mirror of
https://github.com/BerriAI/litellm.git
synced 2026-11-03 07:23:33 +00:00
e34f7e8c4a
* build(docker): move to newer wolfi-base and nginx base images
Bump the pinned wolfi-base digest in every Wolfi Dockerfile to 360896ef, which
ships brotli 1.2.1-r1 and ca-certificates-bundle 20260909-r3. The previous
digest already carried libbrotli 1.2.0-r6 as an OpenSSL dependency, and
`apk add --no-cache` never upgrades a package the base already has
Move the UI image to nginx 1.31.8-alpine3.24, whose CA bundle is the 20261020
Mozilla set, and upgrade brotli-libs in its runtime stage since no nginx
digest ships 1.2.1 yet
* build(docker): copy only runtime files into the gateway, backend and migrations images
The component runtime stages copied the builder's whole /app, which is the
entire repository plus build output: six lockfiles, helm, terraform, docs,
.env.example and the Rust build tree. Measured at runtime with an audit hook
on a booted container, the gateway reads only gateway/, litellm/ and
enterprise/ from /app, the backend only backend/, litellm/ and enterprise/,
and the migrations job only litellm/ and run.py. The pyproject.toml read is
prisma-python's optional [tool.prisma] lookup, which ours does not define
Copy just those, plus .venv, the entrypoint script and schema.prisma for the
gateway and backend. PYTHONPATH=/app and the in-Dockerfile asserts are
unchanged
(cherry picked from commit dddbaa803d)
48 lines
1.5 KiB
Docker
48 lines
1.5 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# UI container — Next.js static export served by nginx.
|
|
|
|
ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
|
|
ARG NGINX_VERSION=1.31.8-alpine3.24@sha256:1ef7ca94d7879df82421428ce13bd1eaa412404953859cf7a5b6512c25e67a60
|
|
|
|
# ---------- builder ----------
|
|
FROM ${UI_BUILD_IMAGE} AS builder
|
|
|
|
ENV NEXT_TELEMETRY_DISABLED=1 \
|
|
npm_config_fund=false \
|
|
npm_config_audit=false
|
|
|
|
WORKDIR /app
|
|
|
|
# Layer the lockfile-only install above the source copy so source-only
|
|
# edits don't bust the install cache.
|
|
COPY ui/litellm-dashboard/package.json ui/litellm-dashboard/package-lock.json ./
|
|
COPY ui/litellm-dashboard/vendor/ ./vendor/
|
|
RUN --mount=type=cache,target=/root/.npm \
|
|
npm ci --prefer-offline
|
|
|
|
COPY ui/litellm-dashboard/ ./
|
|
RUN npm run build
|
|
|
|
# ---------- runtime ----------
|
|
FROM nginx:${NGINX_VERSION} AS runtime
|
|
|
|
RUN apk upgrade --no-cache brotli-libs
|
|
|
|
# Drop the upstream default :80 server; we own the config.
|
|
RUN rm -f /etc/nginx/conf.d/default.conf
|
|
|
|
# Static export → web root.
|
|
COPY --from=builder /app/out /usr/share/nginx/html
|
|
|
|
# Runtime backend discovery config.
|
|
COPY ui/docker-entrypoint.d/40-litellm-runtime-config.sh /docker-entrypoint.d/
|
|
|
|
# Routing rules — see ui/nginx.conf for the full description.
|
|
COPY ui/nginx.conf /etc/nginx/nginx.conf
|
|
|
|
EXPOSE 3000/tcp
|
|
|
|
# nginx as PID 1 in foreground; respects SIGTERM out of the box, so
|
|
# no tini/dumb-init wrapper needed.
|
|
CMD ["nginx", "-g", "daemon off;"]
|