Merge miniforge-cuda into ci-imgs (#167)

Co-authored-by: Bradley Dice <bdice@bradleydice.com>

.github/workflows/build-and-publish-images.yaml

@@ -40,6 +40,8 @@ jobs:
       PYTHON_VER: ${{ matrix.PYTHON_VER }}
       IMAGE_REPO: ${{ matrix.IMAGE_REPO }}
       IMAGE_NAME: ${{ matrix.IMAGE_NAME }}
+      DOCKERFILE: ${{ matrix.DOCKERFILE }}
+      DOCKER_TARGET: ${{ matrix.DOCKER_TARGET }}
   build-multiarch-manifest:
     name: manifest (${{ matrix.CUDA_VER }}, ${{ matrix.PYTHON_VER }}, ${{ matrix.LINUX_VER }}, ${{ matrix.IMAGE_REPO }})
     needs: [docker, compute-matrix]

.github/workflows/build-image.yaml

@@ -21,6 +21,12 @@ on:
       IMAGE_NAME:
         required: true
         type: string
+      DOCKERFILE:
+        required: true
+        type: string
+      DOCKER_TARGET:
+        required: false
+        type: string
 
 jobs:
   run:
@@ -62,9 +68,10 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: context
-          file: ${{ inputs.IMAGE_REPO }}.Dockerfile
+          file: ${{ inputs.DOCKERFILE }}
           push: true
           pull: true
           build-args: |
             ${{ steps.generate-build-args.outputs.ARGS }}
+          target: ${{ inputs.DOCKER_TARGET }}
           tags: ${{ inputs.IMAGE_NAME }}-${{ matrix.ARCH }}

ci-conda.Dockerfile

@@ -4,18 +4,85 @@ ARG PYTHON_VER=notset
 ARG YQ_VER=notset
 ARG AWS_CLI_VER=notset
 
+FROM nvidia/cuda:${CUDA_VER}-base-${LINUX_VER} AS miniforge-cuda
+
+ARG LINUX_VER
+ARG PYTHON_VER
+ARG DEBIAN_FRONTEND=noninteractive
+ENV PATH=/opt/conda/bin:$PATH
+ENV PYTHON_VERSION=${PYTHON_VER}
+
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+
+# Create a conda group and assign it as root's primary group
+RUN <<EOF
+groupadd conda
+usermod -g conda root
+EOF
+
+# Ownership & permissions based on https://docs.anaconda.com/anaconda/install/multi-user/#multi-user-anaconda-installation-on-linux
+COPY --from=condaforge/miniforge3:24.3.0-0 --chown=root:conda --chmod=770 /opt/conda /opt/conda
+
+# Ensure new files are created with group write access & setgid. See https://unix.stackexchange.com/a/12845
+RUN chmod g+ws /opt/conda
+
+RUN <<EOF
+# Ensure new files/dirs have group write permissions
+umask 002
+# install expected Python version
+conda install -y -n base "python~=${PYTHON_VERSION}.0=*_cpython"
+conda update --all -y -n base
+if [[ "$LINUX_VER" == "rockylinux"* ]]; then
+  yum install -y findutils
+  yum clean all
+fi
+find /opt/conda -follow -type f -name '*.a' -delete
+find /opt/conda -follow -type f -name '*.pyc' -delete
+conda clean -afy
+EOF
+
+# Reassign root's primary group to root
+RUN usermod -g root root
+
+RUN <<EOF
+# ensure conda environment is always activated
+ln -s /opt/conda/etc/profile.d/conda.sh /etc/profile.d/conda.sh
+echo ". /opt/conda/etc/profile.d/conda.sh; conda activate base" >> /etc/skel/.bashrc
+echo ". /opt/conda/etc/profile.d/conda.sh; conda activate base" >> ~/.bashrc
+EOF
+
+# tzdata is needed by the ORC library used by pyarrow, because it provides /etc/localtime
+RUN <<EOF
+case "${LINUX_VER}" in
+  "ubuntu"*)
+    apt-get update
+    apt-get upgrade -y
+    apt-get install -y --no-install-recommends \
+      tzdata
+    rm -rf "/var/lib/apt/lists/*"
+    ;;
+  "rockylinux"*)
+    yum update -y
+    yum clean all
+    ;;
+  *)
+    echo "Unsupported LINUX_VER: ${LINUX_VER}" && exit 1
+    ;;
+esac
+EOF
+
 FROM mikefarah/yq:${YQ_VER} AS yq
 
 FROM amazon/aws-cli:${AWS_CLI_VER} AS aws-cli
 
-FROM rapidsai/miniforge-cuda:cuda${CUDA_VER}-base-${LINUX_VER}-py${PYTHON_VER}
+FROM miniforge-cuda
 
 ARG TARGETPLATFORM=notset
 ARG CUDA_VER=notset
 ARG LINUX_VER=notset
 ARG PYTHON_VER=notset
 
-ARG DEBIAN_FRONTEND=noninteractive
+ARG DEBIAN_FRONTEND
 
 # Set RAPIDS versions env variables
 ENV RAPIDS_CUDA_VERSION="${CUDA_VER}"

ci-wheel.Dockerfile

@@ -2,7 +2,7 @@ ARG CUDA_VER=notset
 ARG LINUX_VER=notset
 
 ARG BASE_IMAGE=nvcr.io/nvidia/cuda:${CUDA_VER}-devel-${LINUX_VER}
-ARG AWS_CLI_VER
+ARG AWS_CLI_VER=notset
 
