Skip to content

RHAIENG-1504: incorporate changes to .konflux dockerfiles #1640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 17, 2025
Merged

RHAIENG-1504: incorporate changes to .konflux dockerfiles #1640

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
254c794
incorporate changes to .konflux dockerfiles
atheo89 Oct 17, 2025
b06a26e
re-incorporate changes to minimal notebook from 21e94bd commit
atheo89 Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 40 additions & 25 deletions jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

######################################################
# mongocli-builder (build stage only, not published) #
######################################################
Expand All @@ -20,7 +23,7 @@ RUN arch="${TARGETARCH:-$(uname -m)}" && \
arch=$(echo "$arch" | cut -d- -f1) && \
if [ "$arch" = "s390x" ]; then \
echo "Skipping mongocli build for ${arch}, creating dummy binary"; \
mkdir -p /tmp && echo -e '#!/bin/sh\necho "mongocli not supported on s390x"' > /tmp/mongocli && \
mkdir -p /tmp && printf '#!/bin/sh\necho "mongocli not supported on s390x"\n' > /tmp/mongocli && \
chmod +x /tmp/mongocli; \
else \
echo "Building mongocli for ${arch}"; \
Expand All @@ -44,7 +47,7 @@ ARG TARGETARCH
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand All @@ -66,27 +69,35 @@ RUN --mount=type=cache,target=/var/cache/dnf \
dnf install -y $PACKAGES && \
dnf clean all && rm -rf /var/cache/yum

RUN if [ "$TARGETARCH" = "s390x" ]; then \
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
if [ "$TARGETARCH" = "s390x" ]; then
# Install Rust and set up environment
mkdir -p /opt/.cargo && \
export HOME=/root && \
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o rustup-init.sh && \
chmod +x rustup-init.sh && \
CARGO_HOME=/opt/.cargo HOME=/root ./rustup-init.sh -y --no-modify-path && \
rm -f rustup-init.sh && \
chown -R 1001:0 /opt/.cargo && \
mkdir -p /opt/.cargo
export HOME=/root
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o rustup-init.sh
chmod +x rustup-init.sh
CARGO_HOME=/opt/.cargo HOME=/root ./rustup-init.sh -y --no-modify-path
rm -f rustup-init.sh
chown -R 1001:0 /opt/.cargo
# Set environment variables
echo 'export PATH=/opt/.cargo/bin:$PATH' >> /etc/profile.d/cargo.sh && \
echo 'export CARGO_HOME=/opt/.cargo' >> /etc/profile.d/cargo.sh && \
echo 'export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1' >> /etc/profile.d/cargo.sh; \
cat > /etc/profile.d/cargo.sh <<'CARGO_EOF'
export PATH=/opt/.cargo/bin:$PATH
export CARGO_HOME=/opt/.cargo
export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1
CARGO_EOF
fi
EOF

# Set python alternatives only for s390x (not needed for other arches)
RUN if [ "$TARGETARCH" = "s390x" ]; then \
alternatives --install /usr/bin/python python /usr/bin/python3.12 1 && \
alternatives --install /usr/bin/python3 python3 /usr/bin/python3.12 1 && \
python --version && python3 --version; \
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
if [ "$TARGETARCH" = "s390x" ]; then
alternatives --install /usr/bin/python python /usr/bin/python3.12 1
alternatives --install /usr/bin/python3 python3 /usr/bin/python3.12 1
python --version && python3 --version
fi
EOF

# Other apps and tools installed as default user
USER 1001
Expand All @@ -109,6 +120,7 @@ RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/oc
FROM cpu-base AS pyarrow-builder

