@@ -6,6 +6,24 @@ ARG BASE_IMAGE
66# External image alias for UBI repository configuration
77FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
88
9+ ############################
10+ # Stage 1: PDF Tool Build #
11+ ############################
12+ FROM registry.access.redhat.com/ubi9/python-312:latest AS pdf-builder
13+
14+ WORKDIR /opt/app-root/bin
15+
16+ # OS Packages needs to be installed as root
17+ USER 0
18+
19+ # Copy scripts
20+ COPY jupyter/utils/install_texlive.sh ./install_texlive.sh
21+ COPY jupyter/utils/install_pandoc.sh ./install_pandoc.sh
22+ RUN chmod +x install_texlive.sh install_pandoc.sh
23+
24+ RUN ./install_texlive.sh
25+ RUN ./install_pandoc.sh
26+
927####################
1028# cpu-base #
1129####################
@@ -16,51 +34,35 @@ WORKDIR /opt/app-root/bin
1634# OS Packages needs to be installed as root
1735USER 0
1836
19- ### BEGIN upgrade first to avoid fixable vulnerabilities
20- # If we have a Red Hat subscription prepared, refresh it
21- RUN /bin/bash <<'EOF'
22- set -Eeuxo pipefail
23- if command -v subscription-manager &> /dev/null; then
24- subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
25- fi
26- EOF
37+ # Inject the official UBI 9 repository configuration into the AIPCC base image.
38+ # The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
39+ # By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
40+ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
2741
42+ # upgrade first to avoid fixable vulnerabilities begin
2843# Problem: The operation would result in removing the following protected packages: systemd
2944# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
3045# Solution: --best --skip-broken does not work either, so use --nobest
31- RUN /bin/bash <<'EOF'
32- set -Eeuxo pipefail
33- dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
34- dnf clean all -y
35- EOF
36-
37- ### END upgrade first to avoid fixable vulnerabilities
46+ RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
47+ && dnf clean all -y
48+ # upgrade first to avoid fixable vulnerabilities end
3849
3950# Install useful OS packages
40- RUN /bin/bash <<'EOF'
41- set -Eeuxo pipefail
42- dnf install -y perl mesa-libGL skopeo
43- dnf clean all
44- rm -rf /var/cache/yum
45- EOF
51+ RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
4652
4753# Other apps and tools installed as default user
4854USER 1001
4955
50- ### BEGIN Install micropipenv and uv to deploy packages from requirements.txt
51- RUN pip install --no-cache-dir --extra-index-url https://pypi.org/simple - U "micropipenv[toml]==1.9.0" "uv==0.8.12"
52- ### END Install micropipenv and uv to deploy packages from requirements.txt
56+ # Install micropipenv and uv to deploy packages from requirements.txt begin
57+ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
58+ # Install micropipenv and uv to deploy packages from requirements.txt end
5359
54- ### BEGIN Install the oc client
55- RUN /bin/bash <<'EOF'
56- set -Eeuxo pipefail
57- curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
58- -o /tmp/openshift-client-linux.tar.gz
59- tar -xzvf /tmp/openshift-client-linux.tar.gz oc
60- rm -f /tmp/openshift-client-linux.tar.gz
61- EOF
62-
63- ### END Install the oc client
60+ # Install the oc client begin
61+ RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
62+ -o /tmp/openshift-client-linux.tar.gz && \
63+ tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
64+ rm -f /tmp/openshift-client-linux.tar.gz
65+ # Install the oc client end
6466
6567####################
6668# jupyter-minimal #
@@ -86,35 +88,36 @@ COPY ${JUPYTER_REUSABLE_UTILS} utils/
8688
8789USER 0
8890
89- ### BEGIN Dependencies for PDF export
90- RUN ./utils/install_pdf_deps.sh
91- ENV PATH="/usr/local/texlive/bin/linux:/usr/local/pandoc/bin:$PATH"
92-
93- ### END Dependencies for PDF export
91+ # Dependencies for PDF export begin
92+ RUN --mount=type=cache,from=pdf-builder,source=/usr/local/,target=/pdf_builder/,rw \
93+ bash -c ' \
94+ if [[ "$(uname -m)" == "ppc64le" ]]; then \
95+ cp -r /pdf_builder/texlive /usr/local/; \
96+ cp -r /pdf_builder/pandoc /usr/local/; \
97+ else \
98+ ./utils/install_pdf_deps.sh; \
99+ fi'
94100
95101USER 1001
96102
97103COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./
98104
99105# Install Python dependencies from requirements.txt file
100- RUN /bin/bash <<'EOF'
101- set -Eeuxo pipefail
102- echo "Installing softwares and packages"
103- # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
104- # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
105- uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
106- # Disable announcement plugin of jupyterlab
107- jupyter labextension disable "@jupyterlab/apputils-extension:announcements"
108- # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y
109- sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json
110- # copy jupyter configuration
111- cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter
112- # Fix permissions to support pip in Openshift environments
113- chmod -R g+w /opt/app-root/lib/python3.12/site-packages
114- fix-permissions /opt/app-root -P
115- # Apply JupyterLab addons
116- /opt/app-root/bin/utils/addons/apply.sh
117- EOF
106+ RUN echo "Installing softwares and packages" && \
107+ # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
108+ # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
109+ uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \
110+ # Disable announcement plugin of jupyterlab \
111+ jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \
112+ # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \
113+ sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \
114+ # copy jupyter configuration
115+ cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \
116+ # Fix permissions to support pip in Openshift environments \
117+ chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \
118+ fix-permissions /opt/app-root -P && \
119+ # Apply JupyterLab addons \
120+ /opt/app-root/bin/utils/addons/apply.sh
118121
119122WORKDIR /opt/app-root/src
120123
0 commit comments