chore(alibi-detect-server): [INFRA-1646] Upgrading alibi-detect-server (PR for visibility)

.github/workflows/alibidetect_tests.yml

@@ -2,28 +2,27 @@ name: V1 Alibi Detect Tests
 
 on:
   push:
-    branches: [ master ]
+    branches: "*" # TODO: return [master]
   pull_request:
-    # TODO revert before merge to master
-    branches: [ fix/core-1-CVEs ]
+    branches: "*" # TODO: return [master]
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: Set up Python 3.8
+      - uses: actions/checkout@v4
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: '3.12'
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:
-          version: 1.1.15
+          version: 2.1.2
           virtualenvs-create: false
       - name: Install dependencies
         run: |
-          pip install --upgrade pip setuptools
+          python -m pip install --upgrade pip setuptools
           make -C components/alibi-detect-server dev_install
       - name: Lint
         run: |
@@ -32,24 +31,24 @@ jobs:
   python-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Install Rclone
         run: |
-          wget https://downloads.rclone.org/v1.62.2/rclone-v1.62.2-linux-amd64.zip
-          unzip rclone-v1.62.2-linux-amd64.zip
-          mv rclone-v1.62.2-linux-amd64/rclone /usr/local/bin/rclone
-      - name: Set up Python 3.8
+          wget https://downloads.rclone.org/v1.71.2/rclone-v1.71.2-linux-amd64.zip
+          unzip rclone-v1.71.2-linux-amd64.zip
+          mv rclone-v1.71.2-linux-amd64/rclone /usr/local/bin/rclone
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          version: 1.1.15
-          python-version: 3.8
+          python-version: '3.12'
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:
+          version: 2.1.2
           virtualenvs-create: false
       - name: Install dependencies
         run: |
-          pip install --upgrade pip setuptools
+          python -m pip install --upgrade pip setuptools
           make -C components/alibi-detect-server dev_install
       - name: Test
         run: |

components/alibi-detect-server/.dockerignore

@@ -0,0 +1 @@
+_seldon_core/.tox

components/alibi-detect-server/.tool-versions

@@ -0,0 +1 @@
+poetry 1.8.0

components/alibi-detect-server/Dockerfile

@@ -1,63 +1,58 @@
 ARG VERSION
 ARG BASE_IMAGE
-FROM ${BASE_IMAGE}:${VERSION} as base
+FROM ${BASE_IMAGE}:${VERSION} AS base
 
 ARG VERSION
 LABEL name="Seldon Alibi Detect Server" \
-      vendor="Seldon Technologies" \
-      version="1.19.0-dev" \
-      release="1" \
-      summary="Alibi Detect Server for Seldon Core" \
-      description="The Alibi Detect Server provides outlier, drift and adversarial detection services for Seldon Core"
+    vendor="Seldon Technologies" \
+    version="1.19.0-dev" \
+    release="1" \
+    summary="Alibi Detect Server for Seldon Core" \
+    description="The Alibi Detect Server provides outlier, drift and adversarial detection services for Seldon Core"
 
-FROM base as builder
+FROM base AS builder
 
 USER root
 
 RUN microdnf update -y && \
     microdnf install -y \
-      unzip \
-      make \
-      automake \
-      gcc \
-      gcc-c++
+    unzip \
+    make \
+    automake \
+    gcc \
+    gcc-c++
 
