DO NOT MERGE: check torch 2.11 on the hermetic image build

.tekton/odh-trustyai-nemo-guardrails-server-pull-request.yaml

@@ -43,11 +43,21 @@ spec:
     - linux/x86_64
     - linux-m2xlarge/arm64
     - linux/ppc64le
+    - linux/s390x
   - name: prefetch-input
     value: |
-      [{"type": "generic", "path": "."}]
+      [{
+        "type": "pip",
+        "path": ".",
+        "requirements_files": ["requirements-build.txt", "requirements.txt", "requirements-models.txt"],
+        "binary": {"arch": "x86_64,aarch64,ppc64le,s390x"}
+      },
+      {
+        "type": "generic",
+        "path": "."
+      }]
   - name: hermetic
-    value: false
+    value: "true"
   - name: enable-slack-failure-notification
     value: "false"
   - name: path-context
@@ -70,4 +80,4 @@ spec:
   - name: git-auth
     secret:
       secretName: '{{ git_auth_secret }}'
-status: {}
+status: {}

Dockerfile.konflux

@@ -1,175 +1,19 @@
-###############################################################
-# Stage 1 Base builder image with common tooling
-###############################################################
-FROM registry.access.redhat.com/ubi9/python-312@sha256:7adc9bee533e01ff0b98220b67d17aca1280344bf7ad0b663bfc84cee7e1adb5 as packages-build
-
-USER root
-WORKDIR /app
-
-ENV PATH="$HOME/.cargo/bin:$PATH"
-ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/
-ARG TARGETARCH
-
-# Install dependencies
-RUN if [ "$TARGETARCH" = "ppc64le" ]; then                        \
-        dnf install -y \
-        make libtool wget patch ninja-build cmake xz bzip2-devel libffi-devel zlib-devel openssl-devel libevent-devel \
-        python3.12 python3.12-devel python3.12-pip clang \
-        gcc-toolset-14-gcc gcc-toolset-14-gcc-c++ gcc-toolset-14-gcc-gfortran skopeo && \
-        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y      && \
-        dnf clean all                                                   && \
-        pip install --upgrade setuptools-rust pip 'cmake<4' setuptools wheel maturin  ; \
-    fi
-
-COPY requirements* /app/
-
-# Create a dummy file to trigger build dependency
-RUN touch /tmp/control
-
-###############################################################
-# Stage 2 to build OpenBLAS
-###############################################################
-
-FROM packages-build AS openblas-builder
-ENV OPENBLAS_VERSION=0.3.30
-ARG TARGETARCH
-
-WORKDIR /app
-
-# Creating a directory for OpenBlas
-RUN mkdir /tmp/openblas
-
-RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
-        source /opt/rh/gcc-toolset-14/enable &&  \
-        wget https://github.com/OpenMathLib/OpenBLAS/releases/download/v${OPENBLAS_VERSION}/OpenBLAS-${OPENBLAS_VERSION}.zip && \
-        unzip OpenBLAS-${OPENBLAS_VERSION}.zip -d /tmp/ && mv -T /tmp/OpenBLAS-${OPENBLAS_VERSION} /tmp/openblas             && \
-        cd /tmp/openblas                                                                                                     && \
-        make -j$(nproc) TARGET=POWER9 BINARY=64 USE_OPENMP=1 USE_THREAD=1 NUM_THREADS=120 DYNAMIC_ARCH=1 INTERFACE64=0        ; \
-    fi
-
-###############################################################
-# Stage 3 to build pyTorch
-###############################################################
-
-FROM packages-build AS torch-builder
-USER root
-
-WORKDIR /app
-
-ARG MAX_JOBS
-ARG _GLIBCXX_USE_CXX11_ABI=1
-ARG TARGETARCH
-
-RUN mkdir -p /torchwheels
-
-RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
-    export TORCH_VERSION=$(sed -n "s/^torch==//p" /app/requirements-torch.in)                                                      && \
-    source /opt/rh/gcc-toolset-14/enable &&  \
-    git clone --recursive https://github.com/pytorch/pytorch.git -b v${TORCH_VERSION} && \
-    cd pytorch && pip install -r requirements.txt && \
