Dockerfile.gpu

# syntax=docker/dockerfile:1
# check=skip=SecretsUsedInArgOrEnv

# ARG BASE_IMAGE=nvidia/cuda:11.0.3-cudnn8-runtime-ubuntu20.04
# ARG BASE_IMAGE=nvidia/cuda:11.3.1-cudnn8-runtime-ubuntu20.04
ARG BASE_IMAGE=nvidia/cuda:12.0.1-cudnn8-runtime-ubuntu22.04
# ARG BASE_IMAGE=nvidia/cuda:12.6.3-cudnn-runtime-ubuntu24.04
# ARG BASE_IMAGE=nvidia/cuda:13.0.0-cudnn-runtime-ubuntu24.04
# ARG BASE_IMAGE=nvidia/cuda:13.0.0-tensorrt-runtime-ubuntu24.04

ARG DEBIAN_FRONTEND=noninteractive
ARG PROJECT_SLUG="model-python-template"


## Here is the builder image:
FROM ${BASE_IMAGE} AS builder

ARG DEBIAN_FRONTEND
ARG PROJECT_SLUG

ENV	UV_LINK_MODE=copy

ARG PYTHON_VERSION=3.10

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

WORKDIR "/usr/src/${PROJECT_SLUG}"

RUN --mount=type=cache,target=/opt/conda/pkgs,sharing=private \
	--mount=type=cache,target=/root/.cache,sharing=locked \
	_BUILD_TARGET_ARCH=$(uname -m) && \
    echo "BUILDING TARGET ARCHITECTURE: $_BUILD_TARGET_ARCH" && \
	rm -rfv /var/lib/apt/lists/* /var/cache/apt/archives/* /tmp/* && \
	apt-get clean -y && \
	# echo "Acquire::http::Pipeline-Depth 0;" >> /etc/apt/apt.conf.d/99fixbadproxy && \
	# echo "Acquire::http::No-Cache true;" >> /etc/apt/apt.conf.d/99fixbadproxy && \
	# echo "Acquire::BrokenProxy true;" >> /etc/apt/apt.conf.d/99fixbadproxy && \
	apt-get update --fix-missing -o Acquire::CompressionTypes::Order::=gz && \
	apt-get install -y --no-install-recommends \
		ca-certificates \
		build-essential \
		wget && \
	_MINICONDA_VERSION=py310_25.11.1-1 && \
	if [ "${_BUILD_TARGET_ARCH}" == "x86_64" ]; then \
		_MINICONDA_FILENAME=Miniconda3-${_MINICONDA_VERSION}-Linux-x86_64.sh && \
		export _MINICONDA_URL=https://repo.anaconda.com/miniconda/${_MINICONDA_FILENAME}; \
	elif [ "${_BUILD_TARGET_ARCH}" == "aarch64" ]; then \
		_MINICONDA_FILENAME=Miniconda3-${_MINICONDA_VERSION}-Linux-aarch64.sh && \
		export _MINICONDA_URL=https://repo.anaconda.com/miniconda/${_MINICONDA_FILENAME}; \
	else \
		echo "Unsupported platform: ${_BUILD_TARGET_ARCH}" && \
		exit 1; \
	fi && \
	if [ ! -f "/root/.cache/${_MINICONDA_FILENAME}" ]; then \
		wget -nv --show-progress --progress=bar:force:noscroll "${_MINICONDA_URL}" -O "/root/.cache/${_MINICONDA_FILENAME}"; \
	fi && \
	/bin/bash "/root/.cache/${_MINICONDA_FILENAME}" -b -u -p /opt/conda && \
	/opt/conda/condabin/conda tos accept --override-channels \
		-c https://repo.anaconda.com/pkgs/main \
		-c https://repo.anaconda.com/pkgs/r && \
	/opt/conda/condabin/conda config --append channels conda-forge && \
	/opt/conda/condabin/conda update -y conda && \
	/opt/conda/condabin/conda install -y python=${PYTHON_VERSION} pip && \
	/opt/conda/bin/pip install --timeout 60 -U pip uv

