brooktrails/gllm
Watch
1
0
Fork
You've already forked gllm
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix: CUDA image security updates, apt caching, and a 13.4 canary build #47

Merged
rcsheets merged 4 commits from feat/cuda-image into main 2026-07-22 07:01:18 +00:00
Conversation 3 Commits 4 Files changed 3 +92 -1
rcsheets commented 2026-07-22 06:45:23 +00:00
Owner
Copy link

Follow-ups to #46 for the CUDA image:

  • Security updates: the runtime stage now runs apt-get upgrade on every build, so the image lands on Ubuntu's current patch level instead of the NVIDIA base's. This clears the scanner findings for libssl3t64/openssl, gzip, libsqlite3-0, libudev1/libsystemd0, perl-base, tar, libtinfo6/liblzma5, and the ncurses family (verified in a local build: openssl 3.0.13-0ubuntu3.11, tar 1.35+dfsg-3ubuntu0.3, ...). No pinned package list to rot.
  • apt proxy: CI passes an APT_PROXY build arg pointing at the cluster apt-cache, so the upgrade downloads are cached like the runner's own apt traffic. The proxy config is removed in the same layer and verified absent from the shipped image; local builds without the arg go direct.
  • CUDA 13.4 canary: a continue-on-error, build-only step that builds Dockerfile.cuda against 13.4.0-devel/-runtime. No 13.4 tags exist on Docker Hub yet, so it fails harmlessly for now; once it goes green it proves the build against the next CUDA release before we bump the shipped CUDA_VERSION/CUDA_MM defaults. Never tagged for the registry or pushed.

🤖 Generated with Claude Code

Follow-ups to #46 for the CUDA image: - **Security updates**: the runtime stage now runs `apt-get upgrade` on every build, so the image lands on Ubuntu's current patch level instead of the NVIDIA base's. This clears the scanner findings for libssl3t64/openssl, gzip, libsqlite3-0, libudev1/libsystemd0, perl-base, tar, libtinfo6/liblzma5, and the ncurses family (verified in a local build: openssl 3.0.13-0ubuntu3.11, tar 1.35+dfsg-3ubuntu0.3, ...). No pinned package list to rot. - **apt proxy**: CI passes an `APT_PROXY` build arg pointing at the cluster apt-cache, so the upgrade downloads are cached like the runner's own apt traffic. The proxy config is removed in the same layer and verified absent from the shipped image; local builds without the arg go direct. - **CUDA 13.4 canary**: a `continue-on-error`, build-only step that builds Dockerfile.cuda against `13.4.0-devel`/`-runtime`. No 13.4 tags exist on Docker Hub yet, so it fails harmlessly for now; once it goes green it proves the build against the next CUDA release before we bump the shipped `CUDA_VERSION`/`CUDA_MM` defaults. Never tagged for the registry or pushed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
The NVIDIA runtime base lags Ubuntu security patches (scanners flagged
libssl3t64/openssl, gzip, libsqlite3-0, libudev1/libsystemd0, perl-base,
tar, liblzma5, and the ncurses family). Upgrade the whole package set at
build time instead of pinning that list, so every rebuild lands on the
current patch level. An APT_PROXY build arg routes the downloads through
a caching proxy when set; the proxy config is removed in the same layer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci: use cluster apt cache for image builds, add CUDA 13.4 canary
All checks were successful
ci / test_and_build (pull_request) Successful in 22s
Details
1b16b01bc9 
Pass APT_PROXY so the CUDA runtime stage's security upgrades go through
the same apt-cache service the runner uses (the buildah build shares the
runner's network namespace under chroot isolation).

The canary step builds Dockerfile.cuda against CUDA 13.4.0 with
continue-on-error: it fails harmlessly until NVIDIA publishes the 13.4
base images, then proves our build works against the next CUDA release
before we bump the shipped defaults. Build-only, never pushed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
pr-reviewer-bot commented 2026-07-22 06:45:25 +00:00
Collaborator
Copy link

Automated review by pr-reviewer v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id r-606705-a25b47
This is an AI-generated review and may contain mistakes.

Status: ✅ Completed

⚠️ The primary review (Mistral Small) failed. The review below is from Claude Sonnet 5, which reviewed the same diff.

✅ Verdict: LGTM — Changes are limited to CI/Docker build hygiene (apt upgrade with proper cleanup, non-blocking canary build), with no secrets, breaking changes, or logic errors found.

Reviewed the diff:

  • Dockerfile.cuda: adds an apt-get upgrade -y step in the runtime stage, gated by an optional APT_PROXY build-arg, with proxy config removed and apt lists cleaned in the same RUN layer (avoids leaking cluster-internal proxy address or leftover apt cache into the shipped image). Looks correctly done — single layer, cleanup included.
  • CI workflow: adds APT_PROXY build-arg to the main cuda build, and a new continue-on-error: true canary build step for CUDA 13.4 that only tags a localhost/ image (not pushed/registry-tagged). This is safe since it can't fail the pipeline and doesn't publish anything.
  • No secrets embedded — the apt-cache URL is an internal cluster service address, not a credential.
  • No changes to shipped defaults (CUDA_VERSION/CUDA_MM), so no breaking change to the production image build path.

