build: remove FFmpeg from automodel to avoid unfixed CVE

[gabwow]

Summary

This change addresses multiple High CVEs in the nmp-automoel-training image that all relate to FFMpeg. The current version of FFMpeg (8.1.2) is the latest version of the 8.xx versions. There is a 9.0 release but underlying dependencies only document compability with 8.xx and libavcodec bumps between the releases. GPT thought it was safer to remove than upgrade. Since we aren't exposing VLM, fully removing seemed the better option.

Changes

• remove the fffmpeg wheel
• remove vlm from uv extras

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Documentation updated for user-visible behavior
• Documentation not applicable — justification:

Verification

• [ X] Built image
  Targeted validation:

Summary by CodeRabbit

• Bug Fixes

  • Streamlined Automodel container builds by removing legacy video and FFmpeg components.
  • Reduced image size and installation overhead by excluding unnecessary multimedia dependencies when vision-language features are disabled.
  • Removed outdated video-reader configuration from the published image.
  • Updated dependency locking to prevent legacy video packages from being installed unintentionally.

• Documentation

  • Updated Automodel build guidance to reflect the revised multimedia dependency behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 002226d7-c0f5-4bf2-9582-5e0f6685d02a

📥 Commits

Reviewing files that changed from the base of the PR and between 996983d and 11f9e65.

📒 Files selected for processing (3)

• docker/automodel/Dockerfile.nmp-automodel-base
• docker/automodel/README.md
• docker/automodel/cherry-picks/3d98f6e3.diff

🚧 Files skipped from review as they are similar to previous changes (2)

• docker/automodel/README.md
• docker/automodel/Dockerfile.nmp-automodel-base

---

📝 Walkthrough

Walkthrough

The Automodel GPU wheel group and base-builder context no longer include the FFmpeg VLM wheel. The base image no longer installs VLM media wheels or sets the TorchCodec video-reader override. The dependency patch and documentation now reflect the removed media dependencies.

Changes

Automodel VLM dependency removal

Layer / File(s)	Summary
Image dependency wiring docker-bake.hcl, docker/automodel/Dockerfile.nmp-automodel-base	Removed the FFmpeg VLM wheel from build wiring. Removed the VLM extra, media dependency exclusions, custom media wheel installation, and TorchCodec override from the base image.
Dependency patch updates docker/automodel/cherry-picks/3d98f6e3.diff	Removed opencv-python-headless, imageio-ffmpeg, and decord from dependency definitions and lock entries.
Documentation alignment docker/automodel/README.md	Documented the removed media dependencies and removed the TorchCodec video-reader instruction.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#762: Modifies the same FFmpeg/VLM wheel integration in the opposite direction.
• NVIDIA-NeMo/nemo-platform#1150: Removes related FFmpeg/VLM wheel integration from another image.

Suggested labels: chore

Suggested reviewers: ironcommit, crookedstorm, mckornfield

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: removing FFmpeg from Automodel to address unfixed CVEs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agabow/update-automodel-cves-release-0.4

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker/automodel/Dockerfile.nmp-automodel-base`:
- Around line 44-51: The unconditional opencv-python-headless dependency still
enters the text-training image despite excluding VLM/media extras. In
docker/automodel/Dockerfile.nmp-automodel-base lines 44-51, adjust the Automodel
dependency setup so OpenCV is not installed for the base text-training
environment, while preserving it for VLM usage if required; update the related
dependency/install handling at lines 164-166 accordingly. Update
docker/automodel/README.md line 88 to accurately describe the resulting image
behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6e0c9c60-6b7e-4e4a-8a41-8af2da2a81dd

📥 Commits

Reviewing files that changed from the base of the PR and between d985222 and 996983d.

📒 Files selected for processing (3)

• docker-bake.hcl
• docker/automodel/Dockerfile.nmp-automodel-base
• docker/automodel/README.md

💤 Files with no reviewable changes (1)

• docker-bake.hcl

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	31640/40258	78.6%	63.2%
Integration Tests	18402/38193	48.2%	20.8%