mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-07 08:26:10 +00:00
251 lines
11 KiB
Text
251 lines
11 KiB
Text
# Base images
|
|
ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/python:latest-dev
|
|
ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/python:latest-dev
|
|
ARG PROXY_EXTRAS_SOURCE=published
|
|
# Python version shipped in the Chainguard base image (update when base image changes)
|
|
ARG PYTHON_VERSION=3.14
|
|
|
|
# -----------------
|
|
# Builder Stage
|
|
# -----------------
|
|
FROM $LITELLM_BUILD_IMAGE AS builder
|
|
ARG PROXY_EXTRAS_SOURCE
|
|
ARG PYTHON_VERSION
|
|
WORKDIR /app
|
|
USER root
|
|
|
|
# Install build dependencies with retry logic (includes node for UI build)
|
|
RUN for i in 1 2 3; do \
|
|
apk add --no-cache \
|
|
clang \
|
|
llvm \
|
|
lld \
|
|
gcc \
|
|
git \
|
|
curl \
|
|
linux-headers \
|
|
build-base \
|
|
bash \
|
|
nodejs \
|
|
npm && break || sleep 5; \
|
|
done \
|
|
&& python -m pip install --no-cache-dir --upgrade pip setuptools build wheel cmake setuptools_rust maturin
|
|
|
|
# Configure Rust environment for building Rust-backed Python wheels (tiktoken, etc.)
|
|
ENV CARGO_HOME=/root/.cargo
|
|
ENV PATH=/root/.cargo/bin:$PATH
|
|
# Allow forward-compatible ABI for PyO3-based packages on Python 3.14
|
|
ENV PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
|
|
|
|
RUN curl https://sh.rustup.rs -sSf | sh -s -- -y && \
|
|
rustup default stable
|
|
|
|
# Cache Python dependencies
|
|
COPY requirements.txt .
|
|
|
|
# Install build dependencies needed for git-based packages
|
|
RUN pip install --no-cache-dir hatchling hatch-vcs
|
|
|
|
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ --only-binary=Pillow,tokenizers -r requirements.txt \
|
|
&& PYTHON_MINOR=$(python3 -c "import sys; print(sys.version_info.minor)") \
|
|
&& if [ "$PYTHON_MINOR" -lt 14 ]; then \
|
|
pip wheel --no-cache-dir --wheel-dir=/wheels/ "semantic_router==0.1.11" "aurelio-sdk==0.0.19"; \
|
|
else \
|
|
echo "Skipping semantic_router/aurelio-sdk: not supported on Python 3.14+"; \
|
|
fi \
|
|
&& pip wheel --no-cache-dir --wheel-dir=/wheels/ "PyJWT==2.9.0"
|
|
|
|
# Copy source after dependency layers
|
|
COPY . .
