build: normalize install tree ownership and permissions (#8803)

Author: mattwittwer

build.py

@@ -1167,10 +1167,10 @@ def create_dockerfile_linux(
 
     df += f"""
 WORKDIR /opt
-COPY --chown=1000:1000 build/install tritonserver
+COPY build/install tritonserver
 
 WORKDIR /opt/tritonserver
-COPY --chown=1000:1000 NVIDIA_Deep_Learning_Container_License.pdf .
+COPY NVIDIA_Deep_Learning_Container_License.pdf .
 RUN find /opt/tritonserver/python -maxdepth 1 -type f -name \\
     "tritonserver-*.whl" | xargs -I {{}} pip install --upgrade {{}}[{FLAGS.triton_wheels_dependencies_group}] && \\
     find /opt/tritonserver/python -maxdepth 1 -type f -name \\
@@ -1185,7 +1185,7 @@ def create_dockerfile_linux(
             df += """
 LABEL com.amazonaws.sagemaker.capabilities.accept-bind-to-port=true
 LABEL com.amazonaws.sagemaker.capabilities.multi-models=true
-COPY --chown=1000:1000 docker/sagemaker/serve /usr/bin/.
+COPY docker/sagemaker/serve /usr/bin/.
 """
     # This is required since libcublasLt.so is not present during the build
     # stage of the PyTorch backend
@@ -1248,8 +1248,9 @@ def dockerfile_prepare_container_linux(argmap, backends, enable_gpu, target_mach
 ENV TRITON_SERVER_GPU_ENABLED    {gpu_enabled}
 
 # Create a user that can be used to run triton as
-# non-root. Make sure that this user to given ID 1000. All server
-# artifacts copied below are assign to this user.
+# non-root. Make sure that this user is given ID 1000. Server
+# artifacts copied below remain owned by root; the triton-server
+# user reads and executes them via standard group/other permissions.
 ENV TRITON_SERVER_USER=triton-server
 RUN userdel tensorrt-server > /dev/null 2>&1 || true \\
       && userdel ubuntu > /dev/null 2>&1 || true \\
@@ -2115,8 +2116,8 @@ def cibase_build(
 
 
 def finalize_build(cmake_script, install_dir, ci_dir):
-    cmake_script.cmd(f"chmod -R a+rw {install_dir}")
-    cmake_script.cmd(f"chmod -R a+rw {ci_dir}")
+    cmake_script.cmd(f"chmod -R u+rwX,go+rX,go-w {install_dir}")
+    cmake_script.cmd(f"chmod -R u+rwX,go+rX,go-w {ci_dir}")
 
 
 def enable_all():

compose.py

@@ -98,12 +98,12 @@ def start_dockerfile(ddir, images, argmap, dockerfile_name, backends):
     # Copy over files
     df += """
 WORKDIR /opt/tritonserver
-COPY --chown=1000:1000 --from=full /opt/tritonserver/LICENSE .
-COPY --chown=1000:1000 --from=full /opt/tritonserver/TRITON_VERSION .
-COPY --chown=1000:1000 --from=full /opt/tritonserver/NVIDIA_Deep_Learning_Container_License.pdf .
-COPY --chown=1000:1000 --from=full /opt/tritonserver/bin bin/
-COPY --chown=1000:1000 --from=full /opt/tritonserver/lib lib/
-COPY --chown=1000:1000 --from=full /opt/tritonserver/include include/
+COPY --from=full /opt/tritonserver/LICENSE .
+COPY --from=full /opt/tritonserver/TRITON_VERSION .
+COPY --from=full /opt/tritonserver/NVIDIA_Deep_Learning_Container_License.pdf .
+COPY --from=full /opt/tritonserver/bin bin/
+COPY --from=full /opt/tritonserver/lib lib/
+COPY --from=full /opt/tritonserver/include include/
 """
     with open(os.path.join(ddir, dockerfile_name), "w") as dfile:
         dfile.write(df)
@@ -112,47 +112,32 @@ def start_dockerfile(ddir, images, argmap, dockerfile_name, backends):
 def add_requested_backends(ddir, dockerfile_name, backends):
     df = "# Copying over backends \n"
     for backend in backends:
-        df += """COPY --chown=1000:1000 --from=full /opt/tritonserver/backends/{} /opt/tritonserver/backends/{}
+        df += """COPY --from=full /opt/tritonserver/backends/{} /opt/tritonserver/backends/{}
 """.format(
             backend, backend
         )
-    if len(backends) > 0:
-        df += """
-# Top-level /opt/tritonserver/backends not copied so need to explicitly set permissions here
-RUN chown triton-server:triton-server /opt/tritonserver/backends
-"""
     with open(os.path.join(ddir, dockerfile_name), "a") as dfile:
         dfile.write(df)
 
 
 def add_requested_repoagents(ddir, dockerfile_name, repoagents):
     df = "#  Copying over repoagents \n"
     for ra in repoagents:
-        df += """COPY --chown=1000:1000 --from=full /opt/tritonserver/repoagents/{} /opt/tritonserver/repoagents/{}
+        df += """COPY --from=full /opt/tritonserver/repoagents/{} /opt/tritonserver/repoagents/{}
 """.format(
             ra, ra
         )
-    if len(repoagents) > 0:
-        df += """
-# Top-level /opt/tritonserver/repoagents not copied so need to explicitly set permissions here
-RUN chown triton-server:triton-server /opt/tritonserver/repoagents
-"""
     with open(os.path.join(ddir, dockerfile_name), "a") as dfile:
         dfile.write(df)
 
 
 def add_requested_caches(ddir, dockerfile_name, caches):
     df = "#  Copying over caches \n"
     for cache in caches:
-        df += """COPY --chown=1000:1000 --from=full /opt/tritonserver/caches/{} /opt/tritonserver/caches/{}
+        df += """COPY --from=full /opt/tritonserver/caches/{} /opt/tritonserver/caches/{}
 """.format(
             cache, cache
         )
-    if len(caches) > 0:
-        df += """
-# Top-level /opt/tritonserver/caches not copied so need to explicitly set permissions here
-RUN chown triton-server:triton-server /opt/tritonserver/caches
-"""
     with open(os.path.join(ddir, dockerfile_name), "a") as dfile:
         dfile.write(df)
 
@@ -163,7 +148,7 @@ def end_dockerfile(ddir, dockerfile_name, argmap):
     if argmap["SAGEMAKER_ENDPOINT"]:
         df += """
 LABEL com.amazonaws.sagemaker.capabilities.accept-bind-to-port=true
-COPY --chown=1000:1000 --from=full /usr/bin/serve /usr/bin/.
+COPY --from=full /usr/bin/serve /usr/bin/.
 """
     with open(os.path.join(ddir, dockerfile_name), "a") as dfile:
         dfile.write(df)