-    rm -f dist/torch*+git*whl                     && \
-    # Set MAX_JOBS to 2 or 4 to prevent OOM
-    # MAX_JOBS=4 \
-    USE_NCCL=0 \
-    BUILD_TEST=0 \
-    PYTORCH_BUILD_VERSION=${TORCH_VERSION} \
-    PYTORCH_BUILD_NUMBER=1 \
-    pip wheel . --no-build-isolation --wheel-dir /torchwheels/ \
-; fi
-
-###############################################################
-# Stage 4 to build Tiktoken
-###############################################################
-
-FROM packages-build as tiktoken-builder
-ARG TARGETARCH
-WORKDIR /app
-
-RUN mkdir -p /tiktokenwheels
-
-RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
-        export TIKTOKEN_VERSION=$(sed -n "s/^tiktoken==//p" /app/requirements.txt) && \
-        source /opt/rh/gcc-toolset-14/enable && \
-        git clone https://github.com/openai/tiktoken.git && \
-        cd tiktoken && \
-        git checkout ${TIKTOKEN_VERSION} && \
-        pip wheel . --wheel-dir /tiktokenwheels ; \
-    fi
-
-###############################################################
-# Stage 5 to build onnxruntime
-###############################################################
-FROM packages-build AS onnxruntime-builder
-ARG TARGETARCH
-USER root
-
-WORKDIR /app
-
-ENV LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib:/usr/lib64:/usr/lib:/app/.openblas/lib
-
-# copy built OpenBLAS sources
-COPY --from=openblas-builder /tmp/openblas/ /build/openblas
-
-# Install OpenBLAS
-RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
-        PREFIX=/app/.openblas make -C /build/openblas install   && \
-        ln -sf /app/.openblas/lib/libopenblasp-r0.3.30.so /app/.openblas/lib/libopenblasp.so.0 ; \
-   fi
-
-COPY scripts/build_onnxruntime.sh /build/build_onnxruntime.sh
-
-RUN mkdir -p /onnxruntime_wheels
-
-# Build onnxruntime
-RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
-        export ONNXRUNTIME_VERSION=$(sed -n "s/^onnxruntime==//p" /app/requirements.txt) && \
-        sh /build/build_onnxruntime.sh      ; \
-    fi
-
-###############################################################
-# Stage 6 Install hf_xet from source ppc64le
-###############################################################
-FROM packages-build AS hf-xet-builder
-ARG TARGETARCH
-USER root
-
-WORKDIR /app
-RUN mkdir -p /hf_xet_wheels
-
-RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
-       export HF_XET_VERSION=$(sed -n "s/^hf-xet==//p" /app/requirements.txt) && \
-       git clone https://github.com/huggingface/xet-core.git && \
-       cd xet-core/hf_xet && git checkout v${HF_XET_VERSION} && \
-       sed -i '/python-source = "python"/d' pyproject.toml && \
-       maturin build --release --out /hf_xet_wheels ; \
-    fi
-
-###############################################################
-# Stage 7 Install all the dependencies
-###############################################################
-
-FROM registry.access.redhat.com/ubi9/python-312@sha256:7adc9bee533e01ff0b98220b67d17aca1280344bf7ad0b663bfc84cee7e1adb5 as build
+ARG BASE=quay.io/aipcc/base-images/cpu:3.5.0
+FROM $BASE as build
 
 USER 0
 WORKDIR /app
 
-ARG TARGETARCH
 ARG GUARDRAILS_PROFILE=opensource
-ENV LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib:/usr/lib64:/usr/lib:/app/.openblas/lib
-ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/:/app/.openblas/lib/pkgconfig
-ENV PATH="$HOME/.cargo/bin:/app/.venv/bin:$PATH"
-ENV BLIS_ARCH=generic
-ENV GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1
 
-COPY requirements.txt requirements-torch.txt pyproject.toml README.md ./
+COPY requirements.txt requirements-build.txt requirements-models.txt pyproject.toml README.md LICENSE.md LICENSE-Apache-2.0.txt LICENCES-3rd-party ./
+COPY artifacts.lock.yaml ./
 COPY nemoguardrails/ ./nemoguardrails/
 COPY scripts/ ./scripts/
 COPY examples/bots/ ./examples/bots/
 