|
|
|
|
# Set non-root flag for build time consistency
|
|
ENV LITELLM_NON_ROOT=true
|
|
|
|
# Build Admin UI using the upstream command order while keeping a single RUN layer
|
|
# NOTE: Do NOT run `npm install -g npm@latest` here — the upgraded binary can
|
|
# contain ARM-specific instructions that crash under QEMU when cross-building
|
|
# for linux/arm64. The system npm from apk is sufficient for building the UI.
|
|
RUN mkdir -p /var/lib/litellm/ui && \
|
|
cd /app/ui/litellm-dashboard && \
|
|
if [ -f "/app/enterprise/enterprise_ui/enterprise_colors.json" ]; then \
|
|
cp /app/enterprise/enterprise_ui/enterprise_colors.json ./ui_colors.json; \
|
|
fi && \
|
|
npm install --legacy-peer-deps && \
|
|
npm run build && \
|
|
cp -r /app/ui/litellm-dashboard/out/* /var/lib/litellm/ui/ && \
|
|
mkdir -p /var/lib/litellm/assets && \
|
|
cp /app/litellm/proxy/logo.jpg /var/lib/litellm/assets/logo.jpg && \
|
|
( cd /var/lib/litellm/ui && \
|
|
for html_file in *.html; do \
|
|
if [ "$html_file" != "index.html" ] && [ -f "$html_file" ]; then \
|
|
folder_name="${html_file%.html}" && \
|
|
mkdir -p "$folder_name" && \
|
|
mv "$html_file" "$folder_name/index.html"; \
|
|
fi; \
|
|
done ) && \
|
|
cd /app/ui/litellm-dashboard && rm -rf ./out
|
|
|
|
# Build litellm wheel and place it in wheels dir (replace any PyPI wheels)
|
|
RUN rm -rf dist/* && python -m build && \
|
|
rm -f /wheels/litellm-*.whl && \
|
|
cp dist/*.whl /wheels/
|
|
|
|
# Optionally build local litellm-proxy-extras wheel
|
|
RUN if [ "$PROXY_EXTRAS_SOURCE" = "local" ]; then \
|
|
cd /app/litellm-proxy-extras && rm -rf dist && python -m build && \
|
|
cp dist/*.whl /wheels/; \
|
|
fi
|
|
|
|
# Pre-cache Prisma binaries in the builder stage
|
|
ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
|
|
PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
|
|
XDG_CACHE_HOME=/app/.cache \
|
|
PATH="/usr/lib/python${PYTHON_VERSION}/site-packages/nodejs/bin:${PATH}"
|
|
|
|
RUN pip install --no-cache-dir prisma==0.11.0 nodejs-wheel-binaries==24.12.0 \
|
|
&& mkdir -p /app/.cache/npm
|
|
|
|
RUN NPM_CONFIG_CACHE=/app/.cache/npm \
|
|
python -c "import prisma.cli.prisma as p; p.ensure_cached()"
|
|
|
|
RUN prisma generate && \
|
|
prisma --version && \
|
|
prisma migrate diff --from-empty --to-schema-datamodel ./schema.prisma --script > /dev/null 2>&1 || true
|
|
|
|
# -----------------
|
|
# Runtime Stage
|
|
# -----------------
|
|
FROM $LITELLM_RUNTIME_IMAGE AS runtime
|
|
ARG PROXY_EXTRAS_SOURCE
|
|
ARG PYTHON_VERSION
|
|
WORKDIR /app
|
|
USER root
|
|
|
|
# Install runtime dependencies with retry
|
|
RUN for i in 1 2 3; do \
|
|
apk upgrade --no-cache && break || sleep 5; \
|
|
done \
|
|
&& for i in 1 2 3; do \
|
|
apk add --no-cache bash openssl ca-certificates-bundle tzdata nodejs npm supervisor && break || sleep 5; \
|
|
done \
|
|
&& npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 \
|
|
&& GLOBAL="$(npm root -g)" \
|
|
&& find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
|
|
rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
|
|
done \
|
|
&& find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
|
|
rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
|
|
done \
|
|
&& find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
|
|
rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
|
|
done \
|
|
&& npm cache clean --force
|
|
|
|
# Copy artifacts from builder
|
|
COPY --from=builder /app/requirements.txt /app/requirements.txt
|
|
COPY --from=builder /app/docker/entrypoint.sh /app/docker/prod_entrypoint.sh /app/docker/
