build: remove FFmpeg from automodel to avoid unfixed CVE

docker-bake.hcl

@@ -335,7 +335,6 @@ group "nmp-automodel-gpu-wheels" {
   targets = [
     "causal-conv1d-wheel",
     "mamba-ssm-wheel",
-    "ffmpeg-vlm-wheel",
   ]
 }
 
@@ -903,7 +902,6 @@ target "nmp-automodel-base-builder" {
   contexts = {
     causal-conv1d-wheel-image = causal_conv1d_wheel_context()
     mamba-ssm-wheel-image     = mamba_ssm_wheel_context()
-    ffmpeg-vlm-wheel-image    = ffmpeg_vlm_wheel_context()
   }
   platforms = get_platforms()
 }

docker/automodel/Dockerfile.nmp-automodel-base

@@ -11,7 +11,6 @@ ARG PYTORCH_BASE=nvcr.io/nvidia/pytorch:26.05-py3
 
 FROM causal-conv1d-wheel-image AS causal-conv1d-wheel-src
 FROM mamba-ssm-wheel-image AS mamba-ssm-wheel-src
-FROM ffmpeg-vlm-wheel-image AS ffmpeg-vlm-wheel-src
 
 FROM alpine/git AS automodel-clone
 ARG AUTOMODEL_COMMIT
@@ -42,13 +41,12 @@ RUN cd /opt/Automodel && \
     bash docker/common/update_pyproject_pytorch.sh /opt/Automodel && \
     patch -p1 < /opt/cherry-picks/3d98f6e3.diff
 
-# Sync all Automodel extras except cuda — causal-conv1d, mamba-ssm, nv-grouped-gemm,
-# and bitsandbytes are installed from prebuilt wheels / source in the steps below.
+# Sync the Automodel extras used by text training. The cherry-pick removes the
+# unconditional OpenCV dependency; skipping VLM/media extras keeps FFmpeg wheels out.
 RUN --mount=type=cache,target=/root/.cache/uv \
     cd /opt/Automodel && \
     UV_HTTP_TIMEOUT=120 uv sync --locked \
     --extra extra \
-    --extra vlm \
     --extra delta-databricks \
     --all-groups
 
@@ -113,21 +111,6 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     "grpcio>=1.81.1,<2" \
     "wandb>=0.28.1,<1"
 
-# Replace PyPI av/opencv (bundled FFmpeg < 8.1.2) with custom wheels from ffmpeg-vlm-wheel.
-# vlm sync pulls PyPI copies transitively; drop them before installing our manylinux wheels.
-# PyAV 17.x uses cp311-abi3 (stable ABI) — compatible with cp312, not cp312-cp312 tagged.
-RUN --mount=from=ffmpeg-vlm-wheel-src,target=/tmp/ffmpeg-vlm-wheel-src,readonly \
-    rm -rf \
-    /opt/venv/lib/python*/site-packages/av \
-    /opt/venv/lib/python*/site-packages/av-*.dist-info \
-    /opt/venv/lib/python*/site-packages/av.libs \
-    /opt/venv/lib/python*/site-packages/cv2 \
-    /opt/venv/lib/python*/site-packages/opencv_python_headless.libs \
-    /opt/venv/lib/python*/site-packages/opencv_python_headless-*.dist-info && \
-    uv pip install --no-cache-dir --no-deps \
-    /tmp/ffmpeg-vlm-wheel-src/wheels/av-*-abi3-manylinux_2_28_*.whl \
-    /tmp/ffmpeg-vlm-wheel-src/wheels/opencv_python_headless-*cp312*.whl
-
 # Published base image (same filesystem as builder).
 FROM ${PYTORCH_BASE} AS nmp-automodel-base
 ARG PYTORCH_BASE
@@ -180,8 +163,7 @@ RUN rm -rf \
 
 ENV VIRTUAL_ENV=/opt/venv \
     UV_PROJECT_ENVIRONMENT=/opt/venv \
-    HF_HUB_ENABLE_HF_TRANSFER=1 \
-    FORCE_QWENVL_VIDEO_READER=torchcodec
+    HF_HUB_ENABLE_HF_TRANSFER=1
 ENV PATH="/bin:/opt/venv/bin:/root/.local/bin:$PATH"
 WORKDIR /opt
 

docker/automodel/README.md

@@ -85,7 +85,7 @@ Override registry: `export WHEELS_REGISTRY=...` and `export IMAGE_REGISTRY=...`
 
 | Patch | Purpose |
 |-------|---------|
-| `3d98f6e3.diff` | Drop `decord` + `imageio-ffmpeg` (old bundled ffmpeg); use `torchcodec` for VLM video (`FORCE_QWENVL_VIDEO_READER=torchcodec`) |
+| `3d98f6e3.diff` | Drop old media deps (`decord`, `imageio-ffmpeg`) from Automodel extras and remove Automodel's unconditional `opencv-python-headless` dependency. The container skips Automodel's VLM extra, so FFmpeg-bearing `av` / `opencv-python-headless` wheels are not installed. |
 
 **Customizer tasks image (`nmp-customizer-tasks`):** `uv sync --package nmp-customization-common --package nmp-models --no-dev --inexact` from the customizer workspace slice (`docker/customizer/`). Hosts shared CPU steps (`file_io`, `model_entity`, `model_spec`, LoRA sidecar) for all customization backends.
 

docker/automodel/cherry-picks/3d98f6e3.diff

@@ -2,6 +2,14 @@ diff --git a/pyproject.toml b/pyproject.toml
 index 801ca1be..3d98f6e3 100644
 --- a/pyproject.toml
 +++ b/pyproject.toml
+@@ -80,7 +80,6 @@ dependencies = [
+     "datasets>=4.0.0",
+     "megatron-fsdp>=0.2.3",
+     "mistral-common[image,audio,hf-hub,sentencepiece]",
+-    "opencv-python-headless==4.10.0.84",
+     "pybind11",
+     "pyyaml",
+     "tiktoken",
 @@ -99,7 +99,6 @@ diffusion = [
      "diffusers>=0.37.0",
      "ftfy",
@@ -63,6 +71,14 @@ index ad6029d3..42f67bd1 100644
  [[package]]
  name = "imagesize"
  version = "1.4.1"
+@@ -3879,7 +3852,6 @@ dependencies = [
+     { name = "megatron-fsdp" },
+     { name = "mistral-common", extra = ["audio", "hf-hub", "image", "sentencepiece"] },
+     { name = "mlflow" },
+-    { name = "opencv-python-headless" },
+     { name = "pybind11" },
+     { name = "pyyaml" },
+     { name = "tiktoken" },
 @@ -3900,13 +3873,11 @@ all = [
      { name = "boto3" },
      { name = "causal-conv1d" },
@@ -117,3 +133,10 @@ index ad6029d3..42f67bd1 100644
      { name = "kernels", marker = "extra == 'diffusion-kernels'" },
      { name = "mamba-ssm", marker = "extra == 'cuda'" },
      { name = "megatron-fsdp", specifier = ">=0.2.3" },
+@@ -4109,7 +4075,6 @@ requires-dist = [
+     { name = "onnxscript", marker = "extra == 'cuda'", specifier = ">=0.5.6" },
+     { name = "open-clip-torch", marker = "extra == 'vlm'" },
+-    { name = "opencv-python-headless", specifier = "==4.10.0.84" },
+     { name = "opencv-python-headless", marker = "extra == 'diffusion'" },
+     { name = "perceptron", marker = "extra == 'extra'" },
+     { name = "pillow", marker = "extra == 'vlm'" },