 RUN chmod +x ./scripts/entrypoint.sh
-
-RUN python3 -m pip install --no-cache-dir pyyaml
-
+RUN pip install --no-cache-dir pyyaml
 RUN python3 ./scripts/filter_guardrails.py ./scripts/provider-list.yaml $GUARDRAILS_PROFILE
 
 ENV HF_HOME=/app/.cache/huggingface \
@@ -178,65 +22,27 @@ ENV HF_HOME=/app/.cache/huggingface \
     NLTK_DATA=/app/.cache/nltk_data \
     FASTEMBED_CACHE_PATH=/app/.cache/fastembed
 
-RUN python3 -m venv /app/.venv
-
-# Copy OpenBLAS
-COPY --from=openblas-builder /tmp/openblas/ /tmp/openblas
-
-# Dummy file to trigger build dependency
-COPY --from=torch-builder /tmp/control /dev/null
-COPY --from=tiktoken-builder /tmp/control /dev/null
-COPY --from=onnxruntime-builder /tmp/control /dev/null
-COPY --from=hf-xet-builder /tmp/control /dev/null
-
-RUN --mount=type=cache,from=torch-builder,source=/torchwheels/,target=/tmp/torchwheels/,ro \
-    --mount=type=cache,from=tiktoken-builder,source=/tiktokenwheels/,target=/tmp/tiktokenwheels/,ro \
-    --mount=type=cache,from=onnxruntime-builder,source=/onnxruntime_wheels/,target=/tmp/onnxruntime_wheels/,ro \
-    --mount=type=cache,from=hf-xet-builder,source=/hf_xet_wheels/,target=/tmp/hf_xet_wheels/,ro \
-    if [ "$TARGETARCH" = "ppc64le" ]; then \
-        /app/.venv/bin/pip install \
-            /tmp/torchwheels/*.whl \
-            /tmp/tiktokenwheels/*.whl \
-            /tmp/onnxruntime_wheels/*.whl  \
-            /tmp/hf_xet_wheels/*.whl && \
-        PREFIX=/app/.openblas make -C /tmp/openblas install && rm -rf /tmp/openblas     ; \
-    fi
-
-# Temporary workaround for ppc64le with the pinned pandas version. Remove after upgrading pandas with v3.x
-RUN if [ "$TARGETARCH" == "ppc64le" ]; then     \
-        export PANDAS_VERSION=$(sed -n "s/^pandas==//p" /app/requirements.txt) && \
-        /app/.venv/bin/pip install --no-cache-dir "meson<1.10" meson-python ninja cython numpy versioneer[toml] packaging && \
-        /app/.venv/bin/pip install --no-cache-dir --no-build-isolation pandas==${PANDAS_VERSION} ; \
-    fi
-
-RUN /app/.venv/bin/pip install --no-cache-dir -r requirements.txt && \
+RUN python3 -m venv /app/.venv && \
+    /app/.venv/bin/pip install --no-cache-dir -r requirements-build.txt && \
+    /app/.venv/bin/pip install --no-cache-dir -r requirements.txt && \
+    /app/.venv/bin/pip install --no-cache-dir -r requirements-models.txt && \
+    mkdir -p nemoguardrails/examples && \
+    cp -r examples/bots nemoguardrails/examples/bots && \
     /app/.venv/bin/pip install --no-cache-dir --no-deps . && \
-    rm -rf /root/.cache/pip /tmp/* /var/tmp/*
-
-RUN /app/.venv/bin/pip install --no-cache-dir /cachi2/output/deps/generic/en_core_web_lg-3.8.0-py3-none-any.whl
-
-RUN if [ "$TARGETARCH" != "ppc64le" ]; then     \
-        /app/.venv/bin/pip install --no-cache-dir -r requirements-torch.txt ; \
-    fi
+    rm -rf nemoguardrails/examples /root/.cache/pip /tmp/* /var/tmp/*
 
