Skip to content

Commit

Permalink
Add Dockerfiles for Neuron DLC with SDK 2.17.0 (#7)
Browse files Browse the repository at this point in the history
*Issue #, if available:*

*Description of changes:*

Dockerfiles for Neuron DLC images with SDK 2.17.0

By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice.
  • Loading branch information
thaotruong-aws authored Feb 17, 2024
1 parent fed4575 commit a969c77
Show file tree
Hide file tree
Showing 10 changed files with 1,348 additions and 111 deletions.
6 changes: 3 additions & 3 deletions docker/pytorch/inference/1.13.1/Dockerfile.neuron
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ LABEL maintainer="Amazon AI"
LABEL com.amazonaws.sagemaker.capabilities.accept-bind-to-port=true

# Neuron SDK components version numbers
ARG NEURONX_TOOLS_VERSION=2.16.*
ARG NEURON_FRAMEWORK_VERSION=1.13.1.2.9.17.*
ARG NEURON_CC_VERSION=1.21.*
ARG NEURON_FRAMEWORK_VERSION=1.13.1.2.9.17.0
ARG NEURON_CC_VERSION=1.21.0.0
ARG NEURONX_TOOLS_VERSION=2.17.0.0

ARG PYTHON=python3.10
ARG PYTHON_VERSION=3.10.12
Expand Down
191 changes: 160 additions & 31 deletions docker/pytorch/inference/1.13.1/Dockerfile.neuron.cve_allowlist.json
Original file line number Diff line number Diff line change
@@ -1,68 +1,197 @@
{
"CVE-2023-5678": {
"vulnerability_id": "CVE-2023-5678",
"title": "CVE-2023-5678 - cryptography",
"description": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays. Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted sour",
"CVE-2023-51779": {
"description": "\n It was discovered that a race condition existed in the Bluetooth subsystem\n of the Linux kernel, leading to a use-after-free vulnerability. A local\n attacker could use this to cause a denial of service (system crash) or\n possibly execute arbitrary code.",
"remediation": {
"recommendation": {
"text": "None Provided"
}
},
"score": 0.0,
"score_details": {},
"severity": "MEDIUM",
"source": "UBUNTU_CVE",
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2023/CVE-2023-51779.html",
"status": "ACTIVE",
"title": "CVE-2023-51779 - linux",
"vulnerability_id": "CVE-2023-51779",
"vulnerable_packages": [
{
"arch": "AMD64",
"epoch": 0,
"filePath": "opt/conda/lib/python3.10/site-packages/cryptography-41.0.7.dist-info/METADATA",
"name": "cryptography",
"packageManager": "PYTHONPKG",
"version": "41.0.7"
"name": "linux",
"packageManager": "OS",
"release": "171.189",
"version": "5.4.0"
}
]
},
"CVE-2023-51780": {
"description": "\n It was discovered that a race condition existed in the ATM\n (Asynchronous Transfer Mode) subsystem of the Linux kernel, leading\n to a use-after-free vulnerability. A local attacker could use this\n to cause a denial of service (system crash) or possibly execute\n arbitrary code.",
"remediation": {
"recommendation": {
"text": "None Provided"
}
},
"score": 7.0,
"score_details": {
"cvss": {
"adjustments": [],
"score": 7.0,
"scoreSource": "UBUNTU_CVE",
"scoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"severity": "HIGH",
"source": "UBUNTU_CVE",
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2023/CVE-2023-51780.html",
"status": "ACTIVE",
"title": "CVE-2023-51780 - linux",
"vulnerability_id": "CVE-2023-51780",
"vulnerable_packages": [
{
"arch": "AMD64",
"epoch": 0,
"name": "linux",
"packageManager": "OS",
"release": "171.189",
"version": "5.4.0"
}
]
},
"CVE-2023-51781": {
"description": "\n It was discovered that a race condition existed in the AppleTalk\n networking subsystem of the Linux kernel, leading to a use-after-free\n vulnerability. A local attacker could use this to cause a denial of\n service (system crash) or possibly execute arbitrary code.",
"remediation": {
"recommendation": {
"text": "None Provided"
}
},
"score": 7.0,
"score_details": {
"cvss": {
"adjustments": [],
"score": 7.0,
"scoreSource": "UBUNTU_CVE",
"scoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"severity": "HIGH",
"source": "UBUNTU_CVE",
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2023/CVE-2023-51781.html",
"status": "ACTIVE",
"title": "CVE-2023-51781 - linux",
"vulnerability_id": "CVE-2023-51781",
"vulnerable_packages": [
{
"arch": "AMD64",
"epoch": 0,
"name": "linux",
"packageManager": "OS",
"release": "171.189",
"version": "5.4.0"
}
]
},
"CVE-2023-51782": {
"description": "\n It was discovered that a race condition existed in the Rose X.25\n protocol implementation in the Linux kernel, leading to a use-after-\n free vulnerability. A local attacker could use this to cause a denial\n of service (system crash) or possibly execute arbitrary code.",
"remediation": {
"recommendation": {
"text": "None Provided"
}
},
"score": 7.0,
"score_details": {
"cvss": {
"adjustments": [],
"score": 7.0,
"scoreSource": "UBUNTU_CVE",
"scoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"severity": "HIGH",
"source": "UBUNTU_CVE",
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2023/CVE-2023-51782.html",
"status": "ACTIVE",
"title": "CVE-2023-51782 - linux",
"vulnerability_id": "CVE-2023-51782",
"vulnerable_packages": [
{
"arch": "AMD64",
"epoch": 0,
"name": "linux",
"packageManager": "OS",
"release": "171.189",
"version": "5.4.0"
}
],
]
},
"CVE-2023-6129": {
"description": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thus the contents of some of these vector registers\nare corrupted when returning to the caller. The vulnerable code is used only\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where th",
"remediation": {
"recommendation": {
"text": "None Provided"
}
},
"score": 5.3,
"score": 6.5,
"score_details": {
"cvss": {
"adjustments": [],
"score": 5.3,
"score": 6.5,
"scoreSource": "NVD",
"scoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"scoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
},
"source": "NVD",
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5678",
"severity": "MEDIUM",
"status": "ACTIVE"
},
"SNYK-PYTHON-CRYPTOGRAPHY-6126975": {
"vulnerability_id": "SNYK-PYTHON-CRYPTOGRAPHY-6126975",
"title": "IN1-PYTHON-CRYPTOGRAPHY-6126975 - cryptography",
"description": "## Overview\n\nAffected versions of this package are vulnerable to Information Exposure. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.\n\n**Note:**\n\n\nThis vulnerability exists due to an incomplete fix for [CVE-2020-25659](https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-1022152).\n## Remediation\nThere is no fixed version for `cryptography`.\n## References\n- [GitHub Issue](https://github.com/pyca/cryptography/issues/9785#issuecomment-1856209406)",
"source": "NVD",
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6129",
"status": "ACTIVE",
"title": "CVE-2023-6129 - pyOpenSSL",
"vulnerability_id": "CVE-2023-6129",
"vulnerable_packages": [
{
"epoch": 0,
"filePath": "opt/conda/lib/python3.10/site-packages/cryptography-41.0.7.dist-info/METADATA",
"name": "cryptography",
"filePath": "opt/conda/lib/python3.10/site-packages/pyOpenSSL-24.0.0.dist-info/METADATA",
"name": "pyOpenSSL",
"packageManager": "PYTHONPKG",
"version": "41.0.7"
"version": "24.0.0"
}
],
]
},
"CVE-2023-6915": {
"description": " A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.",
"remediation": {
"recommendation": {
"text": "None Provided"
}
},
"score": 5.9,
"score": 5.5,
"score_details": {
"cvss": {
"adjustments": [],
"score": 5.9,
"scoreSource": "SNYK",
"scoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P",
"score": 5.5,
"scoreSource": "UBUNTU_CVE",
"scoringVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"source": "SNYK",
"source_url": "https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6126975",
"severity": "MEDIUM",
"status": "ACTIVE"
"source": "UBUNTU_CVE",
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2023/CVE-2023-6915.html",
"status": "ACTIVE",
"title": "CVE-2023-6915 - linux",
"vulnerability_id": "CVE-2023-6915",
"vulnerable_packages": [
{
"arch": "AMD64",
"epoch": 0,
"name": "linux",
"packageManager": "OS",
"release": "171.189",
"version": "5.4.0"
}
]
}
}
18 changes: 9 additions & 9 deletions docker/pytorch/inference/1.13.1/Dockerfile.neuronx
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,13 @@ LABEL maintainer="Amazon AI"
LABEL com.amazonaws.sagemaker.capabilities.accept-bind-to-port=true