ARG TARGETARCH
# hadolint ignore=DL3002
USER 0
WORKDIR /tmp/build-wheels

Expand Down Expand Up @@ -167,8 +179,9 @@ RUN --mount=type=cache,target=/root/.cache/pip \
#######################################################
FROM cpu-base AS common-builder
ARG TARGETARCH
# hadolint ignore=DL3002
USER root
RUN <<'EOF'
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
if [ "${TARGETARCH}" = "ppc64le" ]; then
dnf install -y gcc-toolset-13 cmake ninja-build git wget unzip
Expand All @@ -193,8 +206,9 @@ if [ "${TARGETARCH}" = "ppc64le" ]; then
cd onnx
git checkout ${ONNX_VERSION}
git submodule update --init --recursive
pip install -r requirements.txt
export CMAKE_ARGS="-DPython3_EXECUTABLE=$(which python3.12)"
pip install --no-cache-dir -r requirements.txt
CMAKE_ARGS="-DPython3_EXECUTABLE=$(which python3.12)"
export CMAKE_ARGS
pip wheel . -w /root/onnx_wheel
else
echo "Skipping ONNX build on non-Power"
Expand All @@ -212,7 +226,7 @@ WORKDIR /root
RUN <<'EOF'
set -Eeuxo pipefail
if [ "${TARGETARCH}" = "ppc64le" ]; then
wget https://github.com/OpenMathLib/OpenBLAS/releases/download/v${OPENBLAS_VERSION}/OpenBLAS-${OPENBLAS_VERSION}.zip
wget --progress=dot:giga https://github.com/OpenMathLib/OpenBLAS/releases/download/v${OPENBLAS_VERSION}/OpenBLAS-${OPENBLAS_VERSION}.zip
unzip OpenBLAS-${OPENBLAS_VERSION}.zip
cd OpenBLAS-${OPENBLAS_VERSION}
make -j$(nproc) TARGET=POWER9 BINARY=64 USE_OPENMP=1 USE_THREAD=1 NUM_THREADS=120 DYNAMIC_ARCH=1 INTERFACE64=0
Expand All @@ -221,6 +235,7 @@ else
echo "Skipping OpenBLAS build on non-Power"
fi
EOF

####################
# jupyter-minimal #
####################
Expand Down Expand Up @@ -296,17 +311,17 @@ COPY --from=openblas-builder /root/OpenBLAS-${OPENBLAS_VERSION} /openblas
COPY --from=onnx-builder /root/onnx_wheel/ /onnxwheels/

# Power-specific ONNX/OpenBLAS installation
RUN <<'EOF'
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
if [ "${TARGETARCH}" = "ppc64le" ]; then
pip install /onnxwheels/*.whl
pip install --no-cache-dir /onnxwheels/*.whl
else
echo "Skipping ONNX/OpenBLAS install on non-Power"
fi
EOF

USER root
RUN <<'EOF'
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
if [ "${TARGETARCH}" = "ppc64le" ]; then
rm -rf /onnxwheels
Expand All @@ -315,7 +330,7 @@ else
fi
EOF

RUN <<'EOF'
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
if [ "${TARGETARCH}" = "ppc64le" ]; then
PREFIX=/usr/local make -C /openblas install
Expand Down
29 changes: 26 additions & 3 deletions jupyter/minimal/ubi9-python-3.12/Dockerfile.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,24 @@ ARG BASE_IMAGE
# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

############################
# Stage 1: PDF Tool Build #
############################
FROM registry.access.redhat.com/ubi9/python-312:latest AS pdf-builder

WORKDIR /opt/app-root/bin

# OS Packages needs to be installed as root
USER 0

# Copy scripts
COPY jupyter/utils/install_texlive.sh ./install_texlive.sh
COPY jupyter/utils/install_pandoc.sh ./install_pandoc.sh
RUN chmod +x install_texlive.sh install_pandoc.sh

RUN ./install_texlive.sh
RUN ./install_pandoc.sh

####################
# cpu-base #
####################
Expand Down Expand Up @@ -71,9 +89,14 @@ COPY ${JUPYTER_REUSABLE_UTILS} utils/
USER 0

# Dependencies for PDF export begin
RUN ./utils/install_pdf_deps.sh
ENV PATH="/usr/local/texlive/bin/linux:/usr/local/pandoc/bin:$PATH"
# Dependencies for PDF export end
RUN --mount=type=cache,from=pdf-builder,source=/usr/local/,target=/pdf_builder/,rw \
bash -c ' \
if [[ "$(uname -m)" == "ppc64le" ]]; then \
cp -r /pdf_builder/texlive /usr/local/; \
cp -r /pdf_builder/pandoc /usr/local/; \
else \
./utils/install_pdf_deps.sh; \
fi'

USER 1001

Expand Down
36 changes: 20 additions & 16 deletions jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

############################
# Stage 1: PDF Tool Build #
############################
Expand Down Expand Up @@ -34,7 +37,7 @@ USER 0
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand Down Expand Up @@ -69,28 +72,21 @@ FROM cpu-base AS jupyter-minimal
ARG JUPYTER_REUSABLE_UTILS=jupyter/utils
ARG MINIMAL_SOURCE_CODE=jupyter/minimal/ubi9-python-3.12