|
|
COPY --from=builder /app/docker/supervisord.conf /etc/supervisord.conf
|
|
COPY --from=builder /app/schema.prisma /app/
|
|
# Copy prisma_migration.py for Helm migrations job compatibility
|
|
COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/prisma_migration.py
|
|
COPY --from=builder /wheels/ /wheels/
|
|
COPY --from=builder /var/lib/litellm/ui /var/lib/litellm/ui
|
|
COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets
|
|
COPY --from=builder /app/.cache /app/.cache
|
|
COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
|
|
COPY --from=builder \
|
|
/usr/lib/python${PYTHON_VERSION}/site-packages/nodejs* \
|
|
/usr/lib/python${PYTHON_VERSION}/site-packages/prisma* \
|
|
/usr/lib/python${PYTHON_VERSION}/site-packages/tomlkit* \
|
|
/usr/lib/python${PYTHON_VERSION}/site-packages/nodeenv* \
|
|
/usr/lib/python${PYTHON_VERSION}/site-packages/
|
|
COPY --from=builder /usr/bin/prisma /usr/bin/prisma
|
|
|
|
# Final runtime environment configuration
|
|
ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
|
|
PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
|
|
HOME=/app \
|
|
LITELLM_NON_ROOT=true \
|
|
XDG_CACHE_HOME=/app/.cache
|
|
|
|
# Install all pre-built wheels (avoids re-cloning git URLs from requirements.txt
|
|
# in a runtime stage that lacks git/gcc/hatchling).
|
|
# First deduplicate: the builder may produce multiple versions of the same package
|
|
# (e.g. PyJWT 2.9.0 + 2.10.1) which causes a pip conflict when installing all at once.
|
|
RUN printf '%s\n' \
|
|
'import os, re' \
|
|
'd = {}' \
|
|
'for f in os.listdir("/wheels/"):' \
|
|
' if not f.endswith(".whl"): continue' \
|
|
' m = re.match(r"([^-]+)-([^-]+)", f)' \
|
|
' if not m: continue' \
|
|
' n = m.group(1).lower()' \
|
|
' v = tuple(int(x) if x.isdigit() else x for x in m.group(2).split("."))' \
|
|
' if n not in d or v > d[n][1]:' \
|
|
' old = d.get(n)' \
|
|
' if old: os.remove("/wheels/" + old[0]); print("Removed", old[0])' \
|
|
' d[n] = (f, v)' \
|
|
' else:' \
|
|
' os.remove("/wheels/" + f); print("Removed", f)' \
|
|
> /tmp/_dedup.py && \
|
|
python3 /tmp/_dedup.py && \
|
|
rm /tmp/_dedup.py && \
|
|
pip install --no-index --find-links=/wheels/ /wheels/*.whl
|
|
|
|
# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
|
|
# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
|
|
# Patch every copy of tar, glob, and brace-expansion inside that tree.
|
|
RUN GLOBAL="$(npm root -g)" && \
|
|
find /usr/lib -path "*/nodejs_wheel/*/node_modules/tar" -type d | while read d; do \
|
|
rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
|
|
done && \
|
|
find /usr/lib -path "*/nodejs_wheel/*/node_modules/glob" -type d | while read d; do \
|
|
rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
|
|
done && \
|
|
find /usr/lib -path "*/nodejs_wheel/*/node_modules/@isaacs/brace-expansion" -type d | while read d; do \
|
|
rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
|
|
done
|
|
|
|
# Permissions, cleanup, and Prisma prep
|
|
# Convert Windows line endings to Unix for entrypoint scripts
|
|
RUN sed -i 's/\r$//' docker/entrypoint.sh && \
|
|
sed -i 's/\r$//' docker/prod_entrypoint.sh && \
|
|
chmod +x docker/entrypoint.sh docker/prod_entrypoint.sh && \
|
|
mkdir -p /nonexistent /.npm /var/lib/litellm/assets /var/lib/litellm/ui && \
|
|
chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent /.npm && \
|
|
pip uninstall jwt -y || true && \
|
|
pip uninstall PyJWT -y || true && \
|
|
pip install --no-index --find-links=/wheels/ PyJWT==2.10.1 --no-cache-dir && \
|
|
rm -rf /wheels && \
|
|
PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
|
|
chown -R nobody:nogroup $PRISMA_PATH && \
|
|
LITELLM_PKG_MIGRATIONS_PATH="$(python -c 'import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))' 2>/dev/null || echo '')/migrations" && \
|
|
[ -n "$LITELLM_PKG_MIGRATIONS_PATH" ] && chown -R nobody:nogroup $LITELLM_PKG_MIGRATIONS_PATH && \
|
|
LITELLM_PROXY_EXTRAS_PATH=$(python -c "import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))" 2>/dev/null || echo "") && \
|
|
chgrp -R 0 $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
|
|
[ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chgrp -R 0 $LITELLM_PROXY_EXTRAS_PATH || true && \
|
|
chmod -R g=u $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
|
|
[ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u $LITELLM_PROXY_EXTRAS_PATH || true && \
|
|
chmod -R g+w $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
|
|
[ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w $LITELLM_PROXY_EXTRAS_PATH || true && \
|
|
chmod -R g+rX $PRISMA_PATH && \
|
|
chmod -R g+rX /app/.cache && \
|
|
mkdir -p /tmp/.npm /nonexistent /.npm
|
|
|
|
# Switch to non-root user for runtime
|
|
USER nobody
|
|
|
|
# Generate Prisma client as nobody user to ensure correct file ownership
|
|
RUN prisma generate
|
|
|
|
# Prisma runtime knobs for offline containers
|
|
ENV PRISMA_SKIP_POSTINSTALL_GENERATE=1 \
|
|
PRISMA_HIDE_UPDATE_MESSAGE=1 \
|
|
PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING=1 \
|
|
NPM_CONFIG_CACHE=/app/.cache/npm \
|
|
NPM_CONFIG_PREFER_OFFLINE=true \
|
|
PRISMA_OFFLINE_MODE=true
|
|
|
|
EXPOSE 4000/tcp
|
|
ENTRYPOINT ["/app/docker/prod_entrypoint.sh"]
|
|
CMD ["--port", "4000"]
|