Skip to content

Updated Dockerfiles #215

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
neuron-containers-ci wants to merge 1 commit into from
Closed

Updated Dockerfiles #215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions common/.neuron_repo
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
729488563159:KwvfuHGKPmKIJGr3lRXdIzcQKjqZskHm
113 changes: 113 additions & 0 deletions common/neuron_repo_auth.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
#!/bin/sh
# Gives the Neuron repo credential from the neuron_repo build secret to apt, dnf, pip and curl
# for one RUN step. The RUN step mounts the secret (--mount=type=secret,id=neuron_repo), sources
# this file and calls neuron_repo_auth first. Everything it writes is removed when the step's
# shell exits, however the step ends, so the credential never reaches an image layer.
#
# With the secret, the repo setup step calls neuron_repo_park at its end. That moves the Neuron
# apt list, yum repo file and private pip extra index (none of them hold the credential) to
# /etc/neuron-repo, and neuron_repo_auth turns them on again for each step that needs them. So
# the image does not keep a private repo it cannot log in to, and a later apt-get update or pip
# install in the image or in an image built from it does not fail on it. The pip extra index is
# set to the public Neuron index instead of being removed, so `pip config unset
# global.extra-index-url` in an image built from this one keeps working.
#
# Without the secret these functions do nothing. Builds that pass the older NEURON_*_REPO_KEY
# build args, and builds against the public repos, work as before.
#
# The repo host names come from /etc/neuron-repo-hosts, which the repo setup step writes. That
# file holds no credential. NEURON_REPO_HOSTS_FILE can point at another file, for tests.

NEURON_REPO_PARK_DIR="${NEURON_REPO_PARK_DIR:-/etc/neuron-repo}"
NEURON_PUBLIC_PIP_INDEX=https://pip.repos.neuron.amazonaws.com

neuron_repo_auth() {
_neuron_repo_secret="${NEURON_REPO_SECRET_FILE:-/run/secrets/neuron_repo}"
[ -s "${_neuron_repo_secret}" ] || return 0

_neuron_repo_cred="$(cat "${_neuron_repo_secret}")"
case "${_neuron_repo_cred}" in
?*:?*) ;;
*)
echo "Error: the neuron_repo secret must be 'user:password'" >&2
return 1
;;
esac
_neuron_repo_user="${_neuron_repo_cred%%:*}"
_neuron_repo_pass="${_neuron_repo_cred#*:}"

_neuron_repo_hosts="${NEURON_REPO_HOSTS_FILE:-/etc/neuron-repo-hosts}"
if [ -r "${_neuron_repo_hosts}" ]; then
. "${_neuron_repo_hosts}"
fi

NEURON_REPO_AUTH_DIR="$(mktemp -d)" || return 1
trap _neuron_repo_auth_cleanup EXIT
# One netrc file for curl, and for pip through NETRC.
NEURON_REPO_NETRC="${NEURON_REPO_AUTH_DIR}/netrc"
: > "${NEURON_REPO_NETRC}"
chmod 600 "${NEURON_REPO_NETRC}"
for _neuron_repo_host in ${NEURON_APT_REPO:-} ${NEURON_YUM_REPO:-} ${NEURON_PIP_REPO:-}; do
printf 'machine %s login %s password %s\n' \
"${_neuron_repo_host}" "${_neuron_repo_user}" "${_neuron_repo_pass}" >> "${NEURON_REPO_NETRC}"
done
export NEURON_REPO_NETRC
export NETRC="${NEURON_REPO_NETRC}"

if [ -n "${NEURON_APT_REPO:-}" ] && [ -d /etc/apt ]; then
mkdir -p /etc/apt/auth.conf.d
printf 'machine %s login %s password %s\n' \
"${NEURON_APT_REPO}" "${_neuron_repo_user}" "${_neuron_repo_pass}" > /etc/apt/auth.conf.d/neuron-repo.conf
chmod 600 /etc/apt/auth.conf.d/neuron-repo.conf
fi

# Turn on the repo config the setup step parked.
if [ -f "${NEURON_REPO_PARK_DIR}/neuron.list" ]; then
cp "${NEURON_REPO_PARK_DIR}/neuron.list" /etc/apt/sources.list.d/neuron.list
fi
if [ -f "${NEURON_REPO_PARK_DIR}/neuron.repo" ]; then
cp "${NEURON_REPO_PARK_DIR}/neuron.repo" /etc/yum.repos.d/neuron.repo
chmod 600 /etc/yum.repos.d/neuron.repo
printf 'username=%s\npassword=%s\n' "${_neuron_repo_user}" "${_neuron_repo_pass}" >> /etc/yum.repos.d/neuron.repo
fi
# The environment variable takes precedence over the pip config files, for this step only.
if [ -f "${NEURON_REPO_PARK_DIR}/pip-extra-index-url" ]; then
PIP_EXTRA_INDEX_URL="$(cat "${NEURON_REPO_PARK_DIR}/pip-extra-index-url")"
export PIP_EXTRA_INDEX_URL
fi

unset _neuron_repo_secret _neuron_repo_hosts _neuron_repo_cred _neuron_repo_user _neuron_repo_pass _neuron_repo_host
}

# Called at the end of the repo setup step. Does nothing unless neuron_repo_auth found the secret.
neuron_repo_park() {
[ -n "${NEURON_REPO_AUTH_DIR:-}" ] || return 0
mkdir -p "${NEURON_REPO_PARK_DIR}"
if [ -f /etc/apt/sources.list.d/neuron.list ]; then
mv /etc/apt/sources.list.d/neuron.list "${NEURON_REPO_PARK_DIR}/neuron.list"
fi
if [ -f /etc/yum.repos.d/neuron.repo ]; then
mv /etc/yum.repos.d/neuron.repo "${NEURON_REPO_PARK_DIR}/neuron.repo"
fi
_neuron_repo_pip="${PIP:-pip3}"
_neuron_repo_index="$(${_neuron_repo_pip} config get global.extra-index-url 2>/dev/null || true)"
if [ -n "${_neuron_repo_index}" ] && [ "${_neuron_repo_index}" != "${NEURON_PUBLIC_PIP_INDEX}" ]; then
printf '%s\n' "${_neuron_repo_index}" > "${NEURON_REPO_PARK_DIR}/pip-extra-index-url"
${_neuron_repo_pip} config set global.extra-index-url "${NEURON_PUBLIC_PIP_INDEX}" >/dev/null || return 1
fi
unset _neuron_repo_pip _neuron_repo_index
}

_neuron_repo_auth_cleanup() {
rm -f /etc/apt/auth.conf.d/neuron-repo.conf
# Only the copies made from the parked config are removed.
if [ -f "${NEURON_REPO_PARK_DIR}/neuron.list" ]; then
rm -f /etc/apt/sources.list.d/neuron.list
fi
if [ -f "${NEURON_REPO_PARK_DIR}/neuron.repo" ]; then
rm -f /etc/yum.repos.d/neuron.repo
fi
if [ -n "${NEURON_REPO_AUTH_DIR:-}" ]; then
rm -rf "${NEURON_REPO_AUTH_DIR}"
fi
}
9 changes: 9 additions & 0 deletions jax/training/0.10.0/Dockerfile.neuronx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,15 @@
LABEL dlc_major_version="1"
LABEL maintainer="Amazon AI"

# SageMaker DLC identification labels. Read by SageMaker/JumpStart tooling to
# identify the container's accelerator, framework, runtime, and OS.
LABEL com.amazonaws.ml.engines.sagemaker.dlc.device.neuron="true"
LABEL com.amazonaws.ml.engines.sagemaker.dlc.arch.x86="true"
LABEL com.amazonaws.ml.engines.sagemaker.dlc.python.py314="true"
LABEL com.amazonaws.ml.engines.sagemaker.dlc.os.ubuntu26-04="true"
LABEL com.amazonaws.ml.engines.sagemaker.dlc.job.training="true"
LABEL com.amazonaws.ml.engines.sagemaker.dlc.framework.jax.0-10-0="true"

