Refactor Containerfile to multi-stage build#191
Open
are-ces wants to merge 12 commits into
Open
Conversation
RHOAI only has up to 46.0.5. Pin override to 46.0.7 so uv resolves from PyPI (sdist). Cryptography builds with Cargo which is already in the build image RPMs. Fixes all three open cryptography CVEs: - CVE-2026-26007 (High): Subgroup attack on SECT curves (fixed 46.0.5) - CVE-2026-34073 (Low): Incomplete DNS name constraint (fixed 46.0.6) - CVE-2026-39892 (Medium): Buffer overflow via non-contiguous buffer (fixed 46.0.7) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
RHOAI rebuilds cffi with different hashes than PyPI. Strip cffi from the universal wheel file and pin per-arch pulp URLs, same pattern as aiohttp and markupsafe. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Install cargo and rust RPMs for building cryptography from source. Remove them after pip install to keep the final image clean. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Split into builder (build tools, sdist compilation) and runtime (clean image, no gcc/cargo/rust/dev libs). Builder stage is discarded so build tools never appear in the final image. This enables building packages from sdist (e.g. cryptography, pillow) without bloating the runtime image. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughSplit base-image build args and convert Containerfile(s) to multi-stage builder/runtime; add cffi/pycparser to build sets, refresh many dependency pins and hashes (cryptography, lxml, click, numpy, etc.), add per-architecture cffi wheel pins, update scripts to generate arch-specific wheel entries, and update RPM and Tekton prefetch lists. ChangesBuild Infrastructure and Dependency Management
🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly Related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/konflux_requirements_cuda.sh`:
- Around line 392-408: The current block in scripts that matches cffi writes
both x86_64 and aarch64 wheels back into the shared WHEEL_HASH_FILE, causing pip
to try installing both arches; change it to remove cffi from the shared
"$WHEEL_HASH_FILE" and instead write arch-specific wheel files (e.g. a CUDA
x86_64 wheel file and a CUDA aarch64 wheel file) similar to the CPU script.
Modify the awk/shell logic that uses CFFI_CUDA_PULP_BASE, CFFI_CUDA_X86_WHEEL,
CFFI_CUDA_X86_SHA256, CFFI_CUDA_AARCH_WHEEL and CFFI_CUDA_AARCH_SHA256 so that
when matching /^cffi==|^cffi `@/` it prints nothing for the main WHEEL_HASH_FILE
(effectively stripping cffi) and writes the two arch-specific entries to
separate files (names analogous to requirements.hashes.wheel.cpu.x86_64.txt and
requirements.hashes.wheel.cpu.aarch64.txt), then mv the temp main file back into
"$WHEEL_HASH_FILE" and create/mv the temp arch files into their final
CUDA-specific filenames so Containerfile-cuda can include them by TARGETARCH.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ea3b23b9-4266-4943-996c-23ebe5b4ec51
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (17)
.konflux/build-args-konflux.conf.konflux/requirements-build.cuda.txt.konflux/requirements-build.txt.konflux/requirements.hashes.source.cuda.txt.konflux/requirements.hashes.source.txt.konflux/requirements.hashes.wheel.cpu.aarch64.txt.konflux/requirements.hashes.wheel.cpu.x86_64.txt.konflux/requirements.hashes.wheel.cuda.txt.konflux/requirements.hashes.wheel.pypi.cuda.base.txt.konflux/requirements.hashes.wheel.txt.konflux/requirements.overrides.cuda.txt.konflux/requirements.overrides.txt.tekton/rag-tool-pull-request.yaml.tekton/rag-tool-push.yamlContainerfilescripts/konflux_requirements.shscripts/konflux_requirements_cuda.sh
💤 Files with no reviewable changes (1)
- .konflux/requirements.hashes.wheel.txt
GH Actions builds use ubi-minimal without entitlement certs — packages like swig are not available. Keep build tools behind the cachi2 check as before; the multi-stage separation still ensures they don't appear in the final image. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Cryptography's Rust code links against OpenSSL and needs the dev headers + pkg-config file to compile from source. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
cffi has arch-specific RHOAI wheels. Putting both in the universal wheel file causes pip to fail with "not a supported wheel on this platform". Strip from universal file and add to per-arch files. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Image size drops from 4.6GB to 2.7GB with this approach, alternative approach to #190 |
Same pattern as CPU: builder stage has build tools (gcc, cargo, rust, dev libs), runtime stage has only Python, CUDA libs, and runtime shared libraries. Build tools never appear in the final image. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Containerfile-cuda`:
- Line 3: The RUNTIME_BASE_IMAGE ARG currently defaults to a “-devel” variant
which keeps build tools in the final stage; change the default value of ARG
RUNTIME_BASE_IMAGE from nvcr.io/nvidia/cuda:12.9.1-devel-ubi9 to a non-devel
runtime (for example nvcr.io/nvidia/cuda:12.9.1-base-ubi9 or
nvcr.io/nvidia/cuda:12.9.1-runtime-ubi9) and ensure the final runtime stage uses
RUNTIME_BASE_IMAGE so the final image only includes CUDA runtime libraries, not
development toolchains.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b6cc29ec-7f6d-40d1-943b-7be2124bae45
📒 Files selected for processing (2)
.konflux/build-args-konflux-cuda.confContainerfile-cuda
| ARG BASE_IMAGE=nvcr.io/nvidia/cuda:12.9.1-devel-ubi9 | ||
| FROM ${BASE_IMAGE} | ||
| ARG BUILDER_BASE_IMAGE=nvcr.io/nvidia/cuda:12.9.1-devel-ubi9 | ||
| ARG RUNTIME_BASE_IMAGE=nvcr.io/nvidia/cuda:12.9.1-devel-ubi9 |
There was a problem hiding this comment.