 # Install Rclone Binary to be present in the image
-RUN wget https://downloads.rclone.org/v1.64.2/rclone-v1.64.2-linux-amd64.zip && \
-    unzip rclone-v1.64.2-linux-amd64.zip && \
-    mv rclone-v1.64.2-linux-amd64/rclone /usr/bin/rclone && \
-    rm -rf rclone-v1.64.2-linux-amd64.zip rclone-v1.64.2-linux-amd64
-
-# Note that we need to force Conda to use the system's std-c++ library, as
-# otherwise PyStan won't compile with Conda's older stdc++ library:
-# https://github.com/stan-dev/pystan/issues/294#issuecomment-870711100
-RUN pip install --upgrade pip setuptools wheel && \
-    cd /opt/conda/lib && \
-      rm libstdc++.so libstdc++.so.6 && \
-      ln -s /usr/lib64/libstdc++.so.6.0.29 libstdc++.so && \
-      ln -s /usr/lib64/libstdc++.so.6.0.29 libstdc++.so.6
+RUN wget https://downloads.rclone.org/v1.71.2/rclone-v1.71.2-linux-amd64.zip && \
+    unzip rclone-v1.71.2-linux-amd64.zip && \
+    mv rclone-v1.71.2-linux-amd64/rclone /usr/bin/rclone && \
+    rm -rf rclone-v1.71.2-linux-amd64.zip rclone-v1.71.2-linux-amd64
 
 # Make home dir
 RUN mkdir microservice
 WORKDIR /microservice
 
 # Install Poetry
-ENV POETRY_HOME /microservice/.poetry
-RUN curl -sSL https://install.python-poetry.org | python3 - --version 1.1.15
+ENV POETRY_HOME=/microservice/.poetry
+RUN /opt/conda/bin/pip install --no-cache-dir "poetry==2.1.2"
 
-ENV PATH "$POETRY_HOME/bin:$PATH"
-ENV POETRY_VIRTUALENVS_CREATE false
+# Replace vulnerable pip wheel embedded inside virtualenv(CVE-2025-8869)
+RUN find /opt/conda/lib/python3.12/site-packages/virtualenv/seed/wheels/embed/ -name "pip-*.whl" -delete && \
+    /opt/conda/bin/pip wheel pip==25.3.0 --wheel-dir /opt/conda/lib/python3.12/site-packages/virtualenv/seed/wheels/embed/
+
+ENV PATH="$POETRY_HOME/bin:$PATH"
+ENV POETRY_VIRTUALENVS_CREATE=false
 
 # Install the server
 ## NOTE: Removing explicitly requirements.txt file from subdeps test
 ## dependencies causing false positives in Snyk.
 COPY poetry.lock pyproject.toml ./
 COPY _seldon_core ./_seldon_core
-RUN poetry install --no-dev && \
+RUN poetry install --no-root && \
     rm ~/.cache/pip -rf && \
-    rm -f /opt/conda/lib/python3.8/site-packages/gslib/vendored/boto/requirements.txt \
-          /opt/conda/lib/python3.8/site-packages/gslib/vendored/oauth2client/docs/requirements.txt \
-          /opt/conda/lib/python3.8/site-packages/tests/conda_env/support/requirements.txt
+    rm -f /opt/conda/lib/python3.12/site-packages/gslib/vendored/boto/requirements.txt \
+    /opt/conda/lib/python3.12/site-packages/gslib/vendored/oauth2client/docs/requirements.txt \
+    /opt/conda/lib/python3.12/site-packages/tests/conda_env/support/requirements.txt
 
 # Add licences
 RUN mkdir /licenses
@@ -70,7 +65,10 @@ COPY adserver adserver
 COPY README.md README.md
 COPY version.txt version.txt
 
-FROM base as final
+# Install the project code
+RUN poetry install
+
+FROM base AS final
 WORKDIR /microservice
 
 USER root
@@ -89,8 +87,8 @@ COPY --from=builder /usr/bin/rclone /usr/bin/rclone
 COPY --from=builder /licenses /licenses
 
 # This is to have writable numba and keops cache directories
-ENV NUMBA_CACHE_DIR /tmp/numba-cache
-RUN mkdir -p /.cache && \
+ENV NUMBA_CACHE_DIR=/tmp/numba-cache
+RUN mkdir /.cache && \
     chown -R 8888:0 /.cache && \
     chmod -R 776 /.cache
 

components/alibi-detect-server/Makefile

@@ -3,7 +3,7 @@ SHELL := /bin/bash
 VERSION ?= $(shell cat ../../version.txt)
 DOCKER_REGISTRY ?= seldonio
 
