Skip to content

Commit a16411c

Browse files
tirantiran
committed
Improve RHEL container files
- Update to Python 3.10.14, which is currently the latest security release of Python 3.10 series. - Use crypto policy `DEFAULT:SHA1` instead of `LEGACY` to work around Habana GPG key with SHA-1 signature. It's less insecure than `LEGACY`. - Enable GPG checks for CentOS repositories. - Only install 64bit Intel oneMKL packages. The 32bit packages are not needed. - Use `$(DOCKER)` variable in Makefile for PyTorch container, so `make DOCKER=podman` works correctly. - Explicitly set `PYTHON_VERSION`, so the package installer uses a fully qualified Python binary (e.g. `python3.10`) for installation. - Use a `.pth` file instead of `PYTHONPATH` env var Signed-off-by: Christian Heimes <[email protected]>
1 parent fe01c25 commit a16411c

File tree

7 files changed

+26
-17
lines changed

7 files changed

+26
-17
lines changed

‎dockerfiles/base/Dockerfile.rhel8.6‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,15 @@ RUN dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.n
1919
RUN echo "[appstream]" > /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
2020
echo "name=CentOS Linux 8 - AppStream" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
2121
echo "baseurl=https://vault.centos.org/8-stream/AppStream/x86_64/os" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
22-
echo "gpgcheck=0" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo
22+
echo "gpgkey=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official-SHA256" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
23+
echo "gpgcheck=1" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo
2324

2425

2526
RUN echo "[BaseOS]" > /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
2627
echo "name=CentOS Linux 8 - BaseOS" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
2728
echo "baseurl=https://vault.centos.org/8-stream/BaseOS/x86_64/os" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
28-
echo "gpgcheck=0" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo
29+
echo "gpgkey=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official-SHA256" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
30+
echo "gpgcheck=1" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo
2931

3032
RUN dnf install -y \
3133
clang \
@@ -78,7 +80,8 @@ RUN echo "[habanalabs]" > /etc/yum.repos.d/habanalabs.repo && \
7880
RUN echo "[powertools]" > /etc/yum.repos.d/powertools.repo && \
7981
echo "name=powertools" >> /etc/yum.repos.d/powertools.repo && \
8082
echo "baseurl=https://vault.centos.org/8-stream/PowerTools/x86_64/os/" >> /etc/yum.repos.d/powertools.repo && \
81-
echo "gpgcheck=0" >> /etc/yum.repos.d/powertools.repo
83+
echo "gpgkey=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official-SHA256" >> /etc/yum.repos.d/powertools.repo && \
84+
echo "gpgcheck=1" >> /etc/yum.repos.d/powertools.repo
8285

8386
RUN dnf install -y habanalabs-rdma-core-"$VERSION"-"$REVISION".el8 \
8487
habanalabs-thunk-"$VERSION"-"$REVISION".el8 \
@@ -108,6 +111,7 @@ RUN wget -nv -O /tmp/main.zip https://github.com/HabanaAI/hccl_ofi_wrapper/archi
108111
cd / && \
109112
rm -rf /tmp/main.zip /tmp/hccl_ofi_wrapper-main
110113

114+
ENV PYTHON_VERSION=3.8
111115
RUN python3.8 -m pip install pip==23.3.1 setuptools==67.3.3 wheel==0.38.4
112116

113117
RUN alternatives --install /usr/bin/python3 python3 /usr/bin/python3.8 2 && \

‎dockerfiles/base/Dockerfile.rhel9.2‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,14 @@ RUN dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.n
1919
RUN echo "[BaseOS]" > /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
2020
echo "name=CentOS Linux 9 - BaseOS" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
2121
echo "baseurl=https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
22-
echo "gpgcheck=0" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo
22+
echo "gpgkey=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official-SHA256" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo && \
23+
echo "gpgcheck=1" >> /etc/yum.repos.d/CentOS-Linux-BaseOS.repo
2324

2425
RUN echo "[centos9]" > /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
2526
echo "name=CentOS Linux 9 - AppStream" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
2627
echo "baseurl=https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
27-
echo "gpgcheck=0" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo
28+
echo "gpgkey=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official-SHA256" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo && \
29+
echo "gpgcheck=1" >> /etc/yum.repos.d/CentOS-Linux-AppStream.repo
2830

2931
RUN dnf install -y \
3032
clang \
@@ -61,6 +63,7 @@ RUN dnf install -y \
6163
dnf update -y && \
6264
dnf clean all && rm -rf /var/cache/yum
6365

66+
ENV PYTHON_VERSION=3.10
6467
COPY install-python310.sh .
6568
RUN ./install-python310.sh rhel9.2 && rm install-python310.sh
6669
ENV LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH
@@ -84,7 +87,8 @@ RUN echo "[habanalabs]" > /etc/yum.repos.d/habanalabs.repo && \
8487
echo "gpgkey=https://${ARTIFACTORY_URL}/artifactory/rhel/9/9.2/repodata/repomd.xml.key" >> /etc/yum.repos.d/habanalabs.repo && \
8588
echo 'gpgcheck=1' >> /etc/yum.repos.d/habanalabs.repo
8689

87-
RUN update-crypto-policies --set LEGACY
90+
# for Habana GPG key with SHA-1 signature
91+
RUN update-crypto-policies --set DEFAULT:SHA1
8892

8993
RUN dnf install -y habanalabs-rdma-core-"$VERSION"-"$REVISION".el9 \
9094
habanalabs-thunk-"$VERSION"-"$REVISION".el9 \

‎dockerfiles/base/install-python310.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,11 @@ case "${_BASE_NAME}" in
3535
esac
3636

3737
# install Python
38-
wget -nv -O /opt/Python-3.10.9.tgz https://www.python.org/ftp/python/3.10.9/Python-3.10.9.tgz
38+
wget -nv -O /opt/Python-3.10.14.tgz https://www.python.org/ftp/python/3.10.14/Python-3.10.14.tgz
3939
cd /opt/
40-
tar xzf Python-3.10.9.tgz
41-
rm -f Python-3.10.9.tgz
42-
cd Python-3.10.9
40+
tar xzf Python-3.10.14.tgz
41+
rm -f Python-3.10.14.tgz
42+
cd Python-3.10.14
4343
./configure --enable-optimizations --enable-loadable-sqlite-extensions --enable-shared $_SSL_LIB
4444
make -j && make altinstall
4545

‎dockerfiles/pytorch/Dockerfile.rhel8.6‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ LABEL name="PyTorch Installer"
1717
LABEL summary="Habanalabs PyTorch installer layer for RHEL8.6"
1818
LABEL description="Image with pre installed Habanalabs packages for PyTorch"
1919

20-
ENV PYTHONPATH=/root:/usr/lib/habanalabs/
20+
RUN echo "/usr/lib/habanalabs" > $(python3.8 -c "import sysconfig; print(sysconfig.get_path('platlib'))")/habanalabs-graph.pth
2121

2222
RUN dnf install -y \
2323
curl \
@@ -34,7 +34,7 @@ RUN dnf install -y \
3434
dnf clean all && rm -rf /var/cache/yum
3535

3636
RUN dnf config-manager --add-repo https://yum.repos.intel.com/mkl/setup/intel-mkl.repo -y && \
37-
dnf install --allowerasing -y intel-mkl-2020.4-912 && \
37+
dnf install --allowerasing -y intel-mkl-64bit-2020.4-912 && \
3838
dnf clean all && rm -rf /var/cache/yum
3939

4040
COPY install_packages.sh .

‎dockerfiles/pytorch/Dockerfile.rhel9.2‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,13 @@ LABEL name="PyTorch Installer"
1717
LABEL summary="Habanalabs PyTorch installer layer for RHEL9.2"
1818
LABEL description="Image with pre installed Habanalabs packages for PyTorch"
1919

20-
ENV PYTHONPATH=/root:/usr/lib/habanalabs/
20+
RUN echo "/usr/lib/habanalabs" > $(python3.10 -c "import sysconfig; print(sysconfig.get_path('platlib'))")/habanalabs-graph.pth
2121

2222
RUN echo "[CRB]" > /etc/yum.repos.d/CentOS-Linux-CRB.repo && \
2323
echo "name=CentOS Linux 9 - CRB" >> /etc/yum.repos.d/CentOS-Linux-CRB.repo && \
2424
echo "baseurl=https://mirror.stream.centos.org/9-stream/CRB/x86_64/os" >> /etc/yum.repos.d/CentOS-Linux-CRB.repo && \
25-
echo "gpgcheck=0" >> /etc/yum.repos.d/CentOS-Linux-CRB.repo
25+
echo "gpgkey=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official-SHA256" >> /etc/yum.repos.d/CentOS-Linux-CRB.repo && \
26+
echo "gpgcheck=1" >> /etc/yum.repos.d/CentOS-Linux-CRB.repo
2627

2728
RUN dnf install --allowerasing -y \
2829
curl \
@@ -38,7 +39,7 @@ RUN dnf install --allowerasing -y \
3839
dnf clean all && rm -rf /var/cache/yum
3940

4041
RUN dnf config-manager --add-repo https://yum.repos.intel.com/mkl/setup/intel-mkl.repo -y && \
41-
dnf install --allowerasing -y intel-mkl-2020.4-912 && \
42+
dnf install --allowerasing -y intel-mkl-64bit-2020.4-912 && \
4243
dnf clean all && rm -rf /var/cache/yum
4344

4445
COPY install_packages.sh .

‎dockerfiles/pytorch/Dockerfile.tencentos3.1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ RUN dnf install -y \
3434
dnf clean all && rm -rf /var/cache/yum
3535

3636
RUN dnf config-manager --add-repo https://yum.repos.intel.com/mkl/setup/intel-mkl.repo -y && \
37-
dnf install --allowerasing -y intel-mkl-2020.4-912 && \
37+
dnf install --allowerasing -y intel-mkl-64bit-2020.4-912 && \
3838
dnf clean all && rm -rf /var/cache/yum
3939

4040
COPY install_packages.sh .

‎dockerfiles/pytorch/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ IMAGE_NAME = pytorch-installer-${BUILD_OS}-$(PT_VERSION)
55
DOCKER_BUILD_ARGS := $(DOCKER_BUILD_ARGS) --build-arg PT_VERSION=$(PT_VERSION)
66

77
base:
8-
ifneq ($(shell docker image inspect $(BASE_IMAGE_URL):$(RELEASE_VERSION)-$(RELEASE_BUILD_ID) --format="image_exists" 2>/dev/null), image_exists)
8+
ifneq ($(shell $(DOCKER) image inspect $(BASE_IMAGE_URL):$(RELEASE_VERSION)-$(RELEASE_BUILD_ID) --format="image_exists" 2>/dev/null), image_exists)
99
cd ../base; \
1010
make build; \
1111
cd ../pytorch

0 commit comments

Comments
 (0)