COPY ./ ./
RUN	--mount=type=cache,target=/root/.cache,sharing=locked \
	/opt/conda/bin/python -m uv pip install -r ./requirements/requirements.test.txt && \
	/opt/conda/bin/python -m uv pip install -r ./requirements/requirements.build.txt && \
	# /opt/conda/bin/python -m build -w && \
	# /opt/conda/bin/python -m uv pip install ./dist/*.whl && \
	/opt/conda/bin/python -m uv pip install jupyterlab jupyterlab-lsp "python-lsp-server[all]" nvitop

## Here is the base image:
FROM ${BASE_IMAGE} AS base

ARG DEBIAN_FRONTEND
ARG PROJECT_SLUG

## IMPORTANT!: Get hashed password from build-arg!
## echo "USER_PASSWORD123" | openssl passwd -6 -stdin
ARG HASH_PASSWORD="\$6\$E262BgUoc/atUJ.9\$15DcOM.oC8TDlslhRFMvEm4vyx1W7GDrf1Ica0U78q5d5GupC0iNlwa7yP9LzmS3YeaIw5XwONm.1QuArpYu20"
## python -c "from jupyter_server.auth import passwd; print(passwd('USER_PASSWORD123'))"
# ARG JUPYTERLAB_PASSWORD_HASH="argon2:\$argon2id\$v=19\$m=10240,t=10,p=8\$wnIeLsNlGKEyUUTxl1lVSg\$dy9k/D3w95OpTbAJbm3nl5Q+J97cmA/RG4whANSBKZk" # pragma: allowlist secret
ARG UID=1000
ARG GID=11000
ARG USER=user
ARG GROUP=devs
ARG WORKSPACES_DIR="/home/${USER}/workspaces"
ARG PROJECTS_DIR="${WORKSPACES_DIR}/projects"
ARG PROJECT_DIR="${PROJECTS_DIR}/${PROJECT_SLUG}"
ARG SSH_PORT=22
ARG JUPYTERLAB_PORT=8888

