fix: Permissions and pymilvus conflict

[ruivieira]

• Fix container permissions
• Resolve pymilvus conflict with garak

Summary by Sourcery

Fix container permission issues by ensuring root context during setup and switching back to a non-root user, remove strict pymilvus version constraints to resolve dependency conflicts, and enhance Docker build workflow and base image references.

Bug Fixes:

• Ensure required directories are created as root and proper permissions are set before reverting to a non-root user in container build scripts
• Remove explicit pymilvus version constraints across project and provider configurations to avoid conflicts

Build:

• Switch to root user for package installations in Containerfiles and build scripts, then switch back to a dedicated non-root user
• Update trustyai-distribution build config to use registry.access.redhat.com for the UBI9 Python base image

CI:

• Revise GitHub Actions Docker build job to use a local image name, then tag it with the full registry path and commit SHA

[sourcery-ai]

Reviewer's Guide

This PR restructures Docker build processes and Python dependency management to resolve container permission issues and address pymilvus version conflicts. It reorders user contexts in containerfiles, unpins pymilvus across configurations, updates GitHub Actions tagging, and corrects registry paths.

Class diagram for ProviderSpec and AdapterSpec pymilvus dependency change

classDiagram
    class ProviderSpec {
        +Api api
        +AdapterSpec adapter_spec
    }
    class AdapterSpec {
        +adapter_type: str
        +pip_packages: list[str]  // Now ["pymilvus"]
        +module: str
        +config_class: str
        +description: str
    }
    ProviderSpec --> AdapterSpec

    class InlineProviderSpec {
        +api: Api
        +provider_type: str
        +pip_packages: list[str]  // Now ["pymilvus"]
        +module: str
        +config_class: str
        +api_dependencies: list[Api]
    }
    ProviderSpec --> InlineProviderSpec

Loading

File-Level Changes

Change	Details	Files
Reorganize user permissions and directory setup in main container build script	Switch to root user before package installation Create /.llama and /.cache directories with group write permissions Switch back to non-root user after setup Remove duplicate directory creation block	llama_stack/distribution/build_container.sh
Update trustyai-distribution Containerfile for permissions and pymilvus unpinning	Add USER root for pip installs Unpin pymilvus dependency Add USER 1001 after installations	trustyai-distribution/Containerfile
Enhance Docker build workflow tagging	Use local image name for build step Tag built image to quay.io registry as latest Tag image with commit SHA for versioning	.github/workflows/docker-build.yml
Remove version constraints on pymilvus across codebase	Replace pymilvus>=2.4.10 with pymilvus in provider specs Remove version specifier for pymilvus in unit and test dependencies	llama_stack/providers/registry/vector_io.py pyproject.toml
Correct base image registry in trustyai build configuration	Change container_image from registry.redhat.io to registry.access.redhat.com	trustyai-distribution/build.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey @ruivieira - I've reviewed your changes - here's some feedback:

• Consider consolidating the USER root and directory permission logic into a single build step or helper to reduce duplication and ensure consistent permissions before switching to the non-root user.
• Unpinning pymilvus entirely could lead to unexpected breaking changes; consider specifying a minimum or maximum version range (or using a constraints file) to maintain compatibility.
• In the GitHub Actions workflow, confirm that the docker tag commands align with the actual image tags produced by the build step to avoid tagging mismatches.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Consider consolidating the USER root and directory permission logic into a single build step or helper to reduce duplication and ensure consistent permissions before switching to the non-root user.
- Unpinning pymilvus entirely could lead to unexpected breaking changes; consider specifying a minimum or maximum version range (or using a constraints file) to maintain compatibility.
- In the GitHub Actions workflow, confirm that the docker tag commands align with the actual image tags produced by the build step to avoid tagging mismatches.

## Individual Comments

### Comment 1
<location> `trustyai-distribution/Containerfile:33` </location>
<code_context>
     pillow \
     psycopg2-binary \
-    pymilvus>=2.4.10 \
+    pymilvus \
     pymongo \
     pypdf \
</code_context>

<issue_to_address>
Removing the version pin for pymilvus may introduce compatibility issues.

Installing the latest pymilvus version may cause unexpected issues. Pin to a compatible version range if possible to maintain stability.
</issue_to_address>

### Comment 2
<location> `llama_stack/providers/registry/vector_io.py:524` </location>
<code_context>
             AdapterSpec(
                 adapter_type="milvus",
-                pip_packages=["pymilvus>=2.4.10"],
+                pip_packages=["pymilvus"],
                 module="llama_stack.providers.remote.vector_io.milvus",
                 config_class="llama_stack.providers.remote.vector_io.milvus.MilvusVectorIOConfig",
</code_context>

<issue_to_address>
Unpinned pymilvus dependency may cause unexpected behavior.

Without a minimum version, environments may install incompatible pymilvus versions. Specify a minimum version if your code depends on certain features or fixes.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (bug_risk): Removing the version pin for pymilvus may introduce compatibility issues.

Installing the latest pymilvus version may cause unexpected issues. Pin to a compatible version range if possible to maintain stability.

[sourcery-ai]

issue (bug_risk): Unpinned pymilvus dependency may cause unexpected behavior.

Without a minimum version, environments may install incompatible pymilvus versions. Specify a minimum version if your code depends on certain features or fixes.

[saichandrapandraju]

LGTM, Thanks @ruivieira !