fix(container): make vLLM FlashInfer cubin dirs writable

[bewestphal]

Summary

• grant group-write permission to directories under flashinfer_cubin/cubins in vLLM runtime images
• match the existing SGLang runtime behavior for arbitrary OpenShift UIDs in group 0
• allow FlashInfer TRT-LLM MoE initialization to create its package-local cubin symlinks

Without this, a non-root vLLM worker loading a ModelOpt FP8 MoE checkpoint fails during profile_run() with:

PermissionError: [Errno 13] Permission denied: /usr/local/lib/python3.12/dist-packages/flashinfer_cubin/cubins/flashinfer

Validation

• rendered the CUDA 13.0 vLLM runtime Dockerfile and verified the permission step
• git diff --check
• pre-commit run --files container/templates/vllm_runtime.Dockerfile
• Ran a e2e DGD deploy before/after that previously required cubin hack which now works without it.

---

Summary by CodeRabbit

• Enhancements
  • Improved runtime image setup by ensuring FlashInfer cache directories are accessible when available.

[devin-ai-integration]

Devin Review found 1 potential issue.

[coderabbitai]

Walkthrough

The runtime Dockerfile now conditionally locates the FlashInfer cubin cache and grants group access to its directories. The permission step is skipped when the cache is absent.

Changes

FlashInfer cache permissions

Layer / File(s)	Summary
Configure runtime cache permissions container/templates/vllm_runtime.Dockerfile	The runtime image locates the FlashInfer cubin cache and applies group read, write, and execute permissions to its directories when present.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change and validation, but it omits the required Related Issues section and reviewer starting point.	Add the required Related Issues section and identify the file or code area where reviewers should start.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: granting write access to vLLM FlashInfer cubin directories.

---

_{Comment @coderabbitai help to get the list of available commands.}

[dynamo-ops]

/ok to test 3d0ae32

[datadog-official]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 36.73% (-5.58%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6237556 | Docs | Datadog PR Page | Give us feedback!}

[dynamo-ops]

/ok to test 6237556