replaces `python setup.py build_ext ... bdist_wheel`. The - # PYARROW_WITH_*/PYARROW_BUNDLE_ARROW_CPP env vars exported above are still read - # directly by python/CMakeLists.txt, so they carry over unchanged; PYARROW_PARALLEL - # is gone (Ninja/scikit-build-core parallelize automatically). - python -m build --wheel --no-isolation --outdir /arrowwheels . -else - echo "Not ppc64le, skipping pyarrow build" - mkdir -p /arrowwheels -fi -EOF - -####################### -# runtime-datascience # -####################### -FROM cpu-base AS runtime-datascience - -ARG TARGETARCH -ARG DATASCIENCE_SOURCE_CODE=runtimes/datascience/ubi9-python-3.12 - -LABEL name="odh-notebook-runtime-datascience-ubi9-python-3.12" \ - summary="Runtime data science notebook image for ODH notebooks" \ - description="Runtime data science notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Runtime data science notebook image for ODH notebooks" \ - io.k8s.description="Runtime data science notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/runtimes/datascience/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:runtime-datascience-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin -USER 0 - -# Install ppc64le-built wheels if available -COPY --from=openblas-builder /root/OpenBLAS-* /openblas -COPY --from=onnx-builder /onnx_wheels /tmp/onnx_wheels -COPY --from=arrow-builder /arrowwheels /tmp/arrowwheels - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "ppc64le" ]; then - echo "Installing ppc64le ONNX, pyarrow wheels and OpenBLAS..." - HOME=/root pip install --no-cache-dir /tmp/onnx_wheels/*.whl /tmp/arrowwheels/*.whl - if [ -d "/openblas" ] && [ "$(ls -A /openblas 2>/dev/null)" ]; then - PREFIX=/usr/local make -C /openblas install - fi - rm -rf /openblas /tmp/onnx_wheels /tmp/arrowwheels -else - echo "Skipping architecture-specific wheel installs for (${TARGETARCH})" - rm -rf /tmp/wheels /openblas /tmp/onnx_wheels /tmp/arrowwheels -fi -EOF - -USER 0 -# Copy wheels from build stage (s390x only) -COPY --from=s390x-builder /tmp/wheels /tmp/wheels -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -if [ "$TARGETARCH" = "s390x" ]; then - pip install --no-cache-dir /tmp/wheels/*.whl - rm -rf /tmp/wheels -else - echo "Skipping wheel install for $TARGETARCH" -fi -EOF - - -# Install Python packages from pylock.toml -COPY ${DATASCIENCE_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra dependencies for air-gapped enviroment -COPY ${DATASCIENCE_SOURCE_CODE}/utils ./utils/ - -RUN --mount=type=cache,target=/root/.cache/pip /bin/bash <<'EOF' -set -Eeuxo pipefail -echo "Installing softwares and packages" -# RHOAIENG-58277: Meson 1.11.0 breaks pandas 2.3.3 source builds on ppc64le/s390x -echo "meson<1.11" > build_constraints.txt -if [ "$TARGETARCH" = "ppc64le" ]; then - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig - export LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib:/usr/lib64:/usr/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --build-constraint build_constraints.txt --requirements=./pylock.toml -elif [ "$TARGETARCH" = "s390x" ]; then - # For s390x, we need special flags and environment variables for building packages - GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \ - CFLAGS="-O3" CXXFLAGS="-O3" \ - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --build-constraint build_constraints.txt --requirements=./pylock.toml -else - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml -fi -# Fix permissions to support pip in Openshift environments -chmod -R g+w /opt/app-root/lib/python3.12/site-packages -fix-permissions /opt/app-root -P -EOF - -USER 1001 - -WORKDIR /opt/app-root/src diff --git a/runtimes/minimal/ubi9-python-3.12/Dockerfile.cpu b/runtimes/minimal/ubi9-python-3.12/Dockerfile.cpu deleted file mode 100644 index 05b9383fc8..0000000000 --- a/runtimes/minimal/ubi9-python-3.12/Dockerfile.cpu +++ /dev/null @@ -1,88 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# cpu-base # -#################### -FROM ${BASE_IMAGE} AS cpu-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN ARCH=$(uname -m) && \ - echo "Detected architecture: $ARCH" && \ - PACKAGES="perl mesa-libGL skopeo" && \ - if [ "$ARCH" = "s390x" ] || [ "$ARCH" = "ppc64le" ]; then \ - PACKAGES="$PACKAGES gcc g++ make openssl-devel autoconf automake libtool cmake"; \ - fi && \ - dnf