Skip to content

fix: Permissions and pymilvus conflict #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ruivieira merged 1 commit into from
Aug 5, 2025
Merged

fix: Permissions and pymilvus conflict #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/docker-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
run: echo "Repository owner is trusted."

- name: Log in to Quay
uses: docker/login-action@v3

Check failure on line 38 in .github/workflows/docker-build.yml

View workflow job for this annotation

GitHub Actions / pre-commit 

uses non-SHA action ref:         uses: docker/login-action@v3
with:
registry: quay.io
username: ${{ secrets.QUAY_ROBOT_USERNAME }}
Expand All @@ -47,7 +47,10 @@
USE_COPY_NOT_MOUNT=true LLAMA_STACK_DIR=. uv run llama stack build \
--config trustyai-distribution/build.yaml \
--image-type container \
--image-name quay.io/trustyai/llama-stack:latest
--image-name llama-stack-trustyai

# Tag the built image with the full registry path
docker tag llama-stack-trustyai:dev quay.io/trustyai/llama-stack:latest

# Also tag with commit SHA for versioning
docker tag quay.io/trustyai/llama-stack:latest quay.io/trustyai/llama-stack:${{ github.sha }}
Expand Down
18 changes: 12 additions & 6 deletions llama_stack/distribution/build_container.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,8 @@ WORKDIR /app
# We install the Python 3.12 dev headers and build tools so that any
# C-extension wheels (e.g. polyleven, faiss-cpu) can compile successfully.

USER root

RUN dnf -y update && dnf install -y iputils git net-tools wget \
vim-minimal python3.12 python3.12-pip python3.12-wheel \
python3.12-setuptools python3.12-devel gcc make && \
Expand Down Expand Up @@ -324,6 +326,16 @@ fi
RUN pip uninstall -y uv
EOF

# Create directories and set permissions as root before switching to non-root user
add_to_container << EOF
RUN mkdir -p /.llama /.cache && chmod -R g+rw /app /.llama /.cache
EOF

# Switch to non-root user after all package installations and directory setup
add_to_container << EOF
USER 1001
EOF

# If a run config is provided, we use the --config flag
if [[ -n "$run_config" ]]; then
add_to_container << EOF
Expand All @@ -336,12 +348,6 @@ ENTRYPOINT ["python", "-m", "llama_stack.distribution.server.server", "--templat
EOF
fi

# Add other require item commands genearic to all containers
add_to_container << EOF

RUN mkdir -p /.llama /.cache && chmod -R g+rw /app /.llama /.cache
EOF

printf "Containerfile created successfully in %s/Containerfile\n\n" "$TEMP_DIR"
cat "$TEMP_DIR"/Containerfile
printf "\n"
Expand Down
4 changes: 2 additions & 2 deletions llama_stack/providers/registry/vector_io.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -521,7 +521,7 @@ def available_providers() -> list[ProviderSpec]:
Api.vector_io,
AdapterSpec(
adapter_type="milvus",
pip_packages=["pymilvus>=2.4.10"],
pip_packages=["pymilvus"],
Copy link

@sourcery-ai sourcery-ai bot Aug 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): Unpinned pymilvus dependency may cause unexpected behavior.

Without a minimum version, environments may install incompatible pymilvus versions. Specify a minimum version if your code depends on certain features or fixes.

module="llama_stack.providers.remote.vector_io.milvus",
config_class="llama_stack.providers.remote.vector_io.milvus.MilvusVectorIOConfig",
description="""
Expand Down Expand Up @@ -634,7 +634,7 @@ def available_providers() -> list[ProviderSpec]:
InlineProviderSpec(
api=Api.vector_io,
provider_type="inline::milvus",
pip_packages=["pymilvus>=2.4.10"],
pip_packages=["pymilvus"],
module="llama_stack.providers.inline.vector_io.milvus",
config_class="llama_stack.providers.inline.vector_io.milvus.MilvusVectorIOConfig",
api_dependencies=[Api.inference],
Expand Down
4 changes: 2 additions & 2 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ unit = [
"sqlalchemy[asyncio]>=2.0.41",
"blobfile",
"faiss-cpu",
"pymilvus>=2.5.12",
"pymilvus",
"litellm",
"together",
"coverage",
Expand All @@ -113,7 +113,7 @@ test = [
"sqlalchemy",
"sqlalchemy[asyncio]>=2.0.41",
"requests",
"pymilvus>=2.5.12",
"pymilvus",
"reportlab",
]
docs = [
Expand Down
7 changes: 6 additions & 1 deletion trustyai-distribution/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
FROM registry.access.redhat.com/ubi9/python-312:latest
WORKDIR /opt/app-root

# Switch to root for package installation
USER root
RUN pip install sqlalchemy # somehow sqlalchemy[asyncio] is not sufficient
RUN pip install \
aiosqlite \
Expand All @@ -28,7 +30,7 @@ RUN pip install \
pandas \
pillow \
psycopg2-binary \
pymilvus>=2.4.10 \
pymilvus \
Copy link

@sourcery-ai sourcery-ai bot Aug 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): Removing the version pin for pymilvus may introduce compatibility issues.

Installing the latest pymilvus version may cause unexpected issues. Pin to a compatible version range if possible to maintain stability.

pymongo \
pypdf \
redis \
Expand All @@ -43,6 +45,9 @@ RUN pip install \
RUN pip install --index-url https://download.pytorch.org/whl/cpu torch torchvision
RUN pip install --no-deps sentence-transformers
RUN pip install --no-cache llama-stack==0.2.16

# Switch back to non-root user
USER 1001
RUN mkdir -p ${HOME}/.llama/providers.d ${HOME}/.cache
COPY trustyai-distribution/run.yaml ${APP_ROOT}/run.yaml
COPY trustyai-distribution/providers.d/ ${HOME}/.llama/providers.d/
Expand Down
5 changes: 5 additions & 0 deletions trustyai-distribution/Containerfile.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,14 @@
FROM registry.access.redhat.com/ubi9/python-312:latest
WORKDIR /opt/app-root

# Switch to root for package installation
USER root
RUN pip install sqlalchemy # somehow sqlalchemy[asyncio] is not sufficient
{dependencies}
RUN pip install --no-cache llama-stack==0.2.16

# Switch back to non-root user
USER 1001
RUN mkdir -p ${{HOME}}/.llama/providers.d ${{HOME}}/.cache
COPY trustyai-distribution/run.yaml ${{APP_ROOT}}/run.yaml
COPY trustyai-distribution/providers.d/ ${{HOME}}/.llama/providers.d/
Expand Down
2 changes: 1 addition & 1 deletion trustyai-distribution/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ distribution_spec:
- provider_type: remote::tavily-search
- provider_type: inline::rag-runtime
- provider_type: remote::model-context-protocol
container_image: registry.redhat.io/ubi9/python-312:latest
container_image: registry.access.redhat.com/ubi9/python-312:latest
additional_pip_packages:
- aiosqlite
- sqlalchemy[asyncio]
Expand Down
Loading
Loading