2024-01-08 10:37:47 +05:30
|
|
|
# Base image for building
|
2025-12-02 22:50:13 -08:00
|
|
|
ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
|
2023-11-30 14:49:21 -08:00
|
|
|
|
2023-12-06 08:55:53 +10:00
|
|
|
# Runtime image
|
2025-12-02 22:50:13 -08:00
|
|
|
ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
|
2026-02-07 11:14:55 -08:00
|
|
|
|
2024-01-08 10:37:47 +05:30
|
|
|
# Builder stage
|
2024-09-21 17:21:11 +02:00
|
|
|
FROM $LITELLM_BUILD_IMAGE AS builder
|
2024-01-08 10:37:47 +05:30
|
|
|
|
|
|
|
|
# Set the working directory to /app
|
|
|
|
|
WORKDIR /app
|
|
|
|
|
|
2025-01-07 20:35:57 -08:00
|
|
|
USER root
|
|
|
|
|
|
2024-01-08 10:37:47 +05:30
|
|
|
# Install build dependencies
|
2025-12-02 22:50:13 -08:00
|
|
|
RUN apk add --no-cache bash gcc py3-pip python3 python3-dev openssl openssl-dev
|
2025-01-07 20:35:57 -08:00
|
|
|
|
2025-12-02 22:50:13 -08:00
|
|
|
RUN python -m pip install build
|
2024-01-08 10:37:47 +05:30
|
|
|
|
|
|
|
|
# Copy the current directory contents into the container at /app
|
|
|
|
|
COPY . .
|
|
|
|
|
|
2024-02-21 21:28:56 -08:00
|
|
|
# Build Admin UI
|
2026-01-07 11:36:57 -08:00
|
|
|
# Convert Windows line endings to Unix and make executable
|
|
|
|
|
RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
|
2024-02-21 21:28:56 -08:00
|
|
|
|
2024-01-08 10:37:47 +05:30
|
|
|
# Build the package
|
|
|
|
|
RUN rm -rf dist/* && python -m build
|
|
|
|
|
|
|
|
|
|
# There should be only one wheel file now, assume the build only creates one
|
|
|
|
|
RUN ls -1 dist/*.whl | head -1
|
|
|
|
|
|
|
|
|
|
# Install the package
|
|
|
|
|
RUN pip install dist/*.whl
|
|
|
|
|
|
|
|
|
|
# install dependencies as wheels
|
|
|
|
|
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
|
2023-12-03 18:38:44 +10:00
|
|
|
|
2024-03-19 16:59:59 -07:00
|
|
|
# ensure pyjwt is used, not jwt
|
|
|
|
|
RUN pip uninstall jwt -y
|
|
|
|
|
RUN pip uninstall PyJWT -y
|
2026-03-14 19:54:54 -07:00
|
|
|
RUN pip install PyJWT==2.12.0 --no-cache-dir
|
2024-03-19 16:59:59 -07:00
|
|
|
|
2023-12-16 16:01:02 -08:00
|
|
|
# Runtime stage
|
2024-09-21 17:21:11 +02:00
|
|
|
FROM $LITELLM_RUNTIME_IMAGE AS runtime
|
2023-12-03 18:38:44 +10:00
|
|
|
|
2025-01-07 20:35:57 -08:00
|
|
|
# Ensure runtime stage runs as root
|
|
|
|
|
USER root
|
|
|
|
|
|
2026-01-29 02:33:41 -03:00
|
|
|
# Install runtime dependencies (libsndfile needed for audio processing on ARM64)
|
2026-01-31 11:44:43 -08:00
|
|
|
RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
|
2026-03-13 11:16:17 -07:00
|
|
|
npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
|
2026-02-08 11:53:01 +05:30
|
|
|
# SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
|
|
|
|
|
# levels inside its dependency tree. `npm install -g <pkg>` only creates a
|
|
|
|
|
# SEPARATE global package, it does NOT replace npm's internal copies.
|
|
|
|
|
# We must find and replace EVERY copy inside npm's directory.
|
|
|
|
|
GLOBAL="$(npm root -g)" && \
|
|
|
|
|
find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
|
|
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
|
|
|
|
|
done && \
|
|
|
|
|
find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
|
|
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
|
|
|
|
|
done && \
|
|
|
|
|
find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
|
|
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
|
|
|
|
|
done && \
|
2026-02-24 19:40:09 +05:30
|
|
|
find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
|
|
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
|
|
|
|
|
done && \
|
|
|
|
|
find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
|
|
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
|
|
|
|
|
done && \
|
2026-03-07 18:31:27 -08:00
|
|
|
# SECURITY FIX: patch npm's own package.json metadata so scanners see the
|
|
|
|
|
# actual installed versions instead of the stale declared dependencies.
|
|
|
|
|
find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
|
|
|
|
|
sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
|
|
|
|
|
npm cache clean --force && \
|
|
|
|
|
# Remove the apk-tracked npm so its stale SBOM metadata (tar 7.5.9) is
|
|
|
|
|
# no longer visible to image scanners. The globally installed npm@latest
|
|
|
|
|
# at /usr/local/lib/node_modules/npm/ remains fully functional.
|
|
|
|
|
{ apk del --no-cache npm 2>/dev/null || true; }
|
2025-09-26 19:31:56 -07:00
|
|
|
|
2023-12-16 16:01:02 -08:00
|
|
|
WORKDIR /app
|
2024-01-06 14:59:10 +05:30
|
|
|
# Copy the current directory contents into the container at /app
|
|
|
|
|
COPY . .