ENV UID=${UID} \
	GID=${GID} \
	USER=${USER} \
	GROUP=${GROUP} \
	PROJECT_SLUG=${PROJECT_SLUG} \
	WORKSPACES_DIR=${WORKSPACES_DIR} \
	PROJECTS_DIR=${PROJECTS_DIR} \
	PROJECT_DIR=${PROJECT_DIR} \
	SSH_PORT=${SSH_PORT} \
	JUPYTERLAB_PORT=${JUPYTERLAB_PORT} \
	PYTHONIOENCODING=utf-8 \
	PYTHONUNBUFFERED=1 \
	PATH="/opt/conda/bin:${PATH}"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN --mount=type=secret,id=HASH_PASSWORD \
	rm -vrf /var/lib/apt/lists/* /var/cache/apt/archives/* /tmp/* /root/.cache/* && \
	apt-get clean -y && \
	apt-get update --fix-missing -o Acquire::CompressionTypes::Order::=gz && \
	apt-get install -y --no-install-recommends \
		sudo \
		gosu \
		ca-certificates \
		locales \
		tzdata \
		procps \
		iputils-ping \
		net-tools \
		iproute2 \
		openssh-server \
		wget \
		curl \
		rsync \
		git \
		htop \
		ncdu \
		duf \
		neofetch \
		# fastfetch \
		# zsh \
		vim \
		nano && \
	apt-get clean -y && \
	sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \
	sed -i -e 's/# en_AU.UTF-8 UTF-8/en_AU.UTF-8 UTF-8/' /etc/locale.gen && \
	sed -i -e 's/# ko_KR.UTF-8 UTF-8/ko_KR.UTF-8 UTF-8/' /etc/locale.gen && \
	dpkg-reconfigure --frontend=noninteractive locales && \
	update-locale LANG=en_US.UTF-8 && \
	echo "LANGUAGE=en_US.UTF-8" >> /etc/default/locale && \
	echo "LC_ALL=en_AU.UTF-8" >> /etc/default/locale && \
	addgroup --gid ${GID} ${GROUP} && \
	useradd -lmN -d "/home/${USER}" -s /bin/bash -g ${GROUP} -G sudo -u ${UID} ${USER} && \
	# usermod -l ${USER} -m -d /home/${USER} -s /bin/bash -g ${GROUP} -aG sudo ubuntu && \
	# echo "${USER} ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${USER}" && \
	# chmod 0440 "/etc/sudoers.d/${USER}" && \
	if [ -f "/run/secrets/HASH_PASSWORD" ]; then \
		echo "Using hashed password from secret: /run/secrets/HASH_PASSWORD"; \
		echo -e "${USER}:$(cat /run/secrets/HASH_PASSWORD)" | chpasswd -e; \
	else \
		echo "Using hashed password from build argument: HASH_PASSWORD"; \
		echo -e "${USER}:${HASH_PASSWORD}" | chpasswd -e; \
	fi && \
	echo -e "\nalias ls='ls -aF --group-directories-first --color=auto'" >> /root/.bashrc && \
	echo -e "alias ll='ls -alhF --group-directories-first --color=auto'\n" >> /root/.bashrc && \
	echo -e "\numask 0002" >> "/home/${USER}/.bashrc" && \
	echo "alias ls='ls -aF --group-directories-first --color=auto'" >> "/home/${USER}/.bashrc" && \
	echo -e "alias ll='ls -alhF --group-directories-first --color=auto'\n" >> "/home/${USER}/.bashrc" && \
	echo ". /opt/conda/etc/profile.d/conda.sh" >> "/home/${USER}/.bashrc" && \
	echo "conda activate base" >> "/home/${USER}/.bashrc" && \
	ssh-keygen -A && \
	mkdir -pv /run/sshd "/home/${USER}/.jupyter" "${PROJECT_DIR}" && \
	echo "c.ServerApp.ip = '*'" >> "/home/${USER}/.jupyter/jupyter_server_config.py" && \
	echo "c.ServerApp.port = ${JUPYTERLAB_PORT}" >> "/home/${USER}/.jupyter/jupyter_server_config.py" && \
	echo "c.ServerApp.open_browser = False" >> "/home/${USER}/.jupyter/jupyter_server_config.py" && \
	echo "c.ServerApp.allow_origin = '*'" >> "/home/${USER}/.jupyter/jupyter_server_config.py" && \
	# echo "c.IdentityProvider.token = ''" >> "/home/${USER}/.jupyter/jupyter_server_config.py" && \
	# echo "c.PasswordIdentityProvider.hashed_password = u'${JUPYTERLAB_PASSWORD_HASH}'" >> "/home/${USER}/.jupyter/jupyter_server_config.py" && \
	chown -Rc "${USER}:${GROUP}" "/home/${USER}/.jupyter" "${WORKSPACES_DIR}" && \
	find "/home/${USER}/.jupyter" "${PROJECTS_DIR}" -type d -exec chmod -c 770 {} + && \
	find "/home/${USER}/.jupyter" "${PROJECTS_DIR}" -type f -exec chmod -c 660 {} + && \
	find "/home/${USER}/.jupyter" "${PROJECTS_DIR}" -type d -exec chmod -c ug+s {} + && \
	rm -rfv /var/lib/apt/lists/* /var/cache/apt/archives/* /tmp/* /root/.cache/* "/home/${USER}/.cache/*"

ENV	LANG=en_US.UTF-8 \
	LANGUAGE=en_US.UTF-8 \
	LC_ALL=en_AU.UTF-8

COPY --from=builder --chown=${UID}:${GID} /opt/conda /opt/conda


## Here is the final image:
FROM base AS app

WORKDIR "${PROJECT_DIR}"
COPY --chown=${UID}:${GID} ./ ${PROJECT_DIR}
COPY --chown=${UID}:${GID} --chmod=770 ./scripts/docker/*.sh /usr/local/bin/

# EXPOSE ${SSH_PORT} ${JUPYTERLAB_PORT}
# USER ${UID}:${GID}

ENTRYPOINT ["docker-entrypoint.sh"]