Nothing alarming: no accidental credentials, no logic bugs, and the risky-looking new step is explicitly non-blocking and non-publishing.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id `r-606705-a25b47`* *This is an AI-generated review and may contain mistakes.* **Status:** ✅ Completed --- > ⚠️ The primary review (**Mistral Small**) failed. The review below is from **Claude Sonnet 5**, which reviewed the same diff. **✅ Verdict: LGTM** — Changes are limited to CI/Docker build hygiene (apt upgrade with proper cleanup, non-blocking canary build), with no secrets, breaking changes, or logic errors found. Reviewed the diff: - Dockerfile.cuda: adds an `apt-get upgrade -y` step in the runtime stage, gated by an optional `APT_PROXY` build-arg, with proxy config removed and apt lists cleaned in the same RUN layer (avoids leaking cluster-internal proxy address or leftover apt cache into the shipped image). Looks correctly done — single layer, cleanup included. - CI workflow: adds `APT_PROXY` build-arg to the main cuda build, and a new `continue-on-error: true` canary build step for CUDA 13.4 that only tags a `localhost/` image (not pushed/registry-tagged). This is safe since it can't fail the pipeline and doesn't publish anything. - No secrets embedded — the apt-cache URL is an internal cluster service address, not a credential. - No changes to shipped defaults (CUDA_VERSION/CUDA_MM), so no breaking change to the production image build path. Nothing alarming: no accidental credentials, no logic bugs, and the risky-looking new step is explicitly non-blocking and non-publishing.
ci: build the CUDA 13.4 canary from NVIDIA's prerelease apt channel
All checks were successful
ci / test_and_build (pull_request) Successful in 22s
Details
d8ae33304d 
The 13.4.0 base images are not on Docker Hub or nvcr.io yet, but the
release already exists as Debian packages on packages.nvidia.com -- and
its trixie repo matches golang:1.26's distro exactly. The canary now
installs cuda-compiler/cuda-cudart-dev/libcublas-dev from the
prerelease/cuda/13.4.0 suite and compiles the kernels and the cgo link
against them, so the early warning fires today instead of whenever the
container images ship. Verified locally: nvcc 13.4.46 builds the kernels
and links the server.

No runtime stage on purpose: compile+link is the signal, and the
prerelease suite disappears once the release goes GA.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
pr-reviewer-bot commented 2026-07-22 06:57:31 +00:00
Collaborator
Copy link

Automated review by pr-reviewer v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id r-6069db-763f7c
This is an AI-generated review and may contain mistakes.

Status: ✅ Completed

⚠️ The primary review (Mistral Small) failed. The review below is from Claude Sonnet 5, which reviewed the same diff.

✅ Verdict: LGTM — Changes are additive, non-blocking (canary build allowed to fail), and proxy config is properly cleaned up within the same layer — nothing alarming.

Reviewed the diff:

  • Dockerfile.cuda: adds a conditional apt proxy config file, runs apt-get upgrade, then cleans up the proxy config and apt lists in the same RUN layer — proxy config won't leak into the final image layer, which matches the stated intent. Looks fine.
  • build-push.yaml: adds APT_PROXY build-arg pointing to an internal cluster service for the main CUDA build, and a separate continue-on-error: true, build-only canary step for CUDA 13.4 prerelease that's never tagged or pushed to the registry. Failure there is explicitly non-blocking.
  • Dockerfile.cuda-prerelease: new file, installs from NVIDIA's prerelease apt channel, build-only (no runtime stage), not referenced by the push/tag logic in the workflow — consistent with the PR description that it's never shipped.

