mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-22 00:31:44 +00:00
9f3de27fc9
- Update Dockerfile.database to upgrade zlib and busybox packages - Add npm overrides for glob, tar, and diff vulnerabilities in package.json files - Add jaraco-context>=6.1.0 to requirements.txt to fix GHSA-58pv-8j8x-9vj2 - Add CVE-2026-22184 (zlib) to ALLOWED_CVES in security_scans.sh for vulnerabilities without fixes Fixes: - Critical: zlib CVE-2026-22184 (no fix available, added to allowlist) - High: glob (GHSA-5j98-mcp5-4vw2) - fixed via npm overrides - High: jaraco-context (GHSA-58pv-8j8x-9vj2) - fixed via requirements.txt - Medium: tar (GHSA-29xp-372q-xqph) - fixed via npm overrides - Medium: busybox CVE-2025-60876 (no fix available, already in allowlist) - Low: diff (GHSA-73rr-hh4g-fpgx) - fixed via npm overrides
97 lines
2.9 KiB
Text
97 lines
2.9 KiB
Text
# Base image for building
|
|
ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
|
|
|
|
# Runtime image
|
|
ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
|
|
# Builder stage
|
|
FROM $LITELLM_BUILD_IMAGE AS builder
|
|
|
|
# Set the working directory to /app
|
|
WORKDIR /app
|
|
|
|
USER root
|
|
|
|
# Install build dependencies
|
|
RUN apk add --no-cache \
|
|
bash \
|
|
gcc \
|
|
py3-pip \
|
|
python3 \
|
|
python3-dev \
|
|
openssl \
|
|
openssl-dev
|
|
|
|
RUN python -m pip install build
|
|
|
|
# Copy the current directory contents into the container at /app
|
|
COPY . .
|
|
|
|
# Build Admin UI
|
|
# Convert Windows line endings to Unix and make executable
|
|
RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
|
|
|
|
# Build the package
|
|
RUN rm -rf dist/* && python -m build
|
|
|
|
# There should be only one wheel file now, assume the build only creates one
|
|
RUN ls -1 dist/*.whl | head -1
|
|
|
|
# Install the package
|
|
RUN pip install dist/*.whl
|
|
|
|
# install dependencies as wheels
|
|
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
|
|
|
|
# Runtime stage
|
|
FROM $LITELLM_RUNTIME_IMAGE AS runtime
|
|
|
|
# Ensure runtime stage runs as root
|
|
USER root
|
|
|
|
# Install runtime dependencies and upgrade vulnerable packages
|
|
RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
|
|
apk upgrade --no-cache zlib busybox || true
|
|
|
|
WORKDIR /app
|
|
# Copy the current directory contents into the container at /app
|
|
COPY . .
|
|
RUN ls -la /app
|
|
|
|
# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
|
|
COPY --from=builder /app/dist/*.whl .
|
|
COPY --from=builder /wheels/ /wheels/
|
|
|
|
# Install the built wheel using pip; again using a wildcard if it's the only file
|
|
RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
|
|
|
|
# Install semantic_router and aurelio-sdk using script
|
|
# Convert Windows line endings to Unix and make executable
|
|
RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
|
|
|
|
# ensure pyjwt is used, not jwt
|
|
RUN pip uninstall jwt -y
|
|
RUN pip uninstall PyJWT -y
|
|
RUN pip install PyJWT==2.9.0 --no-cache-dir
|
|
|
|
# Build Admin UI (runtime stage)
|
|
# Convert Windows line endings to Unix and make executable
|
|
RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
|
|
|
|
# Generate prisma client
|
|
RUN prisma generate
|
|
# Convert Windows line endings to Unix for entrypoint scripts
|
|
RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
|
|
RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
|
|
EXPOSE 4000/tcp
|
|
|
|
RUN apk add --no-cache supervisor
|
|
COPY docker/supervisord.conf /etc/supervisord.conf
|
|
|
|
# # Set your entrypoint and command
|
|
|
|
|
|
ENTRYPOINT ["docker/prod_entrypoint.sh"]
|
|
|
|
# Append "--detailed_debug" to the end of CMD to view detailed debug logs
|
|
# CMD ["--port", "4000", "--detailed_debug"]
|
|
CMD ["--port", "4000"]
|