From 3eef9fec3b8f54fdca2adf9dc501e95ed0f41f48 Mon Sep 17 00:00:00 2001 From: BacLuc Date: Fri, 17 Jul 2026 09:12:59 +0200 Subject: [PATCH] feat(Dockerfile.non_root): support randomized user id This is the default seccomp profile on openshift clusters. As documented in https://docs.redhat.com/en/documentation/openshift_container_platform/3.11/html/creating_images/creating-images-guidelines#use-uid Files and directories need to have group 0 in which the random user id will be part of at runtime. Writeable paths need group write permission. Pushed a build of this image here: ghcr.io/bacluc/litellm-non_root-direct:1.92.0 --- docker/Dockerfile.non_root | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root index 1883e87be60..995ef164854 100644 --- a/docker/Dockerfile.non_root +++ b/docker/Dockerfile.non_root @@ -158,11 +158,12 @@ RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \ LITELLM_PKG_MIGRATIONS_PATH="$(python -c 'import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))' 2>/dev/null || echo '')/migrations" && \ [ -n "$LITELLM_PKG_MIGRATIONS_PATH" ] && chown -R nobody:nogroup "$LITELLM_PKG_MIGRATIONS_PATH" || true && \ LITELLM_PROXY_EXTRAS_PATH=$(python -c "import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))" 2>/dev/null || echo "") && \ - chgrp -R 0 "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \ + chgrp -R 0 /app "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \ [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chgrp -R 0 "$LITELLM_PROXY_EXTRAS_PATH" || true && \ chmod -R g=u "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \ [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u "$LITELLM_PROXY_EXTRAS_PATH" || true && \ - chmod -R g+w "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \ + PYTHON_SITE_PACKAGES=$(python -c "import sysconfig; print(sysconfig.get_paths()['purelib'])") && \ + chmod -R g+w "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache "$PYTHON_SITE_PACKAGES/prisma" && \ [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w "$LITELLM_PROXY_EXTRAS_PATH" || true && \ chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache