build: exclude opencv-python-headless from shipped container

pyproject.toml

@@ -347,17 +347,18 @@ default-groups = ["dev", "build"]
 #  --link-mode=symlink (fastest option when uv cache and venv on different file-system; caveat: venv is brittle since it depends on the environment/container)
 link-mode = "copy"
 # The TE override is needed to pin the TE version across all extras
-# The opencv-python-headless override is needed because automodel pins it to 4.10.0.84, whereas vllm>=0.11.0 needs >= 4.11.0.
-# Bumped to >=5.0.0 to pick up a bundled FFmpeg that addresses CVE-2025-9951, CVE-2025-1594, and CVE-2024-31582
-# (all in opencv_python_headless.libs/libav*.so shipped by 4.x wheels, which bundle FFmpeg 5.1.6).
+# The opencv-python-headless override pins >=5.0.0 to patch CVE-2025-9951, CVE-2025-1594, and CVE-2024-31582
+# (bundled FFmpeg 5.1.6 in 4.x wheels) and excludes it from the shipped container (sys_platform == 'never')
+# because its bundled FFmpeg codec libs (H.264, H.265, AAC) may incur royalties. Installed at runtime
+# via tools/install_audio_deps.sh. vllm defaults to opencv for video IO but falls back to torchcodec.
 # The timm override is needed because sglang requires timm==1.0.16.
 override-dependencies = [
   "transformer-engine[pytorch,core_cu13] @ git+https://github.com/NVIDIA/TransformerEngine.git@release_v2.15",
   "nvidia-cublas==13.5.1.27; sys_platform != 'darwin'",
   "nvidia-cudnn-cu13==9.20.0.48; sys_platform != 'darwin'",
   "nvidia-cudnn-frontend==1.23.0",
   "nvidia-nvshmem-cu13>=3.6.5; sys_platform != 'darwin'",
-  "opencv-python-headless>=5.0.0",
+  "opencv-python-headless>=5.0.0; sys_platform == 'never'",
   "timm<=1.0.22",
   "nvidia-modelopt[torch]>=0.44.0a0",
   "torch==2.11.0",

tools/install_audio_deps.sh

@@ -1,15 +1,15 @@
 #!/bin/bash
-# Install audio dependencies that are NOT shipped in the NeMo-RL container.
+# Install audio/video dependencies that are NOT shipped in the NeMo-RL container.
 #
-# Run this script before using audio features or running audio tests:
+# Run this script before using audio/video features or running audio/VLM tests:
 #
 #   bash tools/install_audio_deps.sh
 #
 # Safe to call multiple times — exits immediately if already installed.
 set -euo pipefail
 
-# Fast exit: if torchcodec imports cleanly it already has FFmpeg available.
-if python -c "import torchcodec" 2>/dev/null; then
+# Fast exit: both torchcodec and cv2 must be importable.
+if python -c "import torchcodec; import cv2" 2>/dev/null; then
     echo "[audio-deps] Already installed and functional, skipping."
     exit 0
 fi
@@ -26,4 +26,10 @@ uv pip install \
     --reinstall-package torchaudio \
     "torchaudio==2.11.0" \
     "torchcodec>=0.3.0"
+
+# opencv-python-headless is excluded from the shipped container (bundled FFmpeg codec
+# libs incur royalties). vllm defaults to opencv for video IO; install >=5.0.0 which
+# also patches CVE-2025-9951, CVE-2025-1594, and CVE-2024-31582.
+echo "[audio-deps] Installing opencv-python-headless..."
+uv pip install "opencv-python-headless>=5.0.0"
 echo "[audio-deps] Done."