LABEL name="odh-notebook-jupyter-minimal-ubi9-python-3.12" \
summary="Minimal Jupyter notebook image for ODH notebooks" \
description="Minimal Jupyter notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \
io.k8s.display-name="Minimal Jupyter notebook image for ODH notebooks" \
io.k8s.description="Minimal Jupyter notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \
authoritative-source-url="https://github.com/opendatahub-io/notebooks" \
io.openshift.build.commit.ref="main" \
io.openshift.build.source-location="https://github.com/opendatahub-io/notebooks/tree/main/jupyter/minimal/ubi9-python-3.12" \
io.openshift.build.image="quay.io/opendatahub/workbench-images:jupyter-minimal-ubi9-python-3.12" \
com.redhat.component="odh-workbench-jupyter-minimal-cpu-py312-rhel9" \
com.redhat.license_terms="https://www.redhat.com/licenses/Red_Hat_Standard_EULA_20191108.pdf"

WORKDIR /opt/app-root/bin

COPY ${JUPYTER_REUSABLE_UTILS} utils/

USER 0

# Dependencies for PDF export begin
RUN ./utils/install_pdf_deps.sh
ENV PATH="/usr/local/texlive/bin/linux:/usr/local/pandoc/bin:$PATH"
# Dependencies for PDF export end
RUN --mount=type=cache,from=pdf-builder,source=/usr/local/,target=/pdf_builder/,rw \
bash -c ' \
if [[ "$(uname -m)" == "ppc64le" ]]; then \
cp -r /pdf_builder/texlive /usr/local/; \
cp -r /pdf_builder/pandoc /usr/local/; \
else \
./utils/install_pdf_deps.sh; \
fi'

USER 1001

Expand All @@ -116,3 +112,11 @@ RUN echo "Installing softwares and packages" && \
WORKDIR /opt/app-root/src

ENTRYPOINT ["start-notebook.sh"]

LABEL name="rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9" \
com.redhat.component="odh-workbench-jupyter-minimal-cpu-py312-rhel9" \
io.k8s.display-name="odh-workbench-jupyter-minimal-cpu-py312-rhel9" \
summary="Minimal Jupyter CPU notebook image for ODH notebooks" \
description="Minimal Jupyter CPU notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \
io.k8s.description="Minimal Jupyter CPU notebook image with base Python 3.12 builder image based on UBI9 for ODH notebooks" \
com.redhat.license_terms="https://www.redhat.com/licenses/Red_Hat_Standard_EULA_20191108.pdf"
5 changes: 4 additions & 1 deletion jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ ARG TARGETARCH
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

####################
# cuda-base #
####################
Expand All @@ -18,7 +21,7 @@ USER 0
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand Down
5 changes: 4 additions & 1 deletion jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

####################
# rocm-base #
####################
Expand All @@ -16,7 +19,7 @@ USER 0
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand Down
5 changes: 4 additions & 1 deletion jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ ARG TARGETARCH
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

######################################################
# mongocli-builder (build stage only, not published) #
######################################################
Expand All @@ -31,7 +34,7 @@ USER 0
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand Down
5 changes: 4 additions & 1 deletion jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ ARG TARGETARCH
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

######################################################
# mongocli-builder (build stage only, not published) #
######################################################
Expand All @@ -31,7 +34,7 @@ USER 0
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand Down
5 changes: 4 additions & 1 deletion jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

######################################################
# mongocli-builder (build stage only, not published) #
######################################################
Expand All @@ -29,7 +32,7 @@ USER 0
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand Down
8 changes: 7 additions & 1 deletion jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
#########################
ARG BASE_IMAGE

# External image alias for UBI repository configuration
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos

######################################################
# mongocli-builder (build stage only, not published) #
######################################################
Expand All @@ -29,7 +32,7 @@ USER 0
# Inject the official UBI 9 repository configuration into the AIPCC base image.
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
COPY --from=registry.access.redhat.com/ubi9/ubi /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo

# upgrade first to avoid fixable vulnerabilities begin
# Problem: The operation would result in removing the following protected packages: systemd
Expand Down Expand Up @@ -114,6 +117,7 @@ WORKDIR /opt/app-root/src
###########################
FROM rocm-jupyter-datascience AS rocm-jupyter-tensorflow

ARG JUPYTER_REUSABLE_UTILS=jupyter/utils
ARG DATASCIENCE_SOURCE_CODE=jupyter/datascience/ubi9-python-3.12
ARG TENSORFLOW_SOURCE_CODE=jupyter/rocm/tensorflow/ubi9-python-3.12

Expand Down Expand Up @@ -145,6 +149,8 @@ RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \
fix-permissions /opt/app-root -P
USER 1001

COPY ${JUPYTER_REUSABLE_UTILS}/usercustomize.pth ${JUPYTER_REUSABLE_UTILS}/monkey_patch_protobuf_6x.py /opt/app-root/lib/python3.12/site-packages/

WORKDIR /opt/app-root/src

LABEL name="rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" \
Expand Down
Loading
Loading