mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-11 22:51:28 +00:00
feat(docker): Add Iron Bank base image support (POC)
Add Dockerfile.ironbank using Red Hat UBI9 base images for Iron Bank / FedRAMP compliance. Key changes: - Uses registry.access.redhat.com/ubi9/ubi base images - Installs Python 3.11+ via dnf/microdnf - Follows multi-stage build pattern from main Dockerfile - Adds Iron Bank-compliant labels - Creates non-root user for runtime This is a POC for validation - full Iron Bank submission requires additional hardening and security scanning.
This commit is contained in:
shin-bot-litellm
parent
c8f0d39b4d
commit
b9e27ec2ab
2 changed files with 192 additions and 0 deletions
149
docker/Dockerfile.ironbank
Normal file
149
docker/Dockerfile.ironbank
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
# Iron Bank Compatible Dockerfile for LiteLLM
|
||||
#
|
||||
# This Dockerfile uses Red Hat UBI (Universal Base Image) as a base,
|
||||
# which is compatible with DoD Iron Bank requirements.
|
||||
#
|
||||
# For production Iron Bank submission, replace with:
|
||||
# registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal
|
||||
#
|
||||
# POC uses Docker Hub UBI images as a stand-in for testing.
|
||||
|
||||
# Build stage - using UBI9 with full package set for building
|
||||
ARG LITELLM_BUILD_IMAGE=registry.access.redhat.com/ubi9/ubi:latest
|
||||
ARG LITELLM_RUNTIME_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest
|
||||
|
||||
# ============== Builder Stage ==============
|
||||
FROM $LITELLM_BUILD_IMAGE AS builder
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
USER root
|
||||
|
||||
# Install build dependencies
|
||||
# UBI9 ships with Python 3.9 by default, we need Python 3.11+
|
||||
RUN dnf install -y \
|
||||
python3.11 \
|
||||
python3.11-pip \
|
||||
python3.11-devel \
|
||||
gcc \
|
||||
gcc-c++ \
|
||||
make \
|
||||
openssl \
|
||||
openssl-devel \
|
||||
libffi-devel \
|
||||
git \
|
||||
&& dnf clean all \
|
||||
&& rm -rf /var/cache/dnf
|
||||
|
||||
# Set Python 3.11 as default
|
||||
RUN alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1 \
|
||||
&& alternatives --install /usr/bin/python python /usr/bin/python3.11 1 \
|
||||
&& alternatives --install /usr/bin/pip3 pip3 /usr/bin/pip3.11 1 \
|
||||
&& alternatives --install /usr/bin/pip pip /usr/bin/pip3.11 1
|
||||
|
||||
# Upgrade pip
|
||||
RUN python3.11 -m pip install --upgrade pip setuptools wheel build
|
||||
|
||||
# Copy the current directory contents into the container at /app
|
||||
COPY . .
|
||||
|
||||
# Build Admin UI (skip if enterprise colors not present)
|
||||
RUN chmod +x docker/build_admin_ui_ironbank.sh && ./docker/build_admin_ui_ironbank.sh
|
||||
|
||||
# Build the package
|
||||
RUN rm -rf dist/* && python3.11 -m build
|
||||
|
||||
# Install the package
|
||||
RUN pip3.11 install dist/*.whl
|
||||
|
||||
# Install dependencies as wheels for offline installation in runtime
|
||||
RUN pip3.11 wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
|
||||
|
||||
# Ensure PyJWT is used (not jwt)
|
||||
RUN pip3.11 uninstall jwt -y || true
|
||||
RUN pip3.11 uninstall PyJWT -y || true
|
||||
RUN pip3.11 install PyJWT==2.9.0 --no-cache-dir
|
||||
|
||||
# ============== Runtime Stage ==============
|
||||
FROM $LITELLM_RUNTIME_IMAGE AS runtime
|
||||
|
||||
USER root
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install runtime dependencies using microdnf (minimal package manager for ubi-minimal)
|
||||
RUN microdnf install -y \
|
||||
python3.11 \
|
||||
python3.11-pip \
|
||||
openssl \
|
||||
tzdata \
|
||||
nodejs \
|
||||
npm \
|
||||
libsndfile \
|
||||
shadow-utils \
|
||||
findutils \
|
||||
&& microdnf clean all \
|
||||
&& rm -rf /var/cache/yum
|
||||
|
||||
# Set Python 3.11 as default
|
||||
RUN alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1 \
|
||||
&& alternatives --install /usr/bin/python python /usr/bin/python3.11 1 \
|
||||
&& alternatives --install /usr/bin/pip3 pip3 /usr/bin/pip3.11 1 \
|
||||
&& alternatives --install /usr/bin/pip pip /usr/bin/pip3.11 1
|
||||
|
||||
# Upgrade npm
|
||||
RUN npm install -g npm@latest
|
||||
|
||||
# Copy application files
|
||||
COPY . .
