Support launch as Non-Root user in all published container images. (o…

…pea-project#406) Signed-off-by: zepan <[email protected]>
BaoHuiling · Aug 13, 2024 · 7c8030f · 7c8030f
1 parent 24f48e0
commit 7c8030f
Show file tree

Hide file tree

Showing 21 changed files with 148 additions and 80 deletions.
diff --git a/comps/asr/Dockerfile b/comps/asr/Dockerfile
@@ -3,15 +3,20 @@
 
 FROM python:3.11-slim
 
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
+USER user
+
 ENV LANG=C.UTF-8
 
-COPY comps /home/comps
+COPY comps /home/user/comps
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/asr/requirements.txt
+    pip install --no-cache-dir -r /home/user/comps/asr/requirements.txt
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/asr
+WORKDIR /home/user/comps/asr
 
 ENTRYPOINT ["python", "asr.py"]
diff --git a/comps/asr/whisper/Dockerfile b/comps/asr/whisper/Dockerfile
@@ -3,21 +3,28 @@
 
 FROM python:3.11-slim
 
+
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
+
 # Set environment variables
 ENV LANG=en_US.UTF-8
-ENV PYTHONPATH=/home/user
 
 # Install system dependencies
 RUN apt-get update \
     && apt-get install -y ffmpeg
 
-COPY comps /home/comps
+COPY --chown=user:user comps /home/user/comps
+
+USER user
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/asr/requirements.txt
+    pip install --no-cache-dir -r /home/user/comps/asr/requirements.txt && \
+    pip list
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/asr/whisper
+WORKDIR /home/user/comps/asr/whisper
 
 ENTRYPOINT ["python", "whisper_server.py", "--device", "cpu"]
diff --git a/comps/asr/whisper/Dockerfile_hpu b/comps/asr/whisper/Dockerfile_hpu
@@ -4,6 +4,10 @@
 # HABANA environment
 FROM vault.habana.ai/gaudi-docker/1.16.1/ubuntu22.04/habanalabs/pytorch-installer-2.2.2:latest AS hpu
 
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
+
 # Set environment variables
 ENV LANG=en_US.UTF-8
 ENV PYTHONPATH=/home/user:/usr/lib/habanalabs/:/optimum-habana
@@ -12,15 +16,17 @@ ENV PYTHONPATH=/home/user:/usr/lib/habanalabs/:/optimum-habana
 RUN apt-get update \
     && apt-get install -y ffmpeg
 
-COPY comps /home/comps
+COPY --chown=user:user comps /home/user/comps
+
+USER user
 
 # Install requirements and optimum habana
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/asr/requirements.txt && \
+    pip install --no-cache-dir -r /home/user/comps/asr/requirements.txt && \
     pip install optimum[habana]
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/asr/whisper
+WORKDIR /home/user/comps/asr/whisper
 
 ENTRYPOINT ["python", "whisper_server.py", "--device", "hpu"]
diff --git a/comps/embeddings/langchain-mosec/mosec-docker/Dockerfile b/comps/embeddings/langchain-mosec/mosec-docker/Dockerfile
@@ -2,22 +2,26 @@
 # SPDX-License-Identifier: Apache-2.0
 
 From ubuntu:22.04
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV GLIBC_TUNABLES glibc.cpu.x86_shstk=permissive
+RUN apt update && apt install -y python3 python3-pip 
 
-COPY comps /root/comps
+USER user
+COPY comps /home/user/comps
 
-RUN apt update && apt install -y python3 python3-pip 
 RUN pip3 install torch==2.2.2 torchvision --index-url https://download.pytorch.org/whl/cpu 
 RUN pip3 install intel-extension-for-pytorch==2.2.0
 RUN pip3 install transformers
 RUN pip3 install llmspec mosec
 
-RUN cd /root/ && export HF_ENDPOINT=https://hf-mirror.com && huggingface-cli download --resume-download BAAI/bge-large-zh-v1.5 --local-dir /root/bge-large-zh-v1.5
+RUN cd /home/user/ && export HF_ENDPOINT=https://hf-mirror.com && huggingface-cli download --resume-download BAAI/bge-large-zh-v1.5 --local-dir /home/user/bge-large-zh-v1.5
 
-ENV EMB_MODEL="/root/bge-large-zh-v1.5/"
+ENV EMB_MODEL="/home/user/bge-large-zh-v1.5/"
 
-WORKDIR /root/comps/embeddings/langchain-mosec/mosec-docker
+WORKDIR /home/user/comps/embeddings/langchain-mosec/mosec-docker
 