No secrets, credentials, or large binaries introduced. No obvious logic bugs — the proxy config cleanup happens correctly in the same layer to avoid persisting internal DNS/network details in the image. The canary step is isolated and non-blocking as described. Nothing here looks like it would break existing builds/services; the main runtime image behavior is additive (extra upgrade step) and the new Dockerfile is unused by the release path.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id `r-6069db-763f7c`* *This is an AI-generated review and may contain mistakes.* **Status:** ✅ Completed --- > ⚠️ The primary review (**Mistral Small**) failed. The review below is from **Claude Sonnet 5**, which reviewed the same diff. **✅ Verdict: LGTM** — Changes are additive, non-blocking (canary build allowed to fail), and proxy config is properly cleaned up within the same layer — nothing alarming. Reviewed the diff: - Dockerfile.cuda: adds a conditional apt proxy config file, runs apt-get upgrade, then cleans up the proxy config and apt lists in the same RUN layer — proxy config won't leak into the final image layer, which matches the stated intent. Looks fine. - build-push.yaml: adds APT_PROXY build-arg pointing to an internal cluster service for the main CUDA build, and a separate `continue-on-error: true`, build-only canary step for CUDA 13.4 prerelease that's never tagged or pushed to the registry. Failure there is explicitly non-blocking. - Dockerfile.cuda-prerelease: new file, installs from NVIDIA's prerelease apt channel, build-only (no runtime stage), not referenced by the push/tag logic in the workflow — consistent with the PR description that it's never shipped. No secrets, credentials, or large binaries introduced. No obvious logic bugs — the proxy config cleanup happens correctly in the same layer to avoid persisting internal DNS/network details in the image. The canary step is isolated and non-blocking as described. Nothing here looks like it would break existing builds/services; the main runtime image behavior is additive (extra upgrade step) and the new Dockerfile is unused by the release path.
ci: probe the CUDA 13.4 GA base images alongside the prerelease canary
All checks were successful
ci / test_and_build (pull_request) Successful in 22s
Details
1791be71bb 
The prerelease canary proves our code compiles against 13.4; this
companion step probes 13.4 where it will eventually live -- the shipped
Dockerfile.cuda against nvidia/cuda:13.4.0 on Docker Hub. It fails in
seconds with "manifest unknown" until NVIDIA publishes the images
(continue-on-error, build-only), and the run where it goes green is the
signal to bump the shipped CUDA_VERSION/CUDA_MM defaults and drop both
13.4 steps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
pr-reviewer-bot commented 2026-07-22 07:00:15 +00:00
Collaborator
Copy link

Automated review by pr-reviewer v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id r-606a7f-eaed3f
This is an AI-generated review and may contain mistakes.

Status: ✅ Completed

⚠️ The primary review (Mistral Small) failed. The review below is from Claude Sonnet 5, which reviewed the same diff.

✅ Verdict: LGTM — Changes are limited to CI-only canary steps (continue-on-error, never pushed) and a security-patching apt upgrade layer that properly cleans up its temporary proxy config; nothing risky or breaking found.

Reviewed the diff:

  • Dockerfile.cuda: adds a conditional apt proxy config + apt-get upgrade in the runtime stage, removing the proxy config file and apt lists afterward in the same RUN layer (so it doesn't persist in a layer). This is standard practice and looks correct — no leaked internal proxy address in the final image (single RUN layer ensures it isn't in history).
  • CI workflow: new canary/probe steps use continue-on-error: true and are build-only (tagged localhost/..., never pushed to registry), so they can't break the release pipeline even if 13.4 images don't exist yet. That matches the PR description.
  • Dockerfile.cuda-prerelease: new file, build-only harness, no runtime stage exists on purpose, doesn't get pushed anywhere in CI (only used in the canary step). Uses ADD for a .deb from a URL and dpkg -i's it — acceptable for a non-shipped build-only image, not part of the shipped runtime.
  • No secrets, credentials, or large binaries added. No obvious logic bugs. The apt-cache proxy hostname is an internal cluster service address, not a secret.

Nothing here looks like it would break the shipping build or leak sensitive data. The new steps are correctly isolated as best-effort/non-blocking.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.36.0 | Safety Check | Claude Sonnet 5 | tracking id `r-606a7f-eaed3f`* *This is an AI-generated review and may contain mistakes.* **Status:** ✅ Completed --- > ⚠️ The primary review (**Mistral Small**) failed. The review below is from **Claude Sonnet 5**, which reviewed the same diff. **✅ Verdict: LGTM** — Changes are limited to CI-only canary steps (continue-on-error, never pushed) and a security-patching apt upgrade layer that properly cleans up its temporary proxy config; nothing risky or breaking found. Reviewed the diff: - Dockerfile.cuda: adds a conditional apt proxy config + `apt-get upgrade` in the runtime stage, removing the proxy config file and apt lists afterward in the same RUN layer (so it doesn't persist in a layer). This is standard practice and looks correct — no leaked internal proxy address in the final image (single RUN layer ensures it isn't in history). - CI workflow: new canary/probe steps use `continue-on-error: true` and are build-only (tagged `localhost/...`, never pushed to registry), so they can't break the release pipeline even if 13.4 images don't exist yet. That matches the PR description. - Dockerfile.cuda-prerelease: new file, build-only harness, no runtime stage exists on purpose, doesn't get pushed anywhere in CI (only used in the canary step). Uses ADD for a .deb from a URL and dpkg -i's it — acceptable for a non-shipped build-only image, not part of the shipped runtime. - No secrets, credentials, or large binaries added. No obvious logic bugs. The apt-cache proxy hostname is an internal cluster service address, not a secret. Nothing here looks like it would break the shipping build or leak sensitive data. The new steps are correctly isolated as best-effort/non-blocking.
rcsheets deleted branch feat/cuda-image 2026-07-22 07:01:18 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
brooktrails/gllm!47
No description provided.