-BASE_IMAGE ?= ${DOCKER_REGISTRY}/conda-ubi8
+BASE_IMAGE ?= ${DOCKER_REGISTRY}/conda-ubi9
 IMAGE ?= ${DOCKER_REGISTRY}/alibi-detect-server
 KIND_NAME ?= kind
 
@@ -12,7 +12,7 @@ SELDON_CORE_DIR=../..
 
 get_local_repo: clean
 	cp $(SELDON_CORE_DIR)/version.txt version.txt
-	cp -rT $(SELDON_CORE_DIR)/python/ _seldon_core/
+	cp -R "$(SELDON_CORE_DIR)/python/." _seldon_core/
 
 clean:
 	rm version.txt || true
@@ -27,8 +27,8 @@ type_check:
 	mypy --ignore-missing-imports adserver
 
 .PHONY: test
-test: type_check
-	pytest -W ignore adserver
+test: 
+	poetry run pytest -W ignore adserver
 
 .PHONY: lint
 lint:
@@ -99,7 +99,7 @@ curl-metrics-server-metrics:
 # image building logic
 
 docker-build: get_local_repo
-	docker build -f Dockerfile --build-arg BASE_IMAGE=${BASE_IMAGE} --build-arg VERSION=${VERSION} -t ${IMAGE}:${VERSION} .
+	docker build --platform linux/amd64 -f Dockerfile --build-arg BASE_IMAGE=${BASE_IMAGE} --build-arg VERSION=${VERSION} -t ${IMAGE}:${VERSION} .
 
 docker-build-gpu:
 	docker build -f Dockerfile.gpu -t ${IMAGE}-gpu:${VERSION} .

components/alibi-detect-server/adserver/tests/test_ad_model.py

@@ -40,7 +40,7 @@ def test_basic(self):
         req = [1, 2]
         headers = {}
         res = ad_model.process_event(req, headers)
-        self.assert_(res is not None)
+        self.assertIsNotNone(res)
         self.assertEqual(res.data["data"]["is_adversarial"], 1)
 
     def test_no_return_instance_score(self):
@@ -55,5 +55,5 @@ def test_no_return_instance_score(self):
         req = [1, 2]
         headers = {HEADER_RETURN_INSTANCE_SCORE: "false"}
         res = ad_model.process_event(req, headers)
-        self.assert_(res is not None)
+        self.assertIsNotNone(res)
         self.assertEqual(res.data["data"]["is_adversarial"], expected_is_adversarial)

components/alibi-detect-server/adserver/tests/test_cd_model.py

@@ -1,8 +1,9 @@
 from alibi_detect.base import BaseDetector, concept_drift_dict
 import numpy as np
-from unittest import TestCase
+from unittest import TestCase, skipUnless
 from adserver.cd_model import AlibiDetectConceptDriftModel
 from typing import Dict
+from adserver.base.storage import rclone
 
 
 class DummyCDModel(BaseDetector):
@@ -55,6 +56,7 @@ def test_batch(self):
         self.assertEqual(res, None)
 
 
+@skipUnless(rclone is not None, "rclone binary not available")
 class TestTextDriftModel(TestCase):
     def test_basic(self):
         model = DummyCDModel()

components/alibi-detect-server/adserver/tests/test_od_model.py

@@ -45,7 +45,7 @@ def test_basic(self):
         req = [1, 2]
         headers = {}
         res: ModelResponse = od_model.process_event(req, headers)
-        self.assert_(res is not None)
+        self.assertIsNotNone(res)
         self.assertEqual(res.data["data"]["is_outlier"], 0)
 
     def test_no_return_instance_score(self):
@@ -58,5 +58,5 @@ def test_no_return_instance_score(self):
         req = [1, 2]
         headers = {HEADER_RETURN_INSTANCE_SCORE: "false"}
         res: ModelResponse = ad_model.process_event(req, headers)
-        self.assert_(res is not None)
+        self.assertIsNotNone(res)
         self.assertEqual(res.data["data"]["is_outlier"], expect_return_is_outlier)