litellm/docker/build_from_pip
Yassin Kortam 4e8e4a7162
fix(docker): bake the pip image's prisma engines at a world-readable path (#35976)
The build_from_pip image ran a bare `prisma generate`, so prisma recorded
absolute engine paths under $HOME/.cache, which is /root/.cache in that
build. /root is mode 0700 on python:3.13-slim, so any runtime uid other
than 0 gets EACCES just traversing it and the proxy dies during prisma
client initialisation. That is exactly the shape a securityContext with
runAsUser produces.

Generate under a fixed /opt/prisma and chmod it a+rX, matching what the
shipped images already do, and pin PRISMA_BINARY_CACHE_DIR at runtime so
the client resolves the baked engines instead of looking under $HOME. A
build-time assertion fails the build if any recorded engine path lands
outside the pinned prefix, since the original breakage was silent at
build time and only surfaced as a runtime crash for non-root users.
2026-08-05 12:51:53 -07:00
..
Dockerfile.build_from_pip fix(docker): bake the pip image's prisma engines at a world-readable path (#35976) 2026-08-05 12:51:53 -07:00
litellm_config.yaml ci: run a local fake OpenAI endpoint instead of the shared Railway mock (#30695) 2026-06-17 17:01:13 -07:00
Readme.md (feat) - allow building litellm proxy from pip package (#7633) 2025-01-08 16:36:57 -08:00

Docker to build LiteLLM Proxy from litellm pip package

When to use this ?

If you need to build LiteLLM Proxy from litellm pip package, you can use this Dockerfile as a reference.

Why build from pip package ?

  • If your company has a strict requirement around security / building images you can follow steps outlined here