Dockerfile.dagster-ml

Rama master · réplica de lectura del repositorio original.

#
# Dagster ML image: the main PostHog image plus the `inbox-ranking` dependency group (CPU-only
# torch, onnx, onnxruntime). The inbox ranking training code location runs it, so it must carry
# the same application code as the main locations. CI builds it FROM the main image digest of the
# same commit, see the dagster_ml_build jobs in .github/workflows/container-images-cd.yml and
# .github/workflows/container-images-ci.yml.
#
# Build with: docker build -f Dockerfile.dagster-ml --build-arg BASE_IMAGE=<registry>/posthog-cloud@<digest> .
#
# No default: a floating base tag would let the image drift from the main image of its commit.
ARG BASE_IMAGE

# Keep the uv version equal to the one in Dockerfile.
FROM ghcr.io/astral-sh/uv:0.13.4 AS uv

FROM ${BASE_IMAGE}
SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]

# Install as the user that owns /python-runtime, so the new files keep the same owner.
USER posthog
ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PROJECT_ENVIRONMENT=/python-runtime \
    UV_CACHE_DIR=/tmp/uv-cache

# --inexact keeps every package the main image already has. The other flags and the /code project
# path match the uv sync in Dockerfile, so uv sees the installed packages as up to date and only
# adds the group.
WORKDIR /code
RUN --mount=from=uv,source=/uv,target=/bin/uv \
    --mount=type=cache,id=uv-dagster-ml,target=/tmp/uv-cache,uid=10001,gid=10001 \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    --mount=type=bind,source=tools/hogli,target=tools/hogli \
    --mount=type=bind,source=packages/owners-yaml,target=packages/owners-yaml \
    --mount=type=bind,source=packages/personhog-proto,target=packages/personhog-proto \
    uv sync --locked --inexact --no-dev --no-editable --no-install-project \
        --no-binary-package lxml --no-binary-package xmlsec --group inbox-ranking

# Fail the build if torch is not the CPU-only build, or if any CUDA library got in.
RUN python - <<'PY'
import importlib.metadata
import pathlib

import onnx  # noqa: F401
import onnxruntime
import torch

assert torch.version.cuda is None, f"torch is a CUDA build: {torch.version.cuda}"
assert not torch.cuda.is_available()
cuda_dists = sorted(
    name for d in importlib.metadata.distributions() if (name := d.metadata["Name"]).lower().startswith("nvidia-")
)
assert not cuda_dists, f"CUDA packages installed: {cuda_dists}"
cuda_libs = sorted(
    str(p)
    for p in pathlib.Path("/python-runtime").rglob("lib*.so*")
    if p.name.startswith(("libcuda", "libcudart", "libcudnn", "libcublas", "libnccl"))
)
assert not cuda_libs, f"CUDA libraries present: {cuda_libs}"
print("torch", torch.__version__, "onnxruntime", onnxruntime.__version__)
PY

# Root is needed only so bin/docker-server can drop the app to nobody with setpriv, as in Dockerfile.
# nosemgrep: dockerfile.security.last-user-is-root.last-user-is-root
USER root