install -y $PACKAGES && \ - dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -#################### -# runtime-minimal # -#################### -FROM cpu-base AS runtime-minimal - -ARG MINIMAL_SOURCE_CODE=runtimes/minimal/ubi9-python-3.12 - -LABEL name="odh-notebook-runtime-minimal-ubi9-python-3.12" \ - summary="Runtime minimal image for ODH notebooks" \ - description="Runtime minimal image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Runtime minimal image for ODH notebooks" \ - io.k8s.description="Runtime minimal image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/runtimes/minimal/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:runtime-minimal-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -# Install Python packages from requirements.txt -COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra dependencies for air-gapped enviroment -COPY ${MINIMAL_SOURCE_CODE}/utils ./utils/ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -WORKDIR /opt/app-root/src diff --git a/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda b/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda deleted file mode 100644 index f437345d2a..0000000000 --- a/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.cuda +++ /dev/null @@ -1,83 +0,0 @@ -ARG TARGETARCH - -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# cuda-base # -#################### -FROM ${BASE_IMAGE} AS cuda-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################### -# cuda-runtime-pytorch # -######################### -FROM cuda-base AS cuda-runtime-pytorch - -ARG PYTORCH_SOURCE_CODE=runtimes/pytorch+llmcompressor/ubi9-python-3.12 - -LABEL name="odh-notebook-runtime-cuda-pytorch-llmcompressor-ubi9-python-3.12" \ - summary="Runtime CUDA pytorch-llmcompressor notebook image for ODH notebooks" \ - description="Runtime CUDA pytorch-llmcompressor notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Runtime CUDA pytorch-llmcompressor notebook image for ODH notebooks" \ - io.k8s.description="Runtime CUDA pytorch-llmcompressor notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/runtimes/pytorch+llmcompressor/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:runtime-pytorch-llmcompressor-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -# Install Python packages from requirements.txt -COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra dependencies for air-gapped enviroment -COPY ${PYTORCH_SOURCE_CODE}/utils ./utils/ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -WORKDIR /opt/app-root/src diff --git a/runtimes/pytorch/ubi9-python-3.12/Dockerfile.cuda b/runtimes/pytorch/ubi9-python-3.12/Dockerfile.cuda deleted file mode 100644 index 457d168a1d..0000000000 --- a/runtimes/pytorch/ubi9-python-3.12/Dockerfile.cuda +++ /dev/null @@ -1,83 +0,0 @@ -ARG TARGETARCH - -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# cuda-base # -#################### -FROM ${BASE_IMAGE} AS cuda-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################### -# cuda-runtime-pytorch # -######################### -FROM cuda-base AS cuda-runtime-pytorch - -ARG PYTORCH_SOURCE_CODE=runtimes/pytorch/ubi9-python-3.12 - -LABEL name="odh-notebook-runtime-pytorch-ubi9-python-3.12" \ - summary="Runtime pytorch notebook image for ODH notebooks" \ - description="Runtime pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Runtime pytorch notebook image for ODH notebooks" \ - io.k8s.description="Runtime pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/runtimes/pytorch/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:runtime-pytorch-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -# Install Python packages from requirements.txt -COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra dependencies for air-gapped enviroment -COPY ${PYTORCH_SOURCE_CODE}/utils ./utils/ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -WORKDIR /opt/app-root/src diff --git a/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.rocm b/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.rocm deleted file mode 100644 index 53492a2412..0000000000 --- a/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.rocm +++ /dev/null @@ -1,104 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# rocm-base # -#################### -FROM ${BASE_IMAGE} AS