phoenix-oss/llama-stack-mirror
0
0
Fork 1
mirror of https://github.com/meta-llama/llama-stack.git synced 2025-07-29 15:23:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: make Distribution container images running be rootless in Llama Stack

Browse source
This commit is contained in:
r3v5 2025-07-21 10:26:09 +01:00
parent 6ab5760a1b
commit b9b24fbf94
No known key found for this signature in database
GPG key ID: 7758B9F272DE67D9
1 changed files with 19 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

25
llama_stack/distribution/build_container.sh
View file

@ -259,6 +259,25 @@ fi
RUN pip uninstall -y uv RUN pip uninstall -y uv
EOF EOF
# Add non-root user setup before entrypoint
add_to_container << EOF
# Create group with GID 1001 and user with UID 1001
RUN groupadd -g 1001 appgroup && useradd -u 1001 -g appgroup -M appuser
# Create necessary directories with appropriate permissions for UID 1001
RUN mkdir -p /.llama /.cache && chown -R 1001:1001 /.llama /.cache && chmod -R 775 /.llama /.cache && chmod -R g+w /app
# Set the Llama Stack config directory environment variable to use /.llama
ENV LLAMA_STACK_CONFIG_DIR=/.llama
# This prevents dual storage while keeping /app as working directory for CI compatibility
ENV HOME=/
# Switch to non-root user (UID 1001 directly)
USER 1001
EOF
# If a run config is provided, we use the --config flag # If a run config is provided, we use the --config flag
if [[ -n "$run_config" ]]; then if [[ -n "$run_config" ]]; then
add_to_container << EOF add_to_container << EOF
@ -271,12 +290,6 @@ ENTRYPOINT ["python", "-m", "llama_stack.distribution.server.server", "--templat
EOF EOF
fi fi
# Add other require item commands genearic to all containers
add_to_container << EOF
RUN mkdir -p /.llama /.cache && chmod -R g+rw /app /.llama /.cache
EOF
printf "Containerfile created successfully in %s/Containerfile\n\n" "$TEMP_DIR" printf "Containerfile created successfully in %s/Containerfile\n\n" "$TEMP_DIR"
cat "$TEMP_DIR"/Containerfile cat "$TEMP_DIR"/Containerfile
printf "\n" printf "\n"