|
|
|
|
|
RUN ls -la /app
|
2023-12-03 18:38:44 +10:00
|
|
|
|
2023-12-16 16:01:02 -08:00
|
|
|
# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
|
2024-01-08 10:37:47 +05:30
|
|
|
COPY --from=builder /app/dist/*.whl .
|
|
|
|
|
COPY --from=builder /wheels/ /wheels/
|
2024-01-08 08:02:50 +05:30
|
|
|
|
2023-12-16 16:01:02 -08:00
|
|
|
# Install the built wheel using pip; again using a wildcard if it's the only file
|
2024-01-09 13:44:37 +05:30
|
|
|
RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
|
2024-01-08 08:02:50 +05:30
|
|
|
|
2026-02-07 11:14:55 -08:00
|
|
|
# Replace the nodejs-wheel-binaries bundled node with the system node (fixes CVE-2025-55130)
|
|
|
|
|
RUN NODEJS_WHEEL_NODE=$(find /usr/lib -path "*/nodejs_wheel/bin/node" 2>/dev/null) && \
|
|
|
|
|
if [ -n "$NODEJS_WHEEL_NODE" ]; then cp /usr/bin/node "$NODEJS_WHEEL_NODE"; fi
|
|
|
|
|
|
2025-11-07 14:38:20 -08:00
|
|
|
# Remove test files and keys from dependencies
|
|
|
|
|
RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
|
|
|
|
|
find /usr/lib -type d -path "*/tornado/test" -delete
|
|
|
|
|
|
2026-02-08 11:53:01 +05:30
|
|
|
# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
|
|
|
|
|
# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
|
|
|
|
|
# Patch every copy of tar, glob, and brace-expansion inside that tree.
|
|
|
|
|
RUN GLOBAL="$(npm root -g)" && \
|
2026-03-07 18:31:27 -08:00
|
|
|
[ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
|
2026-02-24 19:40:09 +05:30
|
|
|
find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
|
2026-02-08 11:53:01 +05:30
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
|
|
|
|
|
done && \
|
2026-02-24 19:40:09 +05:30
|
|
|
find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
|
2026-02-08 11:53:01 +05:30
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
|
|
|
|
|
done && \
|
2026-02-24 19:40:09 +05:30
|
|
|
find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
|
2026-02-08 11:53:01 +05:30
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
|
2026-02-24 19:40:09 +05:30
|
|
|
done && \
|
|
|
|
|
find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
|
|
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
|
|
|
|
|
done && \
|
|
|
|
|
find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
|
|
|
|
|
rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
|
2026-02-08 11:53:01 +05:30
|
|
|
done
|
|
|
|
|
|
2025-08-19 18:36:30 -07:00
|
|
|
# Install semantic_router and aurelio-sdk using script
|
2026-01-07 11:36:57 -08:00
|
|
|
# Convert Windows line endings to Unix and make executable
|
|
|
|
|
RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
|
2025-07-24 19:58:49 -07:00
|
|
|
|
2026-01-24 10:52:19 +05:30
|
|
|
# Generate prisma client using the correct schema
|
|
|
|
|
RUN prisma generate --schema=./litellm/proxy/schema.prisma
|
2026-01-07 11:36:57 -08:00
|
|
|
# Convert Windows line endings to Unix for entrypoint scripts
|
|
|
|
|
RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
|
|
|
|
|
RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
|
2024-01-09 13:10:03 +05:30
|
|
|
|
2024-01-08 10:37:47 +05:30
|
|
|
EXPOSE 4000/tcp
|
2023-11-23 04:19:54 -05:00
|
|
|
|
2025-07-18 23:47:15 +05:30
|
|
|
RUN apk add --no-cache supervisor
|
|
|
|
|
COPY docker/supervisord.conf /etc/supervisord.conf
|
|
|
|
|
|
2025-01-06 17:27:09 -08:00
|
|
|
ENTRYPOINT ["docker/prod_entrypoint.sh"]
|
2024-03-06 16:31:32 -08:00
|
|
|
|
2025-05-22 22:36:19 -07:00
|
|
|
# Append "--detailed_debug" to the end of CMD to view detailed debug logs
|
2024-04-08 13:23:56 -07:00
|
|
|
CMD ["--port", "4000"]
|