 RUN set -ex && \
-    GUARDRAILS_PROFILE=$GUARDRAILS_PROFILE /app/.venv/bin/python ./scripts/pre_download_required_models.py && \
+    GUARDRAILS_PROFILE=$GUARDRAILS_PROFILE ./scripts/setup_prefetched_models.sh && \
     find /app/.cache -type f -name "*.pyc" -delete && \
     find /app/.cache -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true && \
     find /app/.cache -type d -name ".git" -exec rm -rf {} + 2>/dev/null || true && \
     rm -rf /app/.cache/huggingface/xet /root/.cache /tmp/* /var/tmp/*
 
-###############################################################
-# Stage 8 Final Build
-###############################################################
-
-FROM registry.access.redhat.com/ubi9/python-312:latest as runtime
+FROM $BASE as runtime
 
 USER 0
 WORKDIR /app
 
-ENV LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib:/usr/lib64:/usr/lib:/app/.openblas/lib
-
 COPY --from=build /app /app
 
 RUN rm -f /etc/security/namespace.conf /usr/lib64/security/pam_namespace.so || true && \
@@ -253,8 +59,10 @@ ENV HF_HOME=/app/.cache/huggingface \
     FASTEMBED_CACHE_PATH=/app/.cache/fastembed \
     PATH="/app/.venv/bin:$PATH" \
     PYTHONUNBUFFERED=1 \
+    DO_NOT_TRACK=1 \
     PYTHONDONTWRITEBYTECODE=1 \
-    DO_NOT_TRACK=1
+    REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
+    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
 
 EXPOSE 8000
 ENTRYPOINT ["./scripts/entrypoint.sh"]

artifacts.lock.yaml

@@ -1,7 +1,64 @@
----
+# Auto-generated by scripts/generate_model_lockfile.py
+# Re-run to update: uv run --with pyyaml --with fastembed scripts/generate_model_lockfile.py
+
+# profile: opensource
+# sentence-transformers/all-MiniLM-L6-v2 commit: c9745ed1d9f207416be6d2e6f8de32d1f16199bf
+# qdrant/all-MiniLM-L6-v2-onnx commit: 5f1b8cd78bc4fb444dd171e59b18f3a3af89a079
+
 metadata:
-  version: "1.0"
+  version: '1.0'
 artifacts:
-  - download_url: "https://github.com/explosion/spacy-models/releases/download/en_core_web_lg-3.8.0/en_core_web_lg-3.8.0-py3-none-any.whl"
-    checksum: "sha256:293e9547a655b25499198ab15a525b05b9407a75f10255e405e8c3854329ab63"
-    filename: "en_core_web_lg-3.8.0-py3-none-any.whl"
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/config.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--config.json
+  checksum: sha256:953f9c0d463486b10a6871cc2fd59f223b2c70184f49815e7efbcab5d8908b41
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/config_sentence_transformers.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--config_sentence_transformers.json
+  checksum: sha256:061ca9d39661d6c6d6de5ba27f79a1cd5770ea247f8d46412a68a498dc5ac9f3
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/data_config.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--data_config.json
+  checksum: sha256:32edcb108fc2516b920734a862ae0692bcae1c5d45d5f8d972cb0d53434a4c54
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/model.safetensors
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--model.safetensors
+  checksum: sha256:53aa51172d142c89d9012cce15ae4d6cc0ca6895895114379cacb4fab128d9db
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/modules.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--modules.json
+  checksum: sha256:84e40c8e006c9b1d6c122e02cba9b02458120b5fb0c87b746c41e0207cf642cf
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/sentence_bert_config.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--sentence_bert_config.json
+  checksum: sha256:fc1993fde0a95c24ec6c022539d41cf6e2f7c9721e5415d6fb6897472a9cd4b7
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/special_tokens_map.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--special_tokens_map.json
+  checksum: sha256:303df45a03609e4ead04bc3dc1536d0ab19b5358db685b6f3da123d05ec200e3
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/tokenizer.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--tokenizer.json
+  checksum: sha256:be50c3628f2bf5bb5e3a7f17b1f74611b2561a3a27eeab05e5aa30f411572037
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/tokenizer_config.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--tokenizer_config.json
+  checksum: sha256:acb92769e8195aabd29b7b2137a9e6d6e25c476a4f15aa4355c233426c61576b
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/vocab.txt
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--vocab.txt
+  checksum: sha256:07eced375cec144d27c900241f3e339478dec958f92fddbc551f295c992038a3
+- download_url: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/1_Pooling/config.json
+  filename: hf--sentence-transformers--all-MiniLM-L6-v2--1_Pooling--config.json
+  checksum: sha256:4be450dde3b0273bb9787637cfbd28fe04a7ba6ab9d36ac48e92b11e350ffc23
+- download_url: https://huggingface.co/qdrant/all-MiniLM-L6-v2-onnx/resolve/main/config.json
+  filename: hf--qdrant--all-MiniLM-L6-v2-onnx--config.json
+  checksum: sha256:1b4d8e2a3988377ed8b519a31d8d31025a25f1c5f8606998e8014111438efcd7
+- download_url: https://huggingface.co/qdrant/all-MiniLM-L6-v2-onnx/resolve/main/model.onnx
+  filename: hf--qdrant--all-MiniLM-L6-v2-onnx--model.onnx
+  checksum: sha256:bbd7b466f6d58e646fdc2bd5fd67b2f5e93c0b687011bd4548c420f7bd46f0c5
+- download_url: https://huggingface.co/qdrant/all-MiniLM-L6-v2-onnx/resolve/main/special_tokens_map.json
+  filename: hf--qdrant--all-MiniLM-L6-v2-onnx--special_tokens_map.json
+  checksum: sha256:5d5b662e421ea9fac075174bb0688ee0d9431699900b90662acd44b2a350503a
+- download_url: https://huggingface.co/qdrant/all-MiniLM-L6-v2-onnx/resolve/main/tokenizer.json
+  filename: hf--qdrant--all-MiniLM-L6-v2-onnx--tokenizer.json
+  checksum: sha256:da0e79933b9ed51798a3ae27893d3c5fa4a201126cef75586296df9b4d2c62a0
+- download_url: https://huggingface.co/qdrant/all-MiniLM-L6-v2-onnx/resolve/main/tokenizer_config.json
+  filename: hf--qdrant--all-MiniLM-L6-v2-onnx--tokenizer_config.json
+  checksum: sha256:bd2e06a5b20fd1b13ca988bedc8763d332d242381b4fbc98f8fead4524158f79
+- download_url: https://huggingface.co/qdrant/all-MiniLM-L6-v2-onnx/resolve/main/vocab.txt
+  filename: hf--qdrant--all-MiniLM-L6-v2-onnx--vocab.txt
+  checksum: sha256:07eced375cec144d27c900241f3e339478dec958f92fddbc551f295c992038a3
+- download_url: https://raw.githubusercontent.com/nltk/nltk_data/gh-pages/packages/tokenizers/punkt.zip
+  filename: nltk--punkt.zip
+  checksum: sha256:51c3078994aeaf650bfc8e028be4fb42b4a0d177d41c012b6a983979653660ec