# Keep apt non-interactive so tzdata's timezone/region prompt can't stall the build
ARG DEBIAN_FRONTEND=noninteractive
ARG PYTHON=python3.14
Expand All @@ -20,7 +29,7 @@
ENV PYTHONIOENCODING=UTF-8
ENV LANG=C.UTF-8
ENV LC_ALL=C.UTF-8
ENV LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/opt/aws/neuron/lib"

Check warning on line 32 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / build (0.10.0, jax/training/0.10.0)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$LD_LIBRARY_PATH'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ENV LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/opt/amazon/efa/lib"
ENV LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/opt/amazon/efa/lib64"
ENV LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/opt/amazon/openmpi/lib64"
Expand All @@ -28,7 +37,7 @@
ENV PATH="/opt/aws/neuron/bin:${PATH}"
ENV PATH="${PATH}:/opt/amazon/efa/bin"

RUN apt-get update \

Check failure on line 40 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
&& apt-get upgrade -y \
&& apt-get install -y --no-install-recommends \
build-essential \
Expand Down Expand Up @@ -68,7 +77,7 @@
&& apt-get clean

# Install Open MPI and configure SSH for MPI operator in k8s
RUN mkdir -p /tmp/openmpi \

Check failure on line 80 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

SC2046 warning: Quote this to prevent word splitting.

Check failure on line 80 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

DL3003 warning: Use WORKDIR to switch to a directory
&& cd /tmp/openmpi \
&& wget --quiet https://download.open-mpi.org/release/open-mpi/v4.1/openmpi-${OMPI_VERSION}.tar.gz \
&& tar zxf openmpi-${OMPI_VERSION}.tar.gz \
Expand All @@ -80,7 +89,7 @@
&& rm -rf /tmp/openmpi

# Install packages and configure SSH for MPI operator in k8s
RUN apt-get update \

Check failure on line 92 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

DL3015 info: Avoid additional packages by specifying `--no-install-recommends`

Check failure on line 92 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
&& apt-get install -y openmpi-bin openssh-server \
&& mkdir -p /var/run/sshd \
&& echo " UserKnownHostsFile /dev/null" >> /etc/ssh/ssh_config \
Expand All @@ -91,7 +100,7 @@
&& apt-get clean

# Install Python
RUN wget -q https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tgz \

Check failure on line 103 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

SC2046 warning: Quote this to prevent word splitting.

Check failure on line 103 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

DL3003 warning: Use WORKDIR to switch to a directory
&& tar -xzf Python-$PYTHON_VERSION.tgz \
&& cd Python-$PYTHON_VERSION \
&& ./configure --enable-shared --prefix=/usr/local \
Expand All @@ -107,7 +116,7 @@
&& rm -rf ~/.cache/pip/*

# Install AWS CLI
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" \

Check failure on line 119 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

DL4001 warning: Either use Wget or Curl but not both
&& unzip awscliv2.zip \
&& ./aws/install \
&& rm -rf awscliv2.zip aws
Expand All @@ -119,7 +128,7 @@
RUN ${PIP} config set global.break-system-packages true

# Install EFA
RUN apt-get update \

Check failure on line 131 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

DL3047 info: Avoid use of wget without progress bar. Use `wget --progress=dot:giga <url>`. Or consider using `-q` or `-nv` (shorthands for `--quiet` or `--no-verbose`).

Check failure on line 131 in jax/training/0.10.0/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter 

SC2086 info: Double quote to prevent globbing and word splitting.
&& cd $HOME \
&& curl -O https://efa-installer.amazonaws.com/aws-efa-installer-latest.tar.gz \
&& wget https://efa-installer.amazonaws.com/aws-efa-installer.key && gpg --import aws-efa-installer.key \
Expand Down
Loading
Loading