rocm-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -######################## -# rocm-runtime-pytorch # -######################## -FROM rocm-base AS rocm-runtime-pytorch - -ARG PYTORCH_SOURCE_CODE=runtimes/rocm-pytorch/ubi9-python-3.12 - -LABEL name="odh-notebook-runtime-rocm-pytorch-ubi9-python-3.12" \ - summary="Runtime ROCm pytorch notebook image for ODH notebooks" \ - description="Runtime ROCm pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Runtime ROCm pytorch notebook image for ODH notebooks" \ - io.k8s.description="Runtime ROCm pytorch notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/runtimes/rocm-pytorch/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:rocm-runtime-pytorch-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -# Install Python packages from requirements.txt -COPY ${PYTORCH_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra dependencies for air-gapped enviroment -COPY ${PYTORCH_SOURCE_CODE}/utils ./utils/ -# Copy utility script -COPY ${PYTORCH_SOURCE_CODE}/de-vendor-torch.sh ./ - -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -echo "Installing softwares and packages" -# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, -# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. -uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml -# De-vendor ROCm libs embedded in Pytorch (same layer as pip — shrinks commit peak) -./de-vendor-torch.sh -rm ./de-vendor-torch.sh -EOF - -USER 0 -# Fix permissions to support pip in Openshift environments -RUN /bin/bash <<'EOF' -set -Eeuxo pipefail -chmod -R g+w /opt/app-root/lib/python3.12/site-packages || true -fix-permissions /opt/app-root -P -EOF - -USER 1001 - -# Workaround for https://issues.redhat.com/browse/AIPCC-8152 -ENV ROCM_PATH=/opt/rocm -# Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds -# https://issues.redhat.com/browse/AIPCC-5882 -USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all -USER 1001 - -WORKDIR /opt/app-root/src diff --git a/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.rocm b/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.rocm deleted file mode 100644 index d6d3a66a68..0000000000 --- a/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.rocm +++ /dev/null @@ -1,96 +0,0 @@ -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# rocm-base # -#################### -FROM ${BASE_IMAGE} AS rocm-base - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -########################### -# rocm-runtime-tensorflow # -########################### -FROM rocm-base AS rocm-runtime-tensorflow - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG TENSORFLOW_SOURCE_CODE=runtimes/rocm-tensorflow/ubi9-python-3.12 - -LABEL name="odh-notebook-rocm-runtime-tensorflow-ubi9-python-3.12" \ - summary="Runtime ROCm tensorflow notebook image for ODH notebooks" \ - description="Runtime ROCm tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Runtime ROCm tensorflow notebook image for ODH notebooks" \ - io.k8s.description="Runtime ROCm tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/runtimes/rocm-tensorflow/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:rocm-runtime-tensorflow-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -# Install Python packages from requirements.txt -COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra dependencies for air-gapped enviroment -COPY ${TENSORFLOW_SOURCE_CODE}/utils ./utils/ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - # Not using --build-constraints=./requirements.txt because error: Unnamed requirements are not allowed as constraints (found: `https://repo.radeon.com/rocm/manylinux/rocm-rel-6.4/ - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml - -# Fix permissions to support pip in Openshift environments \ -USER 0 -RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P -USER 1001 - -COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ - -# Workaround for https://issues.redhat.com/browse/AIPCC-8152 -ENV ROCM_PATH=/opt/rocm -# Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds -# https://issues.redhat.com/browse/AIPCC-5882 -USER 0 -RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all -USER 1001 - -WORKDIR /opt/app-root/src diff --git a/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.cuda b/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.cuda deleted file mode 100644 index 060a610b1b..0000000000 --- a/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.cuda +++ /dev/null @@ -1,92 +0,0 @@ -ARG TARGETARCH - -######################### -# configuration args # -######################### -ARG BASE_IMAGE - -# External image alias for UBI repository configuration -FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos - -#################### -# cuda-base # -#################### -FROM ${BASE_IMAGE} AS cuda-base - -ARG TARGETARCH - -WORKDIR /opt/app-root/bin - -# OS Packages needs to be installed as root -USER 0 - -# Inject the official UBI 9 repository configuration into the AIPCC base image. -# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages. -# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations. -COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo - -# upgrade first to avoid fixable vulnerabilities begin -# Problem: The operation would result in removing the following protected packages: systemd -# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages) -# Solution: --best --skip-broken does not work either, so use --nobest -RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \ - && dnf clean all -y -# upgrade first to avoid fixable vulnerabilities end - -# Install useful OS packages -RUN dnf install -y perl mesa-libGL skopeo libxcrypt-compat && dnf clean all && rm -rf /var/cache/yum - -# Other apps and tools installed as default user -USER 1001 - -# Install micropipenv and uv to deploy packages from requirements.txt begin -RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" -# Install micropipenv and uv to deploy packages from requirements.txt end - -# Install the oc client begin -RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \ - -o /tmp/openshift-client-linux.tar.gz && \ - tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \ - rm -f /tmp/openshift-client-linux.tar.gz -# Install the oc client end - -############################ -# cuda-runtime-tensorflow # -############################ -FROM cuda-base AS cuda-runtime-tensorflow - -ARG JUPYTER_REUSABLE_UTILS=jupyter/utils -ARG TENSORFLOW_SOURCE_CODE=runtimes/tensorflow/ubi9-python-3.12 - -# CVE-2026-2492: Disable HDF5 plugin loading to prevent local privilege escalation -# via unsecured plugin search path in TensorFlow's h5py integration -ENV HDF5_PLUGIN_PATH=disable - -LABEL name="odh-notebook-cuda-runtime-tensorflow-ubi9-python-3.12" \ - summary="Runtime CUDA tensorflow notebook image for ODH notebooks" \ - description="Runtime CUDA tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - io.k8s.display-name="Runtime CUDA tensorflow notebook image for ODH notebooks" \ - io.k8s.description="Runtime CUDA tensorflow notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \ - authoritative-source-url="https://github.com/opendatahub-io/notebooks" \ - io.openshift.build.commit.ref="main" \ - io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/runtimes/tensorflow/ubi9-python-3.12" \ - io.openshift.build.image="quay.io/opendatahub/workbench-images:cuda-runtime-tensorflow-ubi9-python-3.12" - -WORKDIR /opt/app-root/bin - -# Install Python packages from requirements.txt -COPY ${TENSORFLOW_SOURCE_CODE}/pylock.toml ./ -# Copy Elyra dependencies for air-gapped enviroment -COPY ${TENSORFLOW_SOURCE_CODE}/utils ./utils/ - -RUN echo "Installing softwares and packages" && \ - # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`, - # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common. - uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \ - # Fix permissions to support pip in Openshift environments \ - chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \ - fix-permissions /opt/app-root -P - -COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/ - -WORKDIR /opt/app-root/src From 6fcb3f808957e7cea0118e180d898cdedcc7d9e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Mon, 3 Aug 2026 14:13:52 +0200 Subject: [PATCH 3/5] fix(ci): align tooling with Konflux-only workbench Dockerfiles Update manifest accelerator detection, PR changed-file Dockerfile discovery, and docs/tests to reference Dockerfile.konflux.