constraints-aipcc.txt

@@ -0,0 +1 @@
+torch==2.11.0

requirements-build.txt

@@ -0,0 +1,10 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile - --config-file /dev/null --no-sources --index-url https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.5/cpu-ubi9-test/simple/ --python-platform linux --python-version 3.12 --emit-index-url --emit-index-annotation --generate-hashes --no-cache -o requirements-build.txt
+--index-url https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.5/cpu-ubi9-test/simple/
+
+uv-build==0.11.29 \
+    --hash=sha256:5e0ab75518832cad47a20c814cb68bb8c599117877c66b157a89a55907e56ff1 \
+    --hash=sha256:8a698dd58ec5b7e9c91165de5f43798575bc466ec334e3f93734a4df876ea7e6 \
+    --hash=sha256:aa689da63adaec91e4d87e7df72742bfb57844f5d352c8a8bbacd98ebe23e7ad \
+    --hash=sha256:d00fb39395b6814d457420a2d27fb1513976d5c85aaf986f81843b79c6cddacb
+    # from https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.5/cpu-ubi9-test/simple/

requirements-models.txt

@@ -0,0 +1,2 @@
+en-core-web-lg @ https://github.com/explosion/spacy-models/releases/download/en_core_web_lg-3.8.0/en_core_web_lg-3.8.0-py3-none-any.whl \
+    --hash=sha256:293e9547a655b25499198ab15a525b05b9407a75f10255e405e8c3854329ab63