29b302cdf0
Some checks failed
CI / skinny-install (aco) (push) Successful in 46s
CI / skinny-install (api) (push) Successful in 28s
CI / skinny-install (bcda) (push) Successful in 26s
CI / skinny-install (bib) (push) Successful in 24s
CI / skinny-install (bls) (push) Successful in 28s
CI / skinny-install (ccw) (push) Successful in 31s
CI / skinny-install (cli) (push) Successful in 26s
CI / skinny-install (cms) (push) Successful in 26s
CI / skinny-install (conf) (push) Successful in 26s
CI / skinny-install (pfs) (push) Successful in 26s
CI / skinny-install (rex) (push) Successful in 24s
CI / lint-test (push) Successful in 5m50s
Infra CI / notebooks (push) Successful in 1m14s
Infra CI / zotero (push) Failing after 5s
Infra CI / docs (push) Successful in 6s
Infra CI / api (push) Successful in 13s
Infra CI / mc (push) Successful in 7s
Deploy / build-scan-report (push) Successful in 5m6s
Cherry-picked from feat/pkg-supply-chain, adapted for infra/ tree layout: - dev/scripts/pkg_inventory.py — scans Dockerfiles, pyproject.toml, CI workflows, and shell scripts to build a unified package manifest - dev/scripts/pkg_mirror_sync.py — syncs PyPI/APK/npm packages to Gitea package registry (replaces devpi/apt-cacher-ng) - dev/scripts/pkg_drift.py — compares mirror contents against manifest, flags missing or stale packages - dev/scripts/pkg_issues.py — auto-creates Gitea issues for drift and CVE findings - dev/scripts/test_network_isolation.sh — verifies containers can't reach the internet except through mirrors - dev/pipelines/pkg-supply-chain.yml — CI-agnostic pipeline spec - .gitea/workflows/pkg-supply-chain.yml — daily + push-triggered CI job - PYPI_INDEX_URL build arg added to api and notebooks Dockerfiles
63 lines
2.2 KiB
Docker
63 lines
2.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM nvidia/cuda:12.6.0-runtime-ubuntu24.04
|
|
|
|
ARG USERNAME=kert
|
|
ARG USER_UID=1000
|
|
ARG USER_GID=1000
|
|
ARG PYTHON_VERSION=3.13
|
|
|
|
# Local package registry (Gitea) — set via --build-arg to pull from mirror
|
|
ARG PYPI_INDEX_URL=""
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
HOME=/home/kert \
|
|
PATH="/home/kert/.local/bin:${PATH}" \
|
|
NVIDIA_VISIBLE_DEVICES=all \
|
|
NVIDIA_DRIVER_CAPABILITIES=compute,utility
|
|
|
|
# System dependencies
|
|
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
ca-certificates \
|
|
git \
|
|
build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Rename existing ubuntu user/group to kert and fix home ownership
|
|
RUN groupmod -n ${USERNAME} ubuntu \
|
|
&& usermod -l ${USERNAME} -d /home/${USERNAME} -m -s /bin/bash ubuntu \
|
|
&& chown -R ${USER_UID}:${USER_GID} /home/${USERNAME}
|
|
|
|
# Install uv
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uvx /usr/local/bin/uvx
|
|
|
|
# Stay as root for rootless Docker compatibility
|
|
# (root in container = host user in rootless Docker)
|
|
WORKDIR /home/${USERNAME}
|
|
|
|
# Initialize uv project and install dependencies
|
|
RUN uv python install ${PYTHON_VERSION} \
|
|
&& uv init workspace --python ${PYTHON_VERSION} \
|
|
&& cd workspace \
|
|
&& uv add "marimo[recommended]" polars cudf-polars-cu12 pandas numpy pyarrow \
|
|
"pyiceberg[s3,pyarrow]>=0.7.0" "duckdb>=1.0.0" "narwhals>=1.0.0" "trino>=0.328.0" \
|
|
"sqlglot>=26.0.0" \
|
|
vega_datasets pyzotero obstore s3fs \
|
|
--extra-index-url https://pypi.nvidia.com
|
|
|
|
# Create marimo config directory and config
|
|
RUN mkdir -p /home/${USERNAME}/.config/marimo
|
|
COPY --chown=${USER_UID}:${USER_GID} .marimo.toml /home/${USERNAME}/.config/marimo/marimo.toml
|
|
COPY --chown=${USER_UID}:${USER_GID} .marimo-config/loch.css /home/${USERNAME}/.config/marimo/loch.css
|
|
|
|
EXPOSE 2718
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD curl -sf http://localhost:2718/health || exit 1
|
|
|
|
CMD ["uv", "run", "--project", "/home/kert/workspace", \
|
|
"marimo", "edit", \
|
|
"--host", "0.0.0.0", "--port", "2718", "--headless", "--no-token", \
|
|
"/home/kert/notebooks"]
|