mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-07 08:26:10 +00:00
4e8e4a7162
The build_from_pip image ran a bare `prisma generate`, so prisma recorded absolute engine paths under $HOME/.cache, which is /root/.cache in that build. /root is mode 0700 on python:3.13-slim, so any runtime uid other than 0 gets EACCES just traversing it and the proxy dies during prisma client initialisation. That is exactly the shape a securityContext with runAsUser produces. Generate under a fixed /opt/prisma and chmod it a+rX, matching what the shipped images already do, and pin PRISMA_BINARY_CACHE_DIR at runtime so the client resolves the baked engines instead of looking under $HOME. A build-time assertion fails the build if any recorded engine path lands outside the pinned prefix, since the original breakage was silent at build time and only surfaced as a runtime crash for non-root users.
61 lines
2.2 KiB
Text
61 lines
2.2 KiB
Text
ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
|
|
FROM $UV_IMAGE AS uvbin
|
|
|
|
FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
|
|
|
|
ARG LITELLM_VERSION=1.83.0
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=uvbin /uv /usr/local/bin/uv
|
|
COPY --from=uvbin /uvx /usr/local/bin/uvx
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends gcc libffi-dev nodejs npm && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
|
|
UV_LINK_MODE=copy \
|
|
PATH="/app/.venv/bin:${PATH}"
|
|
|
|
COPY schema.prisma .
|
|
|
|
# This image is specifically for validating/installing the published PyPI
|
|
# artifact, not the checked-out source tree.
|
|
# Keep the moved proxy-runtime packages explicit until the published PyPI
|
|
# artifact includes that extra; newer releases will simply dedupe these.
|
|
RUN uv venv --python python && \
|
|
uv pip install --python /app/.venv/bin/python \
|
|
"litellm[proxy,proxy-runtime]==${LITELLM_VERSION}" \
|
|
"google-cloud-aiplatform==1.133.0" \
|
|
"google-genai==1.37.0" \
|
|
"anthropic[vertex]==0.84.0" \
|
|
"grpcio==1.78.0" \
|
|
"prometheus-client==0.20.0" \
|
|
"langfuse==2.59.7" \
|
|
"opentelemetry-api==1.28.0" \
|
|
"opentelemetry-sdk==1.28.0" \
|
|
"opentelemetry-exporter-otlp==1.28.0" \
|
|
"ddtrace==4.11.0" \
|
|
"sentry-sdk==2.21.0" \
|
|
"mangum==0.17.0" \
|
|
"azure-ai-contentsafety==1.0.0" \
|
|
"azure-storage-file-datalake==12.20.0" \
|
|
"pypdf==6.7.5" \
|
|
"llm-sandbox==0.3.31" \
|
|
"detect-secrets==1.5.0" \
|
|
"prisma==0.11.0" \
|
|
"openai==2.24.0"
|
|
|
|
RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
|
|
npm_config_cache=/root/.npm \
|
|
prisma generate --schema=./schema.prisma && \
|
|
chmod -R a+rX /opt/prisma && \
|
|
python -c "import sys; from prisma.client import BINARY_PATHS; bad = sorted(p for group in BINARY_PATHS.model_dump().values() for p in group.values() if not p.startswith('/opt/prisma/')); sys.exit('prisma engines baked outside /opt/prisma: %r' % bad) if bad else None"
|
|
|
|
ENV PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries
|
|
|
|
EXPOSE 4000/tcp
|
|
|
|
ENTRYPOINT ["litellm"]
|
|
CMD ["--port", "4000"]
|