* after removing legacy Dockerfile.cpu/cuda/rocm from jupyter and runtimes. Co-authored-by: Cursor --- ci/cached-builds/gen_gha_matrix_jobs.py | 4 ++-- ci/cached-builds/gha_pr_changed_files.py | 16 ++++++++++------ .../ubi9-python-3.12/Dockerfile.konflux.cpu | 2 +- scripts/buildinputs/buildinputs_test.go | 2 +- scripts/lockfile-generators/README.md | 2 +- tests/manifests.py | 6 +++--- 6 files changed, 18 insertions(+), 14 deletions(-) diff --git a/ci/cached-builds/gen_gha_matrix_jobs.py b/ci/cached-builds/gen_gha_matrix_jobs.py index 1f07b57aa6..6c97c5005e 100755 --- a/ci/cached-builds/gen_gha_matrix_jobs.py +++ b/ci/cached-builds/gen_gha_matrix_jobs.py @@ -217,10 +217,10 @@ class SelfTests(unittest.TestCase): def test_select_changed_targets_dockerfile(self): targets = extract_image_targets(makefile_dir=project_dir) - changed_files = ["jupyter/datascience/ubi9-python-3.11/Dockerfile.cpu"] + changed_files = ["jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu"] targets = gha_pr_changed_files.filter_out_unchanged(targets, changed_files) - assert set(targets) == {"jupyter-datascience-ubi9-python-3.11"} + assert set(targets) == {"jupyter-datascience-ubi9-python-3.12"} def test_select_changed_targets_shared_file(self): targets = extract_image_targets(makefile_dir=project_dir) diff --git a/ci/cached-builds/gha_pr_changed_files.py b/ci/cached-builds/gha_pr_changed_files.py index 895a40b81e..5cab9daa1b 100644 --- a/ci/cached-builds/gha_pr_changed_files.py +++ b/ci/cached-builds/gha_pr_changed_files.py @@ -72,12 +72,16 @@ def get_build_dockerfile(make_target: str, env: dict[str, str] | None = None) -> def find_dockerfiles(directory: str) -> list: - """Finds and returns a list of files matching the pattern 'Dockerfile*' in the specified directory.""" - matching_files = [] - for filename in os.listdir(directory): - if fnmatch.fnmatch(filename, "Dockerfile*") and filename != "Dockerfile.konflux": - matching_files.append(filename) - return matching_files + """Find Dockerfile(s) in a build directory for buildinputs dependency analysis.""" + dir_path = pathlib.Path(directory) + if not dir_path.is_absolute(): + dir_path = PROJECT_ROOT / dir_path + konflux = sorted( + f for f in os.listdir(dir_path) if f.startswith("Dockerfile.konflux.") + ) + if konflux: + return konflux + return sorted(f for f in os.listdir(dir_path) if fnmatch.fnmatch(f, "Dockerfile*")) def _is_file_in_directory(changed_file: str, directory: str) -> bool: diff --git a/codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu b/codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu index c563f28666..afe7131450 100644 --- a/codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu +++ b/codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu @@ -169,7 +169,7 @@ set -Eeuxo pipefail dnf install -y tar perl mesa-libGL skopeo dnf clean all rm -rf /var/cache/dnf -# Install the oc client (same approach as pre-hermetic Dockerfile.cpu) +# Install the oc client curl -fsSL "https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz" \ -o /tmp/openshift-client-linux.tar.gz tar -xzf /tmp/openshift-client-linux.tar.gz -C /usr/local/bin oc diff --git a/scripts/buildinputs/buildinputs_test.go b/scripts/buildinputs/buildinputs_test.go index 4ec4e7b651..c06c7a8ca9 100644 --- a/scripts/buildinputs/buildinputs_test.go +++ b/scripts/buildinputs/buildinputs_test.go @@ -89,7 +89,7 @@ func TestParseDockerfileWithBindMount(t *testing.T) { EOF `)), 0644)) - //dockerfile = "/Users/jdanek/IdeaProjects/notebooks/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.rocm" + //dockerfile = "/Users/jdanek/IdeaProjects/notebooks/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm" result := getDockerfileDeps(dockerfile, "amd64") expected := []string{"codeserver/ubi9-python-3.12/test", "foo"} diff --git a/scripts/lockfile-generators/README.md b/scripts/lockfile-generators/README.md index 667c0de0b0..616e54ad64 100644 --- a/scripts/lockfile-generators/README.md +++ b/scripts/lockfile-generators/README.md @@ -878,7 +878,7 @@ This command: ./scripts/lockfile-generators/create-requirements-lockfile.sh \ --pyproject-toml codeserver/ubi9-python-3.12/pyproject.toml -# Custom flavor (e.g. cuda — requires Dockerfile.cuda and build-args/cuda.conf) +# Custom flavor (e.g. cuda — requires Dockerfile.konflux.cuda and build-args/cuda.conf) ./scripts/lockfile-generators/create-requirements-lockfile.sh \ --pyproject-toml codeserver/ubi9-python-3.12/pyproject.toml \ --flavor cuda diff --git a/tests/manifests.py b/tests/manifests.py index a2ad5de720..8b934c57c0 100644 --- a/tests/manifests.py +++ b/tests/manifests.py @@ -115,10 +115,10 @@ def extract_metadata_from_path(directory: Path) -> NotebookMetadata: elif "cuda" in notebook_identity_parts: accelerator_flavor = "cuda" # The shell script has an implicit rule for pytorch being cuda. We can - # replicate this by checking for a specific Dockerfile. - elif (directory / "Dockerfile.cuda").exists(): + # replicate this by checking for a Konflux Dockerfile variant. + elif (directory / "Dockerfile.konflux.cuda").exists(): accelerator_flavor = "cuda" - elif (directory / "Dockerfile.rocm").exists(): + elif (directory / "Dockerfile.konflux.rocm").exists(): accelerator_flavor = "rocm" return NotebookMetadata( From 1bb2fa153c319ac78fde65c965b3fd330df8a63e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Mon, 3 Aug 2026 14:15:18 +0200 Subject: [PATCH 4/5] test(ci): refresh shared-file matrix job self-test for py312 Replace stale cuda/ubi9-python-3.11 license path and 3.11 target names with jupyter/utils/install_pdf_deps.sh and current 3.12 Makefile targets. Co-authored-by: Cursor --- ci/cached-builds/gen_gha_matrix_jobs.py | 27 +++++++++++++------------ 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/ci/cached-builds/gen_gha_matrix_jobs.py b/ci/cached-builds/gen_gha_matrix_jobs.py index 6c97c5005e..9d89ea042d 100755 --- a/ci/cached-builds/gen_gha_matrix_jobs.py +++ b/ci/cached-builds/gen_gha_matrix_jobs.py @@ -225,20 +225,21 @@ def test_select_changed_targets_dockerfile(self): def test_select_changed_targets_shared_file(self): targets = extract_image_targets(makefile_dir=project_dir) - changed_files = ["cuda/ubi9-python-3.11/NGC-DL-CONTAINER-LICENSE"] + changed_files = ["jupyter/utils/install_pdf_deps.sh"] - # With the removal of chained builds - which now potentially has multiple Dockerfiles defined in a given - # directory, there is an inefficiency introduced to 'gha_pr_changed_files' as demonstrated by this unit test. - # Even though this test only changes a (shared) CUDA file - you will notice the 'cpu' and 'rocm' targets - # also being returned. Odds of this inefficiency noticably "hurting us" is low - so of the opinion we can - # simply treat this as technical debt. + # With multiple Dockerfile.konflux.* files per directory, should_build_target scans + # every Konflux Dockerfile in a build directory for buildinputs dependencies. A shared + # jupyter/utils change therefore fans out to CPU, CUDA, and ROCm targets (not just CUDA). targets = gha_pr_changed_files.filter_out_unchanged(targets, changed_files) assert set(targets) == { - "jupyter-minimal-ubi9-python-3.11", - "cuda-jupyter-minimal-ubi9-python-3.11", - "cuda-jupyter-pytorch-ubi9-python-3.11", - "runtime-cuda-pytorch-ubi9-python-3.11", - "cuda-jupyter-tensorflow-ubi9-python-3.11", - "rocm-jupyter-minimal-ubi9-python-3.11", - "runtime-cuda-tensorflow-ubi9-python-3.11", + "jupyter-minimal-ubi9-python-3.12", + "jupyter-datascience-ubi9-python-3.12", + "jupyter-trustyai-ubi9-python-3.12", + "cuda-jupyter-minimal-ubi9-python-3.12", + "cuda-jupyter-pytorch-ubi9-python-3.12", + "cuda-jupyter-pytorch-llmcompressor-ubi9-python-3.12", + "cuda-jupyter-tensorflow-ubi9-python-3.12", + "rocm-jupyter-minimal-ubi9-python-3.12", + "rocm-jupyter-pytorch-ubi9-python-3.12", + "rocm-jupyter-tensorflow-ubi9-python-3.12", } From 0c210537c5af96ea1f6ea280b88884d7efcf2d94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= Date: Mon, 3 Aug 2026 14:27:03 +0200 Subject: [PATCH 5/5] style(ci): ruff-format gha_pr_changed_files find_dockerfiles Fix pre-commit ruff-format failure on pytest-tests workflow. Co-authored-by: Cursor --- ci/cached-builds/gha_pr_changed_files.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ci/cached-builds/gha_pr_changed_files.py b/ci/cached-builds/gha_pr_changed_files.py index 5cab9daa1b..73cfda5a5a 100644 --- a/ci/cached-builds/gha_pr_changed_files.py +++ b/ci/cached-builds/gha_pr_changed_files.py @@ -76,9 +76,7 @@ def find_dockerfiles(directory: str) -> list: dir_path = pathlib.Path(directory) if not dir_path.is_absolute(): dir_path = PROJECT_ROOT / dir_path - konflux = sorted( - f for f in os.listdir(dir_path) if f.startswith("Dockerfile.konflux.") - ) + konflux = sorted(f for f in os.listdir(dir_path) if f.startswith("Dockerfile.konflux.")) if konflux: return konflux return sorted(f for f in os.listdir(dir_path) if fnmatch.fnmatch(f, "Dockerfile*"))