Skip to content

NO-JIRA: refactor(Dockerfile.cpu): wrap multiple RUN commands with bash for improved readability and error handling #2645

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 6, 2025
Merged

NO-JIRA: refactor(Dockerfile.cpu): wrap multiple RUN commands with bash for improved readability and error handling #2645

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3bdff2f
NO-JIRA: refactor(Dockerfile.cpu): wrap multiple RUN commands with ba…
jiridanek Nov 6, 2025
d493a28
fixup hadolint
jiridanek Nov 6, 2025
02d56bb
fixup hadolint
jiridanek Nov 6, 2025
2aed752
fixup fragments.py
jiridanek Nov 6, 2025
35f1815
Update scripts/dockerfile_fragments.py
jiridanek Nov 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
192 changes: 114 additions & 78 deletions codeserver/ubi9-python-3.12/Dockerfile.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,13 +55,15 @@ COPY ${CODESERVER_SOURCE_CODE}/devel_env_setup.sh ./
# Important: Since HOME & USER for the python-312 has been changed,
# we need to ensure the same cache directory is mounted in
# the final stage with the necessary permissions to consume from cache
RUN --mount=type=cache,target=/root/.cache/uv \
pip install --no-cache-dir uv && \
# the devel script is ppc64le and s390x specific - sets up build-time dependencies
source ./devel_env_setup.sh && \
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
UV_LINK_MODE=copy uv pip install --strict --no-deps --refresh --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
RUN --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF'
set -Eeuxo pipefail
pip install --no-cache-dir uv
# the devel script is ppc64le and s390x specific - sets up build-time dependencies
source ./devel_env_setup.sh
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
UV_LINK_MODE=copy uv pip install --strict --no-deps --refresh --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
EOF

# dummy file to make image build wait for this stage
RUN touch /tmp/control
Expand All @@ -85,19 +87,29 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
# Problem: The operation would result in removing the following protected packages: systemd
# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
# Solution: --best --skip-broken does not work either, so use --nobest
RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
&& dnf clean all -y
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
dnf clean all -y
EOF

# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
RUN dnf install -y tar perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/dnf
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
dnf install -y tar perl mesa-libGL skopeo
dnf clean all
rm -rf /var/cache/dnf
EOF

# (ARCH-ppc64le): since wheels are compiled from source, we need shared libs available at runtime
RUN --mount=type=cache,from=whl-cache,source=/root/OpenBLAS,target=/OpenBlas,rw \
bash -c ' \
if [[ $(uname -m) == "ppc64le" ]]; then \
PREFIX=/usr/ make install -C /OpenBlas; \
fi '
RUN --mount=type=cache,from=whl-cache,source=/root/OpenBLAS,target=/OpenBlas,rw /bin/bash <<'EOF'
set -Eeuxo pipefail
if [[ $(uname -m) == "ppc64le" ]]; then
PREFIX=/usr/ make install -C /OpenBlas
fi
EOF

# Other apps and tools installed as default user
USER 1001
Expand All @@ -107,10 +119,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
# Install micropipenv and uv to deploy packages from requirements.txt end

# Install the oc client begin
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
rm -f /tmp/openshift-client-linux.tar.gz
EOF

# Install the oc client end

####################
Expand Down Expand Up @@ -157,21 +173,28 @@ COPY --from=rpm-base /tmp/control /dev/null
# Install code-server
# Note: Use cache mounts, bind mounts fail on konflux
# https://redhat-internal.slack.com/archives/C04PZ7H0VA8/p1755628065772589?thread_ts=1755597929.335999&cid=C04PZ7H0VA8
RUN --mount=type=cache,from=rpm-base,source=/tmp/,target=/code-server-rpm/,rw \
# EXPLANATION: dnf installation produces an "unsigned rpm" error from Konflux (Conforma)
# since we're building rpm from source, we will simply unpack it over /
# dnf install -y "/code-server-rpm/code-server-${CODESERVER_VERSION/v/}-${TARGETARCH}.rpm"
# dnf -y clean all --enablerepo='*'
dnf install -y cpio && dnf -y clean all && \
cd / && rpm2cpio "/code-server-rpm/code-server-${CODESERVER_VERSION/v/}-${TARGETARCH}.rpm" | cpio -idmv
RUN --mount=type=cache,from=rpm-base,source=/tmp/,target=/code-server-rpm/,rw /bin/bash <<'EOF'
set -Eeuxo pipefail
# EXPLANATION: dnf installation produces an "unsigned rpm" error from Konflux (Conforma)
# since we're building rpm from source, we will simply unpack it over /
# dnf install -y "/code-server-rpm/code-server-${CODESERVER_VERSION/v/}-${TARGETARCH}.rpm"
# dnf -y clean all --enablerepo='*'
dnf install -y cpio
dnf -y clean all
cd /
rpm2cpio "/code-server-rpm/code-server-${CODESERVER_VERSION/v/}-${TARGETARCH}.rpm" | cpio -idmv
EOF

COPY --chown=1001:0 ${CODESERVER_SOURCE_CODE}/utils utils/

# Create and intall the extensions though build-time on a temporary directory. Later this directory will copied on the `/opt/app-root/src/.local/share/code-server/extensions` via run-code-server.sh file when it starts up.
# https://coder.com/docs/code-server/FAQ#how-do-i-install-an-extension
RUN mkdir -p /opt/app-root/extensions-temp && \
code-server --install-extension /opt/app-root/bin/utils/ms-python.python-2025.14.0.vsix --extensions-dir /opt/app-root/extensions-temp && \
code-server --install-extension /opt/app-root/bin/utils/ms-toolsai.jupyter-2025.8.0.vsix --extensions-dir /opt/app-root/extensions-temp
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
mkdir -p /opt/app-root/extensions-temp
code-server --install-extension /opt/app-root/bin/utils/ms-python.python-2025.14.0.vsix --extensions-dir /opt/app-root/extensions-temp
code-server --install-extension /opt/app-root/bin/utils/ms-toolsai.jupyter-2025.8.0.vsix --extensions-dir /opt/app-root/extensions-temp
EOF

# Install NGINX to proxy code-server and pass probes check
ENV APP_ROOT=/opt/app-root
Expand All @@ -188,10 +211,13 @@ ENV NGINX_CONFIGURATION_PATH=${APP_ROOT}/etc/nginx.d \
NGINX_PERL_MODULE_PATH=${APP_ROOT}/etc/perl

# Modules does not exist
RUN INSTALL_PKGS="bind-utils nginx nginx-mod-stream nginx-mod-http-perl httpd" && \
dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \
rpm -V $INSTALL_PKGS && \
dnf -y clean all --enablerepo='*'
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
INSTALL_PKGS="bind-utils nginx nginx-mod-stream nginx-mod-http-perl httpd"
dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS
rpm -V $INSTALL_PKGS
dnf -y clean all --enablerepo='*'
EOF