 FROM amazon/aws-cli:${AWS_CLI_VER} AS aws-cli
 

ci/compute-matrix.jq

@@ -1,13 +1,5 @@
 def compute_arch($x):
-  ["amd64"] |
-  if
-    (["ubuntu18.04", "centos7"] | index($x.LINUX_VER) != null)
-   then
-    .
-  else
-    . + ["arm64"]
-  end |
-  $x + {ARCHES: .};
+  $x + {ARCHES: ["amd64", "arm64"]};
 
 def compute_repo($x):
   if
@@ -30,7 +22,9 @@ def compute_tag_prefix($x):
 def compute_image_name($x):
   compute_repo($x) as $repo |
   compute_tag_prefix($x) as $tag_prefix |
-  "rapidsai/" + $repo + ":" + $tag_prefix + "cuda" + $x.CUDA_VER + "-" + $x.LINUX_VER + "-" + "py" + $x.PYTHON_VER |
+  (if $x.IMAGE_REPO == "miniforge-cuda"
+   then "-base-" else "-" end) as $base_id |
+  "rapidsai/" + $repo + ":" + $tag_prefix + "cuda" + $x.CUDA_VER + $base_id + $x.LINUX_VER + "-" + "py" + $x.PYTHON_VER |
   $x + {IMAGE_NAME: .};
 
 # Checks the current entry to see if it matches the given exclude
@@ -54,6 +48,10 @@ def compute_matrix($input):
   [
     combinations |
     lists2dict($matrix_keys; .) |
+    .IMAGE_REPO = .CI_IMAGE_CONFIG.IMAGE_REPO |
+    .DOCKERFILE = .CI_IMAGE_CONFIG.dockerfile |
+    .DOCKER_TARGET = .CI_IMAGE_CONFIG.docker_target |
+    del(.CI_IMAGE_CONFIG) |
     filter_excludes(.; $excludes) |
     compute_arch(.) |
     compute_image_name(.)

ci/create-multiarch-manifest.sh

@@ -1,14 +1,9 @@
 #!/bin/bash
 set -euo pipefail
 
-PREFIX="conda"
-if [[ "${IMAGE_REPO}" != "ci-conda" ]]; then
-  PREFIX="wheels"
-fi
-
-LATEST_CUDA_VER=$(yq -r ".$PREFIX.CUDA_VER" latest.yaml)
-LATEST_PYTHON_VER=$(yq -r ".$PREFIX.PYTHON_VER" latest.yaml)
-LATEST_UBUNTU_VER=$(yq -r ".$PREFIX.LINUX_VER" latest.yaml)
+LATEST_CUDA_VER=$(yq -r ".${IMAGE_REPO}.CUDA_VER" latest.yaml)
+LATEST_PYTHON_VER=$(yq -r ".${IMAGE_REPO}.PYTHON_VER" latest.yaml)
+LATEST_UBUNTU_VER=$(yq -r ".${IMAGE_REPO}.LINUX_VER" latest.yaml)
 
 source_tags=()
 tag="${IMAGE_NAME}"

citestwheel.Dockerfile

@@ -2,7 +2,7 @@ ARG CUDA_VER=notset
 ARG LINUX_VER=notset
 
 ARG BASE_IMAGE=nvcr.io/nvidia/cuda:${CUDA_VER}-devel-${LINUX_VER}
-ARG AWS_CLI_VER
+ARG AWS_CLI_VER=notset
 
 FROM amazon/aws-cli:${AWS_CLI_VER} AS aws-cli
 

latest.yaml

@@ -1,9 +1,17 @@
 # Define the values used for the "latest" tag
-conda:
+miniforge-cuda:
   CUDA_VER: "12.2.2"
   PYTHON_VER: "3.11"
   LINUX_VER: "ubuntu22.04"
-wheels:
+ci-conda:
+  CUDA_VER: "12.2.2"
+  PYTHON_VER: "3.11"
+  LINUX_VER: "ubuntu22.04"
+ci-wheel:
+  CUDA_VER: "12.2.2"
+  PYTHON_VER: "3.11"
+  LINUX_VER: "ubuntu20.04"
+citestwheel:
   CUDA_VER: "12.2.2"
   PYTHON_VER: "3.11"
   LINUX_VER: "ubuntu20.04"

matrix.yaml

@@ -13,10 +13,19 @@ LINUX_VER:
   - "ubuntu20.04"
   - "ubuntu22.04"
   - "rockylinux8"
-IMAGE_REPO:
-  - "ci-conda"
-  - "ci-wheel"
-  - "citestwheel"
+CI_IMAGE_CONFIG:
+  - IMAGE_REPO: "miniforge-cuda"
+    dockerfile: ci-conda.Dockerfile
+    docker_target: miniforge-cuda
+  - IMAGE_REPO: "ci-conda"
+    dockerfile: ci-conda.Dockerfile
+    docker_target: ""
+  - IMAGE_REPO: "ci-wheel"
+    dockerfile: ci-wheel.Dockerfile
+    docker_target: ""
+  - IMAGE_REPO: "citestwheel"
+    dockerfile: citestwheel.Dockerfile
+    docker_target: ""
 exclude:
   # Exclusions from CUDA's OS support matrix
   - LINUX_VER: "ubuntu22.04"