[dmitry-tokarev-nv]

Linear: OPS-9080

Summary

Add libbrotli1 to the apt-get install --only-upgrade step of the vLLM, SGLang, TensorRT-LLM and frontend runtime templates. That step moves packages that the base image already ships to the current Ubuntu patch release.

• The vLLM, SGLang and TensorRT-LLM base images ship libbrotli1 1.1.0-2build2. The noble archive has 1.1.0-2ubuntu0.1 for amd64 and arm64.
• The frontend gets libbrotli1 from a fresh install and already has 1.1.0-2ubuntu0.1. If a build reuses an older cached layer, the list entry still moves it to the current release.
• The changed step text also makes BuildKit run these steps again instead of reusing the cached layers.

Validation

container/render.py renders seven CUDA targets: vLLM, SGLang and TensorRT-LLM, each with and without --make-efa, plus the frontend. Each rendered Dockerfile differs from main by the one added line.

I ran the rendered step from main and from this branch inside the main-* images built from 7e44a1dfea (amd64). Each run used root and a fresh container:

Image	Step text	libbrotli1 before	after	apt summary
vLLM	main	1.1.0-2build2	1.1.0-2build2	0 upgraded, 0 newly installed, 0 to remove
vLLM	this PR	1.1.0-2build2	1.1.0-2ubuntu0.1	1 upgraded (libbrotli1), 0 newly installed, 0 to remove
SGLang	main	1.1.0-2build2	1.1.0-2build2	0 upgraded, 0 newly installed, 0 to remove
SGLang	this PR	1.1.0-2build2	1.1.0-2ubuntu0.1	1 upgraded (libbrotli1), 0 newly installed, 0 to remove
TensorRT-LLM	main	1.1.0-2build2	1.1.0-2build2	0 upgraded, 0 newly installed, 0 to remove
TensorRT-LLM	this PR	1.1.0-2build2	1.1.0-2ubuntu0.1	1 upgraded (libbrotli1), 0 newly installed, 0 to remove
frontend	main	1.1.0-2ubuntu0.1	1.1.0-2ubuntu0.1	0 upgraded
frontend	this PR	1.1.0-2ubuntu0.1	1.1.0-2ubuntu0.1	0 upgraded

• arm64: ports.ubuntu.com lists libbrotli1 1.1.0-2ubuntu0.1 in noble-updates. The control package, libssl3t64 3.0.13-0ubuntu3.16, matches the version installed in the images.
• The sidecar image does not install libbrotli1 (dpkg-query: no packages found matching libbrotli1 in main-dynamo-sidecar), so its list stays as it is.
• pre-commit run --all-files: 40 hooks passed.
• The images that CI built for this PR (93e5d251ba): vLLM, SGLang, TensorRT-LLM and frontend, on amd64 and arm64, all ship libbrotli1 1.1.0-2ubuntu0.1. In each image, the three shared-library files match the package md5sums, which is the check that dpkg -V runs. Control: main-vllm-runtime still has 1.1.0-2build2.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Four container templates add libbrotli1 to existing OS package upgrade lists.

Changes

Runtime image package upgrades

Layer / File(s)	Summary
Add libbrotli1 to upgrade lists container/templates/frontend.Dockerfile, container/templates/sglang_runtime.Dockerfile, container/templates/trtllm_runtime.Dockerfile, container/templates/vllm_runtime.Dockerfile	Each template adds libbrotli1 to its existing --only-upgrade package list.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Minimal · up to 93e5d

No actionable merge-blocking risk was identified in the package upgrade changes.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: adding libbrotli1 to runtime OS package refresh steps.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description is mostly complete. It explains the change, provides detailed validation results, and identifies the related Linear issue. It does not use all template headings, include an explicit Is…

Full details: Description check

Explanation

The description is mostly complete. It explains the change, provides detailed validation results, and identifies the related Linear issue. It does not use all template headings, include an explicit Issues and Ongoing Work section, or include the pull request checklist, but these omissions do not prevent review.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: ai-dynamo/dynamo
• Branch: main
• File: .coderabbit.yaml
• Commit: 7e44a1d
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 905d185d-1106-4ddd-b7ae-524e2f51213e

Commits

Reviewing files that changed from the base of the PR and between 7e44a1d and 93e5d25.

Files selected for processing: 4

• container/templates/frontend.Dockerfile
• container/templates/sglang_runtime.Dockerfile
• container/templates/trtllm_runtime.Dockerfile
• container/templates/vllm_runtime.Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

[devin-ai-integration]

❌ Dynamo PR CI failed — run 41577864443 (attempt 2) on 93e5d251ba

Gate checks: ✅ backend-status-check · ❌ deploy-status-check · ✅ dynamo-status-check

Framework	Deploy
vLLM	❌ 2 ✅ 2
SGLang	❌ 1 ✅ 2

Failure details

3 Deploy Test jobs failed the same way, before any test ran: vcluster create ci-41577864443 waited about 2 minutes for namespace gh-id-41577864443-pr-17913-dt to finish terminating, then timed out. This is an infrastructure failure. No jobs were cancelled.