# Configure httpd for CGI processing
COPY --chown=1001:0 ${CODESERVER_SOURCE_CODE}/httpd/httpd.conf /etc/httpd/conf/httpd.conf
Expand All @@ -216,34 +242,37 @@ COPY ${CODESERVER_SOURCE_CODE}/nginx/api/ /opt/app-root/api/
# UID=1001 && GID=0
# UID=<any>&& GID=0
# UID=1001 && GID=<any>
RUN sed -i -f ${NGINX_APP_ROOT}/nginxconf.sed ${NGINX_CONF_PATH} && \
mkdir -p ${NGINX_APP_ROOT}/etc/nginx.d/ && \
mkdir -p ${NGINX_APP_ROOT}/etc/nginx.default.d/ && \
mkdir -p ${NGINX_APP_ROOT}/api/ && \
mkdir -p ${NGINX_CONTAINER_SCRIPTS_PATH}/nginx-start && \
mkdir -p ${NGINX_LOG_PATH} && \
mkdir -p ${NGINX_PERL_MODULE_PATH} && \
# Create httpd directories and set permissions
mkdir -p /var/log/httpd /var/run/httpd /etc/httpd/logs && \
chown -R 1001:0 ${NGINX_CONF_PATH} && \
chown -R 1001:0 ${NGINX_APP_ROOT}/etc && \
chown -R 1001:0 ${NGINX_CONTAINER_SCRIPTS_PATH}/nginx-start && \
chown -R 1001:0 /var/lib/nginx /var/log/nginx /run && \
chown -R 1001:0 /var/log/httpd /var/run/httpd /etc/httpd/logs && \
chmod ug+rw ${NGINX_CONF_PATH} && \
chmod -R ug+rwX ${NGINX_APP_ROOT}/etc && \
chmod -R ug+rwX ${NGINX_CONTAINER_SCRIPTS_PATH}/nginx-start && \
chmod -R ug+rwX /var/lib/nginx /var/log/nginx /run && \
chmod -R ug+rwX /var/log/httpd /var/run/httpd /etc/httpd/logs && \
# Make CGI script executable
chmod +x /opt/app-root/api/kernels/access.cgi && \
rpm-file-permissions && \
# Ensure the temporary directory and target directory have the correct permissions
mkdir -p /opt/app-root/src/.local/share/code-server/extensions && \
mkdir -p /opt/app-root/src/.local/share/code-server/coder-logs && \
chown -R 1001:0 /opt/app-root/src/.local/share/code-server && \
chown -R 1001:0 /opt/app-root/extensions-temp && \
chown -R 1001:0 /opt/app-root/src/.config/code-server
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
sed -i -f ${NGINX_APP_ROOT}/nginxconf.sed ${NGINX_CONF_PATH}
mkdir -p ${NGINX_APP_ROOT}/etc/nginx.d/
mkdir -p ${NGINX_APP_ROOT}/etc/nginx.default.d/
mkdir -p ${NGINX_APP_ROOT}/api/
mkdir -p ${NGINX_CONTAINER_SCRIPTS_PATH}/nginx-start
mkdir -p ${NGINX_LOG_PATH}
mkdir -p ${NGINX_PERL_MODULE_PATH}
# Create httpd directories and set permissions
mkdir -p /var/log/httpd /var/run/httpd /etc/httpd/logs
chown -R 1001:0 ${NGINX_CONF_PATH}
chown -R 1001:0 ${NGINX_APP_ROOT}/etc
chown -R 1001:0 ${NGINX_CONTAINER_SCRIPTS_PATH}/nginx-start
chown -R 1001:0 /var/lib/nginx /var/log/nginx /run
chown -R 1001:0 /var/log/httpd /var/run/httpd /etc/httpd/logs
chmod ug+rw ${NGINX_CONF_PATH}
chmod -R ug+rwX ${NGINX_APP_ROOT}/etc
chmod -R ug+rwX ${NGINX_CONTAINER_SCRIPTS_PATH}/nginx-start
chmod -R ug+rwX /var/lib/nginx /var/log/nginx /run
chmod -R ug+rwX /var/log/httpd /var/run/httpd /etc/httpd/logs
# Make CGI script executable
chmod +x /opt/app-root/api/kernels/access.cgi
rpm-file-permissions
# Ensure the temporary directory and target directory have the correct permissions
mkdir -p /opt/app-root/src/.local/share/code-server/extensions
mkdir -p /opt/app-root/src/.local/share/code-server/coder-logs
chown -R 1001:0 /opt/app-root/src/.local/share/code-server
chown -R 1001:0 /opt/app-root/extensions-temp
chown -R 1001:0 /opt/app-root/src/.config/code-server
EOF

