Skip to content

fix: nss image, remove ffmpeg, force wandb version #463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mckornfield merged 2 commits into from
Jun 25, 2026
Merged

fix: nss image, remove ffmpeg, force wandb version #463

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b3d7e64
fix: nss image, remove ffmpeg, force wandb version
mckornfield Jun 25, 2026
b1c365d
chore: update customizer images wandb version
mckornfield Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion docker/Dockerfile.nmp-automodel-base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \
"tornado>=6.5.5,<7" \
"urllib3>=2.7.0,<3" \
"mlflow-skinny>=3.11.1,<3.12.0" \
"grpcio>=1.81.1,<2"
"grpcio>=1.81.1,<2" \
"wandb==0.27.2"

# Published base image (same filesystem as builder).
FROM ${PYTORCH_BASE} AS nmp-automodel-base
Expand Down
11 changes: 9 additions & 2 deletions docker/Dockerfile.safe-synthesizer-tasks
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
# Global ARGs (must be declared before first FROM to be usable in FROM statements)
# =============================================================================
ARG PYTHON_VERSION=3.13
ARG PYTHON_IMAGE=python:${PYTHON_VERSION}-slim-bookworm
ARG PYTHON_IMAGE=python:${PYTHON_VERSION}-slim-trixie
Comment thread
mckornfield marked this conversation as resolved.
ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.9.30
ARG SAFE_SYNTHESIZER_RUNTIME_PACKAGE="nemo-safe-synthesizer[engine,cu129]==0.1.2"
ARG FLASHINFER_CU129_INDEX_URL="https://flashinfer.ai/whl/cu129"
Expand Down Expand Up @@ -109,14 +109,18 @@ RUN printf '%s\n' \
> /tmp/safe-synthesizer-runtime.txt && \
printf '%s\n' \
"${VLLM_CU129_WHEEL}" \
> /tmp/vllm-cu129.txt
> /tmp/vllm-cu129.txt && \
printf '%s\n' \
wandb==0.27.2 \
> /tmp/safe-synthesizer-overrides.txt

RUN --mount=type=cache,target=/root/.cache/uv \
UV_CACHE_DIR=/root/.cache/uv uv pip install --python /opt/venv/bin/python \
--extra-index-url "${FLASHINFER_CU129_INDEX_URL}" \
--extra-index-url "${PYTORCH_CU129_INDEX_URL}" \
--index-strategy unsafe-best-match \
--torch-backend cu129 \
--overrides /tmp/safe-synthesizer-overrides.txt \
--excludes /tmp/exclude-flashinfer-torch-vllm.txt \
--requirements /tmp/safe-synthesizer-runtime.txt

Expand All @@ -127,6 +131,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
--extra-index-url "${PYTORCH_CU129_INDEX_URL}" \
--index-strategy unsafe-best-match \
--torch-backend cu129 \
--overrides /tmp/safe-synthesizer-overrides.txt \
--excludes /tmp/exclude-torch-vllm.txt \
--requirements /tmp/safe-synthesizer-runtime.txt

Expand All @@ -137,6 +142,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
--extra-index-url "${PYTORCH_CU129_INDEX_URL}" \
--index-strategy unsafe-best-match \
--torch-backend cu129 \
--overrides /tmp/safe-synthesizer-overrides.txt \
--excludes /tmp/exclude-vllm.txt \
--requirements /tmp/safe-synthesizer-runtime.txt

Expand All @@ -147,6 +153,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
--extra-index-url "${PYTORCH_CU129_INDEX_URL}" \
--index-strategy unsafe-best-match \
--torch-backend cu129 \
--overrides /tmp/safe-synthesizer-overrides.txt \
--requirements /tmp/safe-synthesizer-runtime.txt \
--requirements /tmp/vllm-cu129.txt

Expand Down
3 changes: 3 additions & 0 deletions docker/automodel/no_override_requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,6 @@ tokenizers; sys_platform == 'never'
accelerate; sys_platform == 'never'
safetensors; sys_platform == 'never'
numpy; sys_platform == 'never'

# Keep W&B's bundled wandb-core binary on a build with patched go-git/go-billy.
wandb==0.27.2
11 changes: 6 additions & 5 deletions docker/scripts/cve-cleanup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,12 @@ set -e
# overlayfs whiteouts that also hide the hard-linked venv files (e.g.
# typing_extensions, pydantic), breaking imports at runtime.

# remove wandb-core gobinary (unused)
rm -f /app/.venv/lib/python3.11/site-packages/wandb/bin/wandb-core
rm -f /opt/venv/lib/python3.12/site-packages/wandb/bin/wandb-core
# Remove unused bundled ffmpeg binaries with their own vulnerability surface.
for venv in /app/.venv /opt/venv; do
if [ -d "${venv}" ]; then
find "${venv}" -type f \( -name ffmpeg -o -name 'ffmpeg-*' \) -delete
fi
done

# remove nsight cli (unused) - nic_sampler vulnerable
rm -rf /usr/local/cuda/NsightSystems-cli-*
Expand Down Expand Up @@ -45,5 +48,3 @@ rm -rf /usr/local/lib/python3.12/dist-packages/urllib3 \
rm -rf /usr/local/lib/python3.12/dist-packages/mlflow \
/usr/local/lib/python3.12/dist-packages/mlflow-*.dist-info \
/usr/local/lib/python3.12/dist-packages/mlflow_skinny-*.dist-info
rm -rf /usr/local/lib/python3.12/dist-packages/wandb \
/usr/local/lib/python3.12/dist-packages/wandb-*.dist-info
3 changes: 3 additions & 0 deletions docker/unsloth/no_override_requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,6 @@ torchaudio; sys_platform == 'never'
tokenizers; sys_platform == 'never'
accelerate; sys_platform == 'never'
safetensors; sys_platform == 'never'

# Keep W&B's bundled wandb-core binary on a build with patched go-git/go-billy.
wandb==0.27.2