Merge branch 'main' into fix-gcp

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: JosepSampe

config/config_template.yaml

@@ -165,14 +165,14 @@
 #ceph:
     #storage_bucket: <BUCKET_NAME>
     #endpoint: <ENDPOINT_URL>
-    #access_key: <ACCESS_KEY>
-    #secret_key: <ACCESS_KEY>
-    
+    #access_key_id: <ACCESS_KEY_ID>
+    #secret_access_key: <SECRET_ACCESS_KEY>
+
 #minio:
     #storage_bucket: <BUCKET_NAME>
     #endpoint: <ENDPOINT_URL>
-    #access_key: <ACCESS_KEY>
-    #secret_key: <ACCESS_KEY>
+    #access_key_id: <ACCESS_KEY_ID>
+    #secret_access_key: <SECRET_ACCESS_KEY>
 
 #redis:
     #host: <ENDPOINT_URL>

docs/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.8-buster
+FROM python:3.10-slim-bookworm
 
 RUN apt-get update \
     && apt-get install --no-install-recommends -y \

docs/source/compute_config/kubernetes.md

@@ -76,6 +76,33 @@ k8s:
 |k8s | runtime_memory | 512 |no | Memory limit in MB. Default 512MB |
 |k8s | runtime_timeout | 600 |no | Runtime timeout in seconds. Default 600 seconds |
 |k8s | master_timeout | 600 |no | Master pod timeout in seconds. Default 600 seconds |
+|k8s | container_security_context | PSS Baseline (drop ALL caps, no privilege escalation, RuntimeDefault seccomp) | no | Mapping injected as the container `securityContext` on every Lithops pod. Set to `null` to disable. |
+|k8s | pod_security_context | | no | Mapping injected as the pod-level `securityContext`. Required for clusters enforcing Pod Security Standards Restricted (e.g. EGI Rancher, GKE Autopilot, OpenShift). Requires a non-root runtime image. |
+
+## Running on Pod Security Standards Restricted clusters
+
+Clusters enforcing the [Pod Security Standards "Restricted"](https://kubernetes.io/docs/concepts/security/pod-security-standards/) profile (Rancher with EGI policies, GKE Autopilot, OpenShift, AKS with Azure Policy, EKS with admission controllers) require pods to run as a non-root user with additional hardening. Set `pod_security_context` and use a runtime image that has a non-root `USER` directive:
+
+```yaml
+k8s:
+    runtime: <your_user>/<non_root_runtime>:<tag>
+    pod_security_context:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+            type: RuntimeDefault
+    container_security_context:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+            drop: ["ALL"]
+        seccompProfile:
+            type: RuntimeDefault
+```
+
+Providing `container_security_context` fully replaces the defaults — copy the snippet above and adjust if you want to extend rather than override.
 
 ## Test Lithops
 

lithops/serverless/backends/aliyun_fc/aliyun_fc.py

@@ -108,7 +108,7 @@ def download_requirements():
             if docker_path:
                 # Build the runtime in a docker
                 cmd = 'python3 -m pip install -U -t . -r requirements.txt'
-                cmd = f'docker run -w /tmp -v {build_dir}:/tmp python:{utils.CURRENT_PY_VERSION}-slim-buster {cmd}'
+                cmd = f'docker run -w /tmp -v {build_dir}:/tmp python:{utils.CURRENT_PY_VERSION}-slim-bookworm {cmd}'
                 utils.run_command(cmd)
             else:
                 logger.warning('Aliyun Functions use a Linux environment. Building'

lithops/serverless/backends/aliyun_fc/config.py

@@ -33,7 +33,6 @@
 BUILD_DIR = os.path.join(TEMP_DIR, 'AliyunRuntimeBuild')
 
 AVAILABLE_PY_RUNTIMES = {
-    '3.6': 'python3',
     '3.9': 'python3.9',
     '3.10': 'python3.10'
 }

lithops/serverless/backends/aws_batch/aws_batch.py

@@ -117,7 +117,7 @@ def _build_default_runtime(self, runtime_name):
         python_version = utils.version_str(sys.version_info)
         dockerfile = "Dockerfile.default-batch-runtime"
         with open(dockerfile, 'w') as f:
-            f.write(f"FROM python:{python_version}-slim-buster\n")
+            f.write(f"FROM python:{python_version}-slim-bookworm\n")
             f.write(batch_config.DOCKERFILE_DEFAULT)
         try:
             self.build_runtime(runtime_name, dockerfile)

lithops/serverless/backends/aws_lambda/config.py

@@ -32,8 +32,6 @@
 ]
 
 AVAILABLE_PY_RUNTIMES = {
-    '3.6': 'python3.6',
-    '3.7': 'python3.7',
     '3.8': 'python3.8',
     '3.9': 'python3.9',
     '3.10': 'python3.10',

lithops/serverless/backends/azure_containers/azure_containers.py

@@ -98,7 +98,7 @@ def _build_default_runtime(self, runtime_name):
         # Build default runtime using local dokcer
         dockerfile = "Dockefile.default-az-runtime"
         with open(dockerfile, 'w') as f:
-            f.write(f"FROM python:{utils.CURRENT_PY_VERSION}-slim-buster\n")
+            f.write(f"FROM python:{utils.CURRENT_PY_VERSION}-slim-bookworm\n")
             f.write(config.DEFAULT_DOCKERFILE)
         try:
             self.build_runtime(runtime_name, dockerfile)

lithops/serverless/backends/azure_functions/config.py

@@ -35,7 +35,7 @@
     'trigger': 'pub/sub'
 }
 
-AVAILABLE_PY_RUNTIMES = ['3.7', '3.8', '3.9', '3.10', '3.11']
+AVAILABLE_PY_RUNTIMES = ['3.8', '3.9', '3.10', '3.11']
 
 REQUIRED_AZURE_STORAGE_PARAMS = ('storage_account_name', 'storage_account_key')
 REQUIRED_AZURE_FUNCTIONS_PARAMS = ('resource_group', 'region')

lithops/serverless/backends/code_engine/code_engine.py

@@ -284,7 +284,7 @@ def _build_default_runtime(self, default_runtime_img_name):
         # Build default runtime using local dokcer
         dockerfile = "Dockefile.default-ce-runtime"
         python_version = utils.CURRENT_PY_VERSION
-        base_image = "slim-buster" if int(python_version.split('.')[1]) < 13 else "bookworm"
+        base_image = "slim-bookworm"
         with open(dockerfile, 'w') as f:
             f.write(f"FROM python:{python_version}-{base_image}\n")
             f.write(config.DOCKERFILE_DEFAULT)