|
||||
|
||||
# Copy the built wheel and dependencies from builder stage
|
||||
COPY --from=builder /app/dist/*.whl .
|
||||
COPY --from=builder /wheels/ /wheels/
|
||||
|
||||
# Install the built wheel and dependencies
|
||||
RUN pip3.11 install *.whl /wheels/* --no-index --find-links=/wheels/ \
|
||||
&& rm -f *.whl \
|
||||
&& rm -rf /wheels
|
||||
|
||||
# Remove test files from dependencies to reduce image size
|
||||
RUN find /usr/lib -type f -path "*/tornado/test/*" -delete 2>/dev/null || true \
|
||||
&& find /usr/lib -type d -path "*/tornado/test" -delete 2>/dev/null || true
|
||||
|
||||
# Install semantic_router and aurelio-sdk
|
||||
RUN pip3.11 install semantic_router==0.1.11 --no-deps || true \
|
||||
&& pip3.11 install aurelio-sdk==0.0.19 || true
|
||||
|
||||
# Generate prisma client
|
||||
RUN prisma generate --schema=./litellm/proxy/schema.prisma
|
||||
|
||||
# Prepare entrypoint scripts
|
||||
RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
|
||||
RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
|
||||
|
||||
# Install supervisor for health check separation
|
||||
RUN microdnf install -y supervisor && microdnf clean all || \
|
||||
pip3.11 install supervisor
|
||||
|
||||
COPY docker/supervisord.conf /etc/supervisord.conf
|
||||
|
||||
# Create non-root user for runtime (Iron Bank requirement)
|
||||
RUN groupadd -r litellm && useradd -r -g litellm litellm \
|
||||
&& chown -R litellm:litellm /app
|
||||
|
||||
# Expose the default LiteLLM port
|
||||
EXPOSE 4000/tcp
|
||||
|
||||
# Set the entrypoint
|
||||
ENTRYPOINT ["docker/prod_entrypoint.sh"]
|
||||
|
||||
# Default command
|
||||
CMD ["--port", "4000"]
|
||||
|
||||
# Labels for Iron Bank compliance
|
||||
LABEL maintainer="BerriAI" \
|
||||
vendor="BerriAI" \
|
||||
version="1.0" \
|
||||
description="LiteLLM Proxy - Iron Bank Compatible" \
|
||||
io.k8s.display-name="LiteLLM Proxy" \
|
||||
io.openshift.tags="litellm,llm,proxy,ai"
|
||||
43
docker/build_admin_ui_ironbank.sh
Normal file
43
docker/build_admin_ui_ironbank.sh
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Admin UI build script for Iron Bank / UBI-based images
|
||||
# Uses dnf instead of apt-get/apk
|
||||
|
||||
echo "Current directory:"
|
||||
pwd
|
||||
|
||||
# Only run this step for litellm enterprise
|
||||
if [ ! -f "enterprise/enterprise_ui/enterprise_colors.json" ]; then
|
||||
echo "Admin UI - using default LiteLLM UI"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Building Custom Admin UI..."
|
||||
|
||||
# Install curl using dnf (for RHEL/UBI)
|
||||
if command -v dnf &> /dev/null; then
|
||||
dnf install -y curl nodejs npm
|
||||
elif command -v microdnf &> /dev/null; then
|
||||
microdnf install -y curl nodejs npm
|
||||
else
|
||||
echo "Error: No supported package manager found (dnf/microdnf)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Install nvm and Node.js v18
|
||||
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
|
||||
source ~/.nvm/nvm.sh
|
||||
nvm install v18.17.0
|
||||
nvm use v18.17.0
|
||||
npm install -g npm
|
||||
|
||||
# Copy enterprise colors config
|
||||
cp enterprise/enterprise_ui/enterprise_colors.json ui/litellm-dashboard/ui_colors.json
|
||||
|
||||
# Build the UI
|
||||
cd ui/litellm-dashboard
|
||||
chmod +x ./build_ui.sh
|
||||
./build_ui.sh
|
||||
|
||||
# Return to root directory
|
||||
cd ../..
|
||||
Loading…
Add table
Reference in a new issue