Merge f009c0b534 into abade761e0

llama_stack/distribution/build_container.sh

@@ -20,7 +20,7 @@ UV_HTTP_TIMEOUT=${UV_HTTP_TIMEOUT:-500}
 USE_COPY_NOT_MOUNT=${USE_COPY_NOT_MOUNT:-}
 
 # Mount command for cache container .cache, can be overridden by the user if needed
-MOUNT_CACHE=${MOUNT_CACHE:-"--mount=type=cache,id=llama-stack-cache,target=/root/.cache"}
+MOUNT_CACHE=${MOUNT_CACHE:-"--mount=type=cache,id=llama-stack-cache,target=~/.cache"}
 
 # Path to the run.yaml file in the container
 RUN_CONFIG_PATH=/app/run.yaml
@@ -259,6 +259,27 @@ fi
 RUN pip uninstall -y uv
 EOF
 
+# Add non-root user setup before entrypoint
+add_to_container << EOF
+
+# Create group with GID 1001 and user with UID 1001
+RUN groupadd -g 1001 1001 && useradd -u 1001 -g 1001 -M 1001
+
+# Create necessary directories with appropriate permissions for UID 1001
+# Set SELinux context to allow access by non-root user (if SELinux is supported)
+RUN mkdir -p /.llama /.cache && chown -R 1001:1001 /.llama /.cache && chmod -R 775 /.llama /.cache && chmod -R g+w /app && \
+    (command -v chcon >/dev/null 2>&1 && touch /tmp/selinux_test && chcon -t container_file_t /tmp/selinux_test 2>/dev/null && chcon -R -t container_file_t /.llama /.cache 2>/dev/null && rm -f /tmp/selinux_test || true)
+
+# Set the Llama Stack config directory environment variable to use /.llama
+ENV LLAMA_STACK_CONFIG_DIR=/.llama
+
+# This prevents dual storage while keeping /app as working directory for CI compatibility
+ENV HOME=/
+
+# Switch to non-root user (UID 1001 directly)
+USER 1001
+EOF
+
 # If a run config is provided, we use the --config flag
 if [[ -n "$run_config" ]]; then
   add_to_container << EOF
@@ -271,12 +292,6 @@ ENTRYPOINT ["python", "-m", "llama_stack.distribution.server.server", "--templat
 EOF
 fi
 
-# Add other require item commands genearic to all containers
-add_to_container << EOF
-
-RUN mkdir -p /.llama /.cache && chmod -R g+rw /app /.llama /.cache
-EOF
-
 printf "Containerfile created successfully in %s/Containerfile\n\n" "$TEMP_DIR"
 cat "$TEMP_DIR"/Containerfile
 printf "\n"

llama_stack/templates/meta-reference-gpu/doc_template.md

@@ -71,7 +71,7 @@ docker run \
   --pull always \
   --gpu all \
   -p $LLAMA_STACK_PORT:$LLAMA_STACK_PORT \
-  -v ~/.llama:/root/.llama \
+  -v ~/.llama:/.llama \
   llamastack/distribution-{{ name }} \
   --port $LLAMA_STACK_PORT \
   --env INFERENCE_MODEL=meta-llama/Llama-3.2-3B-Instruct
@@ -85,7 +85,7 @@ docker run \
   --pull always \
   --gpu all \
   -p $LLAMA_STACK_PORT:$LLAMA_STACK_PORT \
-  -v ~/.llama:/root/.llama \
+  -v ~/.llama:/.llama \
   llamastack/distribution-{{ name }} \
   --port $LLAMA_STACK_PORT \
   --env INFERENCE_MODEL=meta-llama/Llama-3.2-3B-Instruct \

llama_stack/templates/nvidia/doc_template.md

@@ -117,9 +117,9 @@ docker run \
   -it \
   --pull always \
   -p $LLAMA_STACK_PORT:$LLAMA_STACK_PORT \
-  -v ./run.yaml:/root/my-run.yaml \
+  -v ./run.yaml:/.llama/my-run.yaml \
   llamastack/distribution-{{ name }} \
-  --config /root/my-run.yaml \
+  --config /.llama/my-run.yaml \
   --port $LLAMA_STACK_PORT \
   --env NVIDIA_API_KEY=$NVIDIA_API_KEY
 ```