 CMD ["python3", "server-ipex.py"]
diff --git a/comps/llms/text-generation/vllm-xft/docker/Dockerfile b/comps/llms/text-generation/vllm-xft/docker/Dockerfile
@@ -95,4 +95,3 @@ RUN chmod +x /root/comps/llms/text-generation/vllm-xft/run.sh
 WORKDIR /root/comps/llms/text-generation/vllm-xft/
 
 ENTRYPOINT ["/root/comps/llms/text-generation/vllm-xft/run.sh"]
-
diff --git a/comps/llms/text-generation/vllm/docker/Dockerfile.hpu b/comps/llms/text-generation/vllm/docker/Dockerfile.hpu
@@ -1,8 +1,12 @@
 # FROM vault.habana.ai/gaudi-docker/1.15.1/ubuntu22.04/habanalabs/pytorch-installer-2.2.0:latest
 FROM vault.habana.ai/gaudi-docker/1.16.0/ubuntu22.04/habanalabs/pytorch-installer-2.2.2:latest
-
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
 ENV LANG=en_US.UTF-8
-
+RUN sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
+    service ssh restart
+USER user
 WORKDIR /root
 
 RUN pip install --upgrade-strategy eager optimum[habana]
@@ -11,9 +15,6 @@ RUN pip install -v git+https://github.com/HabanaAI/vllm-fork.git@cf6952d
 
 RUN pip install setuptools
 
-RUN sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
-    service ssh restart
-
 ENV no_proxy=localhost,127.0.0.1
 
 ENV PT_HPU_LAZY_ACC_PAR_MODE=0

diff --git a/comps/llms/utils/lm-eval/Dockerfile.cpu b/comps/llms/utils/lm-eval/Dockerfile.cpu
@@ -1,6 +1,8 @@
 ARG UBUNTU_VER=22.04
 FROM ubuntu:${UBUNTU_VER} as devel
-
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
 ARG REPO_COMPS=https://github.com/opea-project/GenAIComps.git
 ARG BRANCH=main
 ENV LANG=C.UTF-8
@@ -16,7 +18,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends --fix-missing \
     git \
     vim \
     wget
-
+USER user
 RUN git clone --single-branch --branch=${BRANCH} ${REPO_COMPS} /home/user/GenAIComps/ && \
     cd /home/user/GenAIComps/ && python3 setup.py install && \
     pip install --no-cache-dir -r /home/user/GenAIComps/comps/llms/utils/lm-eval/requirements.txt

diff --git a/comps/lvms/Dockerfile b/comps/lvms/Dockerfile
@@ -2,17 +2,20 @@
 # SPDX-License-Identifier: Apache-2.0
 
 FROM python:3.11-slim
-
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
+USER user
 # Set environment variables
 ENV LANG=en_US.UTF-8
 
-COPY comps /home/comps
+COPY comps /home/user/comps
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/lvms/requirements.txt
+    pip install --no-cache-dir -r /home/user/comps/lvms/requirements.txt
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/lvms
+WORKDIR /home/user/comps/lvms
 
 ENTRYPOINT ["python", "lvm.py"]
diff --git a/comps/lvms/llava/Dockerfile b/comps/lvms/llava/Dockerfile
@@ -2,18 +2,21 @@
 # SPDX-License-Identifier: Apache-2.0
 
 FROM python:3.11-slim
-
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
+USER user
 # Set environment variables
 ENV LANG=en_US.UTF-8
 ENV PYTHONPATH=/home/user:/usr/lib/habanalabs/:/optimum-habana
 
-COPY comps /home/comps
+COPY comps /home/user/comps
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/lvms/requirements.txt
+    pip install --no-cache-dir -r /home/user/comps/lvms/requirements.txt
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/lvms/llava
+WORKDIR /home/user/comps/lvms/llava
 
 ENTRYPOINT ["python", "llava_server.py", "--device", "cpu"]
diff --git a/comps/lvms/llava/Dockerfile_hpu b/comps/lvms/llava/Dockerfile_hpu
@@ -3,21 +3,25 @@
 
 # HABANA environment
 FROM vault.habana.ai/gaudi-docker/1.16.1/ubuntu22.04/habanalabs/pytorch-installer-2.2.2:latest AS hpu
-RUN rm -rf /etc/ssh/ssh_host*
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
 
+RUN rm -rf /etc/ssh/ssh_host*
+USER user
 # Set environment variables
 ENV LANG=en_US.UTF-8
 ENV PYTHONPATH=/home/user:/usr/lib/habanalabs/:/optimum-habana
 
-COPY comps /home/comps
+COPY comps /home/user/comps
 
 # Install requirements and optimum habana
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/lvms/requirements.txt && \
+    pip install --no-cache-dir -r /home/user/comps/lvms/requirements.txt && \
     pip install optimum[habana]
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/lvms/llava
+WORKDIR /home/user/comps/lvms/llava
 