Runtime base image should not default to a -devel variant.
The RUNTIME_BASE_IMAGE defaults to nvcr.io/nvidia/cuda:12.9.1-devel-ubi9, which is a development image containing build tools, compilers, and development headers. This defeats the primary goal of the multi-stage build: removing build tools from the final runtime image to reduce size.
The runtime stage should default to a non-devel image (e.g., nvcr.io/nvidia/cuda:12.9.1-base-ubi9 or nvcr.io/nvidia/cuda:12.9.1-runtime-ubi9) that contains only the CUDA runtime libraries needed to execute applications, not build them.
🔧 Suggested fix
ARG BUILDER_BASE_IMAGE=nvcr.io/nvidia/cuda:12.9.1-devel-ubi9
-ARG RUNTIME_BASE_IMAGE=nvcr.io/nvidia/cuda:12.9.1-devel-ubi9
+ARG RUNTIME_BASE_IMAGE=nvcr.io/nvidia/cuda:12.9.1-runtime-ubi9🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Containerfile-cuda` at line 3, The RUNTIME_BASE_IMAGE ARG currently defaults
to a “-devel” variant which keeps build tools in the final stage; change the
default value of ARG RUNTIME_BASE_IMAGE from
nvcr.io/nvidia/cuda:12.9.1-devel-ubi9 to a non-devel runtime (for example
nvcr.io/nvidia/cuda:12.9.1-base-ubi9 or nvcr.io/nvidia/cuda:12.9.1-runtime-ubi9)
and ensure the final runtime stage uses RUNTIME_BASE_IMAGE so the final image
only includes CUDA runtime libraries, not development toolchains.
Add libxml2-devel, libxslt-devel, libjpeg-turbo-devel, libtiff-devel, freetype-devel, libwebp-devel, openssl-devel and their transitive deps for building pillow and cryptography from sdist in CUDA hermetic builds. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Generated against registry.redhat.io/rhai/base-image-cuda-12.9-rhel9:3.3 with all dev libs for sdist builds. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Refactor both CPU and CUDA Containerfiles from single-stage to multi-stage builds to eliminate image bloat from build tools.
Stage 1 (builder): Installs all build tools (gcc, cmake, cargo, rust, dev libs, openssl-devel) and compiles Python dependencies from sdist. This stage is discarded after the venv is built.
Stage 2 (runtime): Clean image with only runtime packages (python3.12, git, ruby, skopeo, runtime shared libs). Copies
.venvfrom the builder viaCOPY --from=builder. No build tools in the final image.Image size reduction
CPU:
CUDA:
Changes
Containerfile: Split intobuilder+ runtime stagesContainerfile-cuda: Split intobuilder+ runtime stages.konflux/build-args-konflux.conf:BASE_IMAGE→BUILDER_BASE_IMAGE+RUNTIME_BASE_IMAGE.konflux/build-args-konflux-cuda.conf:BASE_IMAGE→BUILDER_BASE_IMAGE+RUNTIME_BASE_IMAGE.konflux/rpms.in.yaml: Addedopenssl-develfor cryptography sdist build.konflux/rpms.lock.yaml: Regenerated with openssl-develKey details
WORKDIR /rag-content(venv shebangs are absolute paths)UV_LINK_MODE=copyensures venv is self-contained (no broken symlinks)if [ -f /cachi2/cachi2.env ]) so GH Actions still works/cachi2/available in all stages via buildah--volumemountType of change
Tools used to create PR
Checklist before requesting a review
Testing
Summary by CodeRabbit
Chores
New Features