@@ -6,6 +6,26 @@ ARG BASE_IMAGE
66# External image alias for UBI repository configuration
77FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
88
9+ ############################
10+ # Stage 1: PDF Tool Build #
11+ ############################
12+ FROM registry.access.redhat.com/ubi9/python-312:latest AS pdf-builder
13+
14+ WORKDIR /opt/app-root/bin
15+
16+ # OS Packages needs to be installed as root
17+ USER 0
18+
19+ # Copy scripts
20+ COPY jupyter/utils/install_texlive.sh ./install_texlive.sh
21+ COPY jupyter/utils/install_pandoc.sh ./install_pandoc.sh
22+ RUN chmod +x install_texlive.sh install_pandoc.sh
23+
24+ RUN ./install_texlive.sh
25+ RUN ./install_pandoc.sh
26+
27+ USER 1001
28+
929####################
1030# cpu-base #
1131####################
@@ -16,51 +36,35 @@ WORKDIR /opt/app-root/bin
1636# OS Packages needs to be installed as root
1737USER 0
1838
19- ### BEGIN upgrade first to avoid fixable vulnerabilities
20- # If we have a Red Hat subscription prepared, refresh it
21- RUN /bin/bash <<'EOF'
22- set -Eeuxo pipefail
23- if command -v subscription-manager &> /dev/null; then
24- subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
25- fi
26- EOF
39+ # Inject the official UBI 9 repository configuration into the AIPCC base image.
40+ # The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
41+ # By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
42+ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
2743
44+ # upgrade first to avoid fixable vulnerabilities begin
2845# Problem: The operation would result in removing the following protected packages: systemd
2946# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
3047# Solution: --best --skip-broken does not work either, so use --nobest
31- RUN /bin/bash <<'EOF'
32- set -Eeuxo pipefail
33- dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
34- dnf clean all -y
35- EOF
36-
37- ### END upgrade first to avoid fixable vulnerabilities
48+ RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
49+ && dnf clean all -y
50+ # upgrade first to avoid fixable vulnerabilities end
3851
3952# Install useful OS packages
40- RUN /bin/bash <<'EOF'
41- set -Eeuxo pipefail
42- dnf install -y perl mesa-libGL skopeo
43- dnf clean all
44- rm -rf /var/cache/yum
45- EOF
53+ RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
4654
4755# Other apps and tools installed as default user
4856USER 1001
4957
50- ### BEGIN Install micropipenv and uv to deploy packages from requirements.txt
51- RUN pip install --no-cache-dir --extra-index-url https://pypi.org/simple -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
52- ### END Install micropipenv and uv to deploy packages from requirements.txt
53-
54- ### BEGIN Install the oc client
55- RUN /bin/bash <<'EOF'
56- set -Eeuxo pipefail
57- curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
58- -o /tmp/openshift-client-linux.tar.gz
59- tar -xzvf /tmp/openshift-client-linux.tar.gz oc
60- rm -f /tmp/openshift-client-linux.tar.gz
61- EOF
58+ # Install micropipenv and uv to deploy packages from requirements.txt begin
59+ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
60+ # Install micropipenv and uv to deploy packages from requirements.txt end
6261
63- ### END Install the oc client
62+ # Install the oc client begin
63+ RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
64+ -o /tmp/openshift-client-linux.tar.gz && \
65+ tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
66+ rm -f /tmp/openshift-client-linux.tar.gz
67+ # Install the oc client end
6468
6569####################
6670# jupyter-minimal #
@@ -86,35 +90,36 @@ COPY ${JUPYTER_REUSABLE_UTILS} utils/
8690
8791USER 0
8892
89- ### BEGIN Dependencies for PDF export
90- RUN ./utils/install_pdf_deps.sh
91- ENV PATH="/usr/local/texlive/bin/linux:/usr/local/pandoc/bin:$PATH"
92-
93- ### END Dependencies for PDF export
93+ # Dependencies for PDF export begin
94+ RUN --mount=type=cache,from=pdf-builder,source=/usr/local/,target=/pdf_builder/,rw \
95+ bash -c ' \
96+ if [[ "$(uname -m)" == "ppc64le" ]]; then \
97+ cp -r /pdf_builder/texlive /usr/local/; \
98+ cp -r /pdf_builder/pandoc /usr/local/; \
99+ else \
100+ ./utils/install_pdf_deps.sh; \
101+ fi'
94102
95103USER 1001
96104
97105COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./
98106
99107# Install Python dependencies from requirements.txt file
100- RUN /bin/bash <<'EOF'
101- set -Eeuxo pipefail
102- echo "Installing softwares and packages"
103- # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
104- # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
105- uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
106- # Disable announcement plugin of jupyterlab
107- jupyter labextension disable "@jupyterlab/apputils-extension:announcements"
108- # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y
109- sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json
110- # copy jupyter configuration
111- cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter
112- # Fix permissions to support pip in Openshift environments
113- chmod -R g+w /opt/app-root/lib/python3.12/site-packages
114- fix-permissions /opt/app-root -P
115- # Apply JupyterLab addons
116- /opt/app-root/bin/utils/addons/apply.sh
117- EOF
108+ RUN echo "Installing softwares and packages" && \
109+ # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
110+ # we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
111+ uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \
112+ # Disable announcement plugin of jupyterlab \
113+ jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \
114+ # Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \
115+ sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \
116+ # copy jupyter configuration
117+ cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \
118+ # Fix permissions to support pip in Openshift environments \
119+ chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \
120+ fix-permissions /opt/app-root -P && \
121+ # Apply JupyterLab addons \
122+ /opt/app-root/bin/utils/addons/apply.sh
118123
119124WORKDIR /opt/app-root/src
120125
0 commit comments