 ENTRYPOINT ["python", "llava_server.py"]
diff --git a/comps/reranks/langchain-mosec/mosec-docker/Dockerfile b/comps/reranks/langchain-mosec/mosec-docker/Dockerfile
@@ -2,22 +2,26 @@
 # SPDX-License-Identifier: Apache-2.0
 
 From ubuntu:22.04
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV GLIBC_TUNABLES glibc.cpu.x86_shstk=permissive
 
-COPY comps /root/comps
+COPY comps /home/user/comps
 
 RUN apt update && apt install -y python3 python3-pip 
+USER user
 RUN pip3 install torch==2.2.2 torchvision --trusted-host download.pytorch.org --index-url https://download.pytorch.org/whl/cpu 
 RUN pip3 install intel-extension-for-pytorch==2.2.0
 RUN pip3 install transformers sentence-transformers
 RUN pip3 install llmspec mosec
 
-RUN cd /root/ && export HF_ENDPOINT=https://hf-mirror.com && huggingface-cli download --resume-download BAAI/bge-reranker-large --local-dir /root/bge-reranker-large
+RUN cd /home/user/ && export HF_ENDPOINT=https://hf-mirror.com && huggingface-cli download --resume-download BAAI/bge-reranker-large --local-dir /home/user/bge-reranker-large
 
-ENV EMB_MODEL="/root/bge-reranker-large/"
+ENV EMB_MODEL="/home/user/bge-reranker-large/"
 
-WORKDIR /root/comps/reranks/langchain-mosec/mosec-docker
+WORKDIR /home/user/comps/reranks/langchain-mosec/mosec-docker
 
 CMD ["python3", "server-ipex.py"]
diff --git a/comps/tts/Dockerfile b/comps/tts/Dockerfile
@@ -2,16 +2,19 @@
 # SPDX-License-Identifier: Apache-2.0
 
 FROM python:3.11-slim
-
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
+USER user
 ENV LANG=C.UTF-8
 
-COPY comps /home/comps
+COPY comps /home/user/comps
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/tts/requirements.txt
+    pip install --no-cache-dir -r /home/user/comps/tts/requirements.txt
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/tts
+WORKDIR /home/user/comps/tts
 
 ENTRYPOINT ["python", "tts.py"]
diff --git a/comps/tts/speecht5/Dockerfile b/comps/tts/speecht5/Dockerfile
@@ -2,6 +2,9 @@
 # SPDX-License-Identifier: Apache-2.0
 
 FROM python:3.11-slim
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
 
 # Set environment variables
 ENV LANG=en_US.UTF-8
@@ -12,13 +15,15 @@ RUN apt-get update \
     && apt-get install -y ffmpeg \
     && apt-get install -y curl
 
-COPY comps /home/comps
+COPY --chown=user:user comps /home/user/comps
+
+USER user
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/tts/requirements.txt
+    pip install --no-cache-dir -r /home/user/comps/tts/requirements.txt
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/tts/speecht5
+WORKDIR /home/user/comps/tts/speecht5
 
 ENTRYPOINT ["python", "speecht5_server.py", "--device", "cpu"]
diff --git a/comps/tts/speecht5/Dockerfile_hpu b/comps/tts/speecht5/Dockerfile_hpu
@@ -3,7 +3,9 @@
 
 # HABANA environment
 FROM vault.habana.ai/gaudi-docker/1.16.1/ubuntu22.04/habanalabs/pytorch-installer-2.2.2:latest AS hpu
-
+RUN useradd -m -s /bin/bash user && \
+    mkdir -p /home/user && \
+    chown -R user /home/user/
 RUN rm -rf /etc/ssh/ssh_host*
 
 # Set environment variables
@@ -15,15 +17,17 @@ RUN apt-get update \
     && apt-get install -y ffmpeg \
     && apt-get install -y curl
 
-COPY comps /home/comps
+COPY --chown=user:user comps /home/user/comps
+
+USER user
 
 # Install requirements and optimum habana
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r /home/comps/tts/requirements.txt && \
+    pip install --no-cache-dir -r /home/user/comps/tts/requirements.txt && \
     pip install optimum[habana]
 
-ENV PYTHONPATH=$PYTHONPATH:/home
+ENV PYTHONPATH=$PYTHONPATH:/home/user
 
-WORKDIR /home/comps/tts/speecht5
+WORKDIR /home/user/comps/tts/speecht5
 
 ENTRYPOINT ["python", "speecht5_server.py", "--device", "hpu"]