# Launcher
COPY --chown=1001:0 ${CODESERVER_SOURCE_CODE}/run-code-server.sh ${CODESERVER_SOURCE_CODE}/run-nginx.sh ./
Expand All @@ -261,28 +290,35 @@ COPY --from=whl-cache /tmp/control /dev/null
# Install packages and cleanup
# (ARCH-ppc64le): install packages (eg. pyarrow) that need to be built from source repository on ppc64le
RUN --mount=type=cache,target=/root/.cache/uv \
--mount=type=cache,from=whl-cache,source=/wheelsdir/,target=/wheelsdir/,rw \
bash -c ' \
if [[ $(uname -m) == "ppc64le" ]] || [[ $(uname -m) == "s390x" ]]; then \
uv pip install /wheelsdir/*.whl; \
fi '
--mount=type=cache,from=whl-cache,source=/wheelsdir/,target=/wheelsdir/,rw /bin/bash <<'EOF'
set -Eeuxo pipefail
if [[ $(uname -m) == "ppc64le" ]] || [[ $(uname -m) == "s390x" ]]; then
uv pip install /wheelsdir/*.whl
fi
EOF

# install packages as USER 0 (this will allow us to consume uv cache)
RUN --mount=type=cache,target=/root/.cache/uv \
echo "Installing softwares and packages" && \
# we can ensure wheels are consumed from the cache only by restricting internet access for uv install with '--offline' flag
# TODO(jdanek): seen some builds fail on GitHub Actions with --offline and see no need to limit ourselves to the cache, will remove this
UV_LINK_MODE=copy uv pip install --cache-dir /root/.cache/uv --requirements=./pylock.toml && \
# Note: debugpy wheel availabe on pypi (in uv cache) is none-any but bundles amd64.so files
# Build debugpy from source instead
UV_LINK_MODE=copy uv pip install --no-cache git+https://github.com/microsoft/debugpy.git@v$(grep -A1 '\"debugpy\"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b') && \
# change ownership to default user (all packages were installed as root and has root:root ownership \
chown -R 1001:0 /opt/app-root
RUN --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF'
set -Eeuxo pipefail
echo "Installing softwares and packages"
# we can ensure wheels are consumed from the cache only by restricting internet access for uv install with '--offline' flag
# TODO(jdanek): seen some builds fail on GitHub Actions with --offline and see no need to limit ourselves to the cache, will remove this
UV_LINK_MODE=copy uv pip install --cache-dir /root/.cache/uv --requirements=./pylock.toml
# Note: debugpy wheel availabe on pypi (in uv cache) is none-any but bundles amd64.so files
# Build debugpy from source instead
UV_LINK_MODE=copy uv pip install --no-cache git+https://github.com/microsoft/debugpy.git@v$(grep -A1 '\"debugpy\"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b')
# change ownership to default user (all packages were installed as root and has root:root ownership
chown -R 1001:0 /opt/app-root
EOF

USER 1001

# Fix permissions to support pip in Openshift environments
RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \
fix-permissions /opt/app-root -P
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
chmod -R g+w /opt/app-root/lib/python3.12/site-packages
fix-permissions /opt/app-root -P
EOF

WORKDIR /opt/app-root/src

Expand Down
20 changes: 14 additions & 6 deletions jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,12 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
# Problem: The operation would result in removing the following protected packages: systemd
# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
# Solution: --best --skip-broken does not work either, so use --nobest
RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
&& dnf clean all -y
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
dnf clean all -y
EOF

# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
Expand Down Expand Up @@ -107,10 +111,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
# Install micropipenv and uv to deploy packages from requirements.txt end

# Install the oc client begin
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
rm -f /tmp/openshift-client-linux.tar.gz
EOF
Comment on lines +114 to +120
Copy link
Contributor

@coderabbitai coderabbitai bot Nov 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

CRITICAL: Single-quoted heredoc delimiter prevents command substitution.

Line 116 uses $(uname -m) within the heredoc, but the single-quoted delimiter <<'EOF' prevents command substitution. The curl command will receive a literal string "$(uname -m)" instead of the actual machine architecture, causing the download URL to be malformed and the command to fail.