❌ sglang Deploy Test / agg_router: vCluster create timed out waiting for namespace termination

Job: sglang Deploy Test / agg_router · Failed step: Self-bootstrap vCluster (rerun) · Logs: gh run view --job 125764335025 -R ai-dynamo/dynamo --log-failed

+ vcluster create ci-41577864443 --namespace gh-id-41577864443-pr-17913-dt --connect=false --upgrade --set controlPlane.distro.k8s.enabled=true --set controlPlane.distro.k8s.version=v1.36.4 --set sync.toHost.persistentVolumes.enabled=true
06:28:27 info Waiting until namespace is terminated...
06:30:27 fatal client rate limiter Wait returned an error: context deadline exceeded
+ grep -qE 'release: already exists|another operation \(install/upgrade/rollback\) is in progress' /tmp/tmp.k9ENvGW8yH
+ exit 1
##[error]Process completed with exit code 1.

The vCluster bootstrap failed before deployment or tests started. vcluster create hit its deadline while waiting for the run's namespace, which still looked like it was terminating from the previous attempt. The "already exists / in progress" adoption check did not match, so the step exited. This is an infrastructure/cluster-state problem, not a code failure. Rerunning the failed jobs is likely enough once the namespace is gone.

❌ vllm Deploy Test / agg: vCluster create timed out waiting for namespace termination

Job: vllm Deploy Test / agg · Failed step: Self-bootstrap vCluster (rerun) · Logs: gh run view --job 125764335116 -R ai-dynamo/dynamo --log-failed

+ vcluster create ci-41577864443 --namespace gh-id-41577864443-pr-17913-dt --connect=false --upgrade --set controlPlane.distro.k8s.enabled=true --set controlPlane.distro.k8s.version=v1.36.4 --set sync.toHost.persistentVolumes.enabled=true
06:28:27 info Waiting until namespace is terminated...
06:30:30 fatal client rate limiter Wait returned an error: context deadline exceeded
+ grep -qE 'release: already exists|another operation \(install/upgrade/rollback\) is in progress' /tmp/tmp.k9ENvGW8yH
+ exit 1
##[error]Process completed with exit code 1.

The vCluster bootstrap failed before deployment or tests started. vcluster create hit its deadline while waiting for the run's namespace, which still looked like it was terminating from the previous attempt. The "already exists / in progress" adoption check did not match, so the step exited. This is an infrastructure/cluster-state problem, not a code failure. Rerunning the failed jobs is likely enough once the namespace is gone.

❌ vllm Deploy Test / agg_router: vCluster create timed out waiting for namespace termination

Job: vllm Deploy Test / agg_router · Failed step: Self-bootstrap vCluster (rerun) · Logs: gh run view --job 125764335140 -R ai-dynamo/dynamo --log-failed

+ vcluster create ci-41577864443 --namespace gh-id-41577864443-pr-17913-dt --connect=false --upgrade --set controlPlane.distro.k8s.enabled=true --set controlPlane.distro.k8s.version=v1.36.4 --set sync.toHost.persistentVolumes.enabled=true
06:28:27 info Waiting until namespace is terminated...
06:30:27 fatal client rate limiter Wait returned an error: context deadline exceeded
+ grep -qE 'release: already exists|another operation \(install/upgrade/rollback\) is in progress' /tmp/tmp.k9ENvGW8yH
+ exit 1
##[error]Process completed with exit code 1.

The vCluster bootstrap failed before deployment or tests started. vcluster create hit its deadline while waiting for the run's namespace, which still looked like it was terminating from the previous attempt. The "already exists / in progress" adoption check did not match, so the step exited. This is an infrastructure/cluster-state problem, not a code failure. Rerunning the failed jobs is likely enough once the namespace is gone.

For agents

{
 "pr": 17913,
 "run_id": 41577864443,
 "run_attempt": 2,
 "head_sha": "93e5d251bae6a983ef1cc890460af47919eb7290",
 "failures": [
  {
   "job": "sglang Deploy Test / agg_router",
   "job_id": 125764335025,
   "failed_step": "Self-bootstrap vCluster (rerun)",
   "signature": "vcluster create timed out waiting for namespace termination (client rate limiter: context deadline exceeded)",
   "tests": [],
   "log_cmd": "gh run view --job 125764335025 -R ai-dynamo/dynamo --log-failed"
  },
  {
   "job": "vllm Deploy Test / agg",
   "job_id": 125764335116,
   "failed_step": "Self-bootstrap vCluster (rerun)",
   "signature": "vcluster create timed out waiting for namespace termination (client rate limiter: context deadline exceeded)",
   "tests": [],
   "log_cmd": "gh run view --job 125764335116 -R ai-dynamo/dynamo --log-failed"
  },
  {
   "job": "vllm Deploy Test / agg_router",
   "job_id": 125764335140,
   "failed_step": "Self-bootstrap vCluster (rerun)",
   "signature": "vcluster create timed out waiting for namespace termination (client rate limiter: context deadline exceeded)",
   "tests": [],
   "log_cmd": "gh run view --job 125764335140 -R ai-dynamo/dynamo --log-failed"
  }
 ]
}

_{Posted automatically by Devin for run 41577864443. Updated on every full-CI run of this PR.}