# Neuron SDK components version numbers
ARG NEURONX_RUNTIME_LIB_VERSION=2.19.*
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.19.*
ARG NEURONX_TOOLS_VERSION=2.16.*
ARG NEURONX_FRAMEWORK_VERSION=1.13.1.1.13.*
ARG NEURONX_TRANSFORMERS_VERSION=0.9.*
ARG NEURONX_CC_VERSION=2.12.*
ARG NEURONX_DISTRIBUTED_VERSION=0.6.*
ARG NEURONX_FRAMEWORK_VERSION=1.13.1.1.13.1
ARG NEURONX_TRANSFORMERS_VERSION=0.9.474
ARG NEURONX_DISTRIBUTED_VERSION=0.6.0
ARG NEURONX_CC_VERSION=2.12.68.0
ARG NEURONX_TOOLS_VERSION=2.17.0.0
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.20.11.0-c101c322e
ARG NEURONX_RUNTIME_LIB_VERSION=2.20.11.0-b7d33e68b

ARG PYTHON=python3.10
ARG PYTHON_VERSION=3.10.12
Expand Down Expand Up @@ -116,13 +116,13 @@ RUN pip install --no-cache-dir -U \

RUN pip install -U --extra-index-url https://pip.repos.neuron.amazonaws.com \

Check failure on line 117 in docker/pytorch/inference/1.13.1/Dockerfile.neuronx

View workflow job for this annotation

GitHub Actions / dockerfile-linter

DL3042 warning: Avoid use of cache directory with pip. Use `pip install --no-cache-dir <package>`
neuronx-cc==$NEURONX_CC_VERSION \
neuronx_distributed==$NEURONX_DISTRIBUTED_VERSION \
torch-neuronx==$NEURONX_FRAMEWORK_VERSION \
transformers-neuronx==$NEURONX_TRANSFORMERS_VERSION \
&& pip install -U "protobuf>=3.18.3,<4" \
torchserve==${TORCHSERVE_VERSION} \
torch-model-archiver==${TORCHSERVE_VERSION} \
&& pip install --no-deps --no-cache-dir -U torchvision==0.14.*
&& pip install --no-deps --no-cache-dir -U torchvision==0.14.* \
&& pip install --no-deps -U --extra-index-url https://pip.repos.neuron.amazonaws.com neuronx_distributed==$NEURONX_DISTRIBUTED_VERSION

RUN useradd -m model-server \
&& mkdir -p /home/model-server/tmp /opt/ml/model \
Expand Down
Loading

0 comments on commit a969c77

Please sign in to comment.