Fix: Use an unquoted heredoc delimiter to enable command substitution:

-RUN /bin/bash <<'EOF'
+RUN /bin/bash <<EOF
 set -Eeuxo pipefail
 curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
rm -f /tmp/openshift-client-linux.tar.gz
EOF
RUN /bin/bash <<EOF
set -Eeuxo pipefail
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
rm -f /tmp/openshift-client-linux.tar.gz
EOF
🤖 Prompt for AI Agents 
In jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu around lines 114 to 120,
the heredoc is quoted (<<'EOF') which prevents command substitution so $(uname
-m) is not expanded; change the heredoc delimiter to an unquoted form (<<EOF) so
shell expansions like $(uname -m) are performed, leaving the rest of the block
intact and keeping existing set -Eeuxo pipefail behavior.

Copy link
Member Author

@jiridanek jiridanek Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai no, this is not how it works, bash will evaluate $(uname -m) just fine, this is heredoc in Dockerfile not heredoc in bash script

Copy link
Contributor

@coderabbitai coderabbitai bot Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jiridanek, you're absolutely right, and I apologize for the confusion!

In a Dockerfile heredoc, the single-quoted delimiter <<'EOF' only prevents the Dockerfile parser from expanding build-time variables like ${ARG} or ${ENV}. The heredoc content is still passed to /bin/bash as-is, and bash will perform its own command substitution when it executes $(uname -m).

This is different from a bash script heredoc, where <<'EOF' would prevent the shell from performing expansions. Thank you for the correction!

    (\_(\ 
    (='.'=) 
    (")_(")
 *learning noted*
✏️ Learnings added 
Learnt from: jiridanek
Repo: opendatahub-io/notebooks PR: 2645
File: jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu:114-120
Timestamp: 2025-11-06T10:42:31.884Z
Learning: In Dockerfile heredocs (RUN /bin/bash <<'EOF'), the single-quoted delimiter <<'EOF' only prevents Dockerfile parser from expanding build-time variables like ${ARG} or ${ENV}. The heredoc content is still passed to the specified shell (bash) which will perform its own command substitution for expressions like $(uname -m). This is different from bash script heredocs where <<'EOF' prevents shell expansion.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.


# Install the oc client end

##############################
Expand Down
21 changes: 15 additions & 6 deletions jupyter/minimal/ubi9-python-3.12/Dockerfile.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,12 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
# Problem: The operation would result in removing the following protected packages: systemd
# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
# Solution: --best --skip-broken does not work either, so use --nobest
RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
&& dnf clean all -y
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
dnf clean all -y
EOF

# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
Expand All @@ -40,10 +44,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
# Install micropipenv and uv to deploy packages from requirements.txt end

# Install the oc client begin
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
rm -f /tmp/openshift-client-linux.tar.gz
EOF

# Install the oc client end

####################
Expand Down Expand Up @@ -73,6 +81,7 @@ USER 0
# Dependencies for PDF export begin
RUN ./utils/install_pdf_deps.sh
ENV PATH="/usr/local/texlive/bin/linux:/usr/local/pandoc/bin:$PATH"

# Dependencies for PDF export end

USER 1001
Expand Down
21 changes: 15 additions & 6 deletions jupyter/minimal/ubi9-python-3.12/Dockerfile.cuda
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,12 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
# Problem: The operation would result in removing the following protected packages: systemd
# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
# Solution: --best --skip-broken does not work either, so use --nobest
RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
&& dnf clean all -y
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
dnf clean all -y
EOF

# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
Expand All @@ -42,10 +46,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
# Install micropipenv and uv to deploy packages from requirements.txt end

# Install the oc client begin
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
rm -f /tmp/openshift-client-linux.tar.gz
EOF

# Install the oc client end

#########################
Expand Down Expand Up @@ -75,6 +83,7 @@ USER 0
# Dependencies for PDF export begin
RUN ./utils/install_pdf_deps.sh
ENV PATH="/usr/local/texlive/bin/linux:/usr/local/pandoc/bin:$PATH"

# Dependencies for PDF export end

USER 1001
Expand Down
Loading
Loading