[WIP] Merge miniforge-cuda into ci-imgs

.github/workflows/build-and-publish-images.yaml

@@ -40,6 +40,8 @@ jobs:
       PYTHON_VER: ${{ matrix.PYTHON_VER }}
       IMAGE_REPO: ${{ matrix.IMAGE_REPO }}
       IMAGE_NAME: ${{ matrix.IMAGE_NAME }}
+      DOCKERFILE: ${{ matrix.DOCKERFILE }}
+      DOCKER_TARGET: ${{ matrix.DOCKER_TARGET }}
   build-multiarch-manifest:
     name: manifest (${{ matrix.CUDA_VER }}, ${{ matrix.PYTHON_VER }}, ${{ matrix.LINUX_VER }}, ${{ matrix.IMAGE_REPO }})
     needs: [docker, compute-matrix]

.github/workflows/build-image.yaml

@@ -21,6 +21,13 @@ on:
       IMAGE_NAME:
         required: true
         type: string
+      DOCKERFILE:
+        required: true
+        type: string
+      DOCKER_TARGET:
+        required: false
+        type: string
+
 
 jobs:
   run:
@@ -62,9 +69,10 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: context
-          file: ${{ inputs.IMAGE_REPO }}.Dockerfile
+          file: ${{ inputs.DOCKERFILE }}
           push: true
           pull: true
           build-args: |
             ${{ steps.generate-build-args.outputs.ARGS }}
+          target: ${{ inputs.DOCKER_TARGET }}
           tags: ${{ inputs.IMAGE_NAME }}-${{ matrix.ARCH }}

ci-conda.Dockerfile

@@ -1,21 +1,88 @@
 ARG CUDA_VER=notset
 ARG LINUX_VER=notset
 ARG PYTHON_VER=notset
-ARG YQ_VER
-ARG AWS_CLI_VER
+ARG YQ_VER=notset
+ARG AWS_CLI_VER=notset
 
-FROM mikefarah/yq:${YQ_VER} as yq
+FROM nvidia/cuda:${CUDA_VER}-base-${LINUX_VER} AS cuda-base
 
-FROM amazon/aws-cli:${AWS_CLI_VER} as aws-cli
+ARG LINUX_VER
+ARG PYTHON_VER
+ARG DEBIAN_FRONTEND=noninteractive
+ENV PATH=/opt/conda/bin:$PATH
+ENV PYTHON_VERSION=${PYTHON_VER}
+
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+
+# Create a conda group and assign it as root's primary group
+RUN <<EOF
+groupadd conda
+usermod -g conda root
+EOF
+
+# Ownership & permissions based on https://docs.anaconda.com/anaconda/install/multi-user/#multi-user-anaconda-installation-on-linux
+COPY --from=condaforge/miniforge3:24.3.0-0 --chown=root:conda --chmod=770 /opt/conda /opt/conda
 
-FROM rapidsai/miniforge-cuda:cuda${CUDA_VER}-base-${LINUX_VER}-py${PYTHON_VER}
+# Ensure new files are created with group write access & setgid. See https://unix.stackexchange.com/a/12845
+RUN chmod g+ws /opt/conda
+
+RUN <<EOF
+# Ensure new files/dirs have group write permissions
+umask 002
+# install expected Python version
+conda install -y -n base "python~=${PYTHON_VERSION}.0=*_cpython"
+conda update --all -y -n base
+if [[ "$LINUX_VER" == "rockylinux"* ]]; then
+  yum install -y findutils
+  yum clean all
+fi
+find /opt/conda -follow -type f -name '*.a' -delete
+find /opt/conda -follow -type f -name '*.pyc' -delete
+conda clean -afy
+EOF
+
+# Reassign root's primary group to root
+RUN usermod -g root root
+
+RUN <<EOF
+# ensure conda environment is always activated
+ln -s /opt/conda/etc/profile.d/conda.sh /etc/profile.d/conda.sh
+echo ". /opt/conda/etc/profile.d/conda.sh; conda activate base" >> /etc/skel/.bashrc
+echo ". /opt/conda/etc/profile.d/conda.sh; conda activate base" >> ~/.bashrc
+EOF
+
+# tzdata is needed by the ORC library used by pyarrow, because it provides /etc/localtime
+RUN <<EOF
+case "${LINUX_VER}" in
+  "ubuntu"*)
+    apt-get update
+    apt-get upgrade -y
+    apt-get install -y --no-install-recommends \
+      tzdata
+    rm -rf "/var/lib/apt/lists/*"
+    ;;
+  "rockylinux"*)
+    yum update -y
+    yum clean all
+    ;;
+  *)
+    echo "Unsupported LINUX_VER: ${LINUX_VER}" && exit 1
+    ;;
+esac
+EOF
+
+FROM mikefarah/yq:${YQ_VER} AS yq
+
+FROM amazon/aws-cli:${AWS_CLI_VER} AS aws-cli
+
+FROM cuda-base
 
 ARG TARGETPLATFORM
 ARG CUDA_VER
 ARG LINUX_VER
 ARG PYTHON_VER
 
-ARG DEBIAN_FRONTEND=noninteractive
+ARG DEBIAN_FRONTEND
 
 # Set RAPIDS versions env variables
 ENV RAPIDS_CUDA_VERSION="${CUDA_VER}"

ci/compute-matrix.jq

@@ -1,13 +1,5 @@
 def compute_arch($x):
-  ["amd64"] |
-  if
-    (["ubuntu18.04", "centos7"] | index($x.LINUX_VER) != null)
-   then
-    .
-  else
-    . + ["arm64"]
-  end |
-  $x + {ARCHES: .};
+  $x + {ARCHES: ["amd64", "arm64"]};
 
 def compute_repo($x):
   if
@@ -55,6 +47,10 @@ def compute_matrix($input):
     combinations |
     lists2dict($matrix_keys; .) |
     filter_excludes(.; $excludes) |
+    .IMAGE_REPO = .CI_IMAGE_CONFIG.IMAGE_REPO |
+    .DOCKERFILE = .CI_IMAGE_CONFIG.dockerfile |
+    .DOCKER_TARGET = .CI_IMAGE_CONFIG.docker_target |
+    del(.CI_IMAGE_CONFIG) |
     compute_arch(.) |
     compute_image_name(.)
   ] |

matrix.yaml

@@ -13,10 +13,19 @@ LINUX_VER:
   - "ubuntu20.04"
   - "ubuntu22.04"
   - "rockylinux8"
-IMAGE_REPO:
-  - "ci-conda"
-  - "ci-wheel"
-  - "citestwheel"
+CI_IMAGE_CONFIG:
+  - IMAGE_REPO: "miniforge-cuda"
+    dockerfile: ci-conda.Dockerfile
+    docker_target: cuda-base
+  - IMAGE_REPO: "ci-conda"
+    dockerfile: ci-conda.Dockerfile
+    docker_target: ""
+  - IMAGE_REPO: "ci-wheel"
+    dockerfile: ci-wheel.Dockerfile
+    docker_target: ""
+  - IMAGE_REPO: "citestwheel"
+    dockerfile: citestwheel.Dockerfile
+    docker_target: ""
 exclude:
   # Exclusions from CUDA's OS support matrix
   - LINUX_VER: "ubuntu22.04"