Skip to content

Harden Docker images with security best practices and Ubuntu 24.04 #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 15 commits into
base: pixi-lockfiles
Choose a base branch
from
Open

Harden Docker images with security best practices and Ubuntu 24.04 #229

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
2900d3d
Harden Docker images with security best practices and Ubuntu 24.04
dcmcand Oct 20, 2025
067d426
Fix multi-platform Docker build failures in CI
dcmcand Oct 20, 2025
3839a25
Restore BuildKit cache mounts in pixi-installer stage
dcmcand Oct 20, 2025
a77c6d7
Simplify GPU build to match main branch approach
dcmcand Oct 28, 2025
fcf3825
Fix nebari user group ID and add bzip2 dependency
dcmcand Oct 28, 2025
3bf3eda
remove CUDA Digest from dockerfile
dcmcand Oct 28, 2025
963a4c5
remove uneeded steps from dockerfile
dcmcand Oct 28, 2025
e787f49
remove uneeded steps from dockerfile
dcmcand Oct 28, 2025
733c8cd
Upgrade pixi to 0.58.0 and fix build variable scoping
dcmcand Oct 28, 2025
3d74666
Move system dependencies from apt to pixi (conda-forge)
dcmcand Nov 3, 2025
f79d1f0
Run jupyterlab postBuild through pixi to access wget/curl
dcmcand Nov 3, 2025
9fbf67d
Add git to jupyterlab pixi dependencies
dcmcand Nov 3, 2025
fdc7cf8
Change nebari user from UID 1001 to UID 1000
dcmcand Nov 3, 2025
eeaceb3
Add .pixi directories to .gitignore
dcmcand Nov 3, 2025
0608efb
switch user to nebari
dcmcand Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions .github/workflows/build-push-docker.yaml
View file
Open in desktop
Copy link
Member

@marcelovilla marcelovilla Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We'll need to revert some of these changes so it plays nice with #235

Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,7 @@ on:

env:
DOCKER_ORG: nebari
GPU_BASE_IMAGE: nvidia/cuda:12.8.1-base-ubuntu24.04
GPU_IMAGE_SUFFIX: gpu
BASE_IMAGE: ubuntu:24.04

permissions:
contents: read
Expand Down Expand Up @@ -85,11 +83,9 @@ jobs:
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_TOKEN }}

- name: "Set BASE_IMAGE and Image Suffix 📷"
- name: "Set Image Suffix for GPU 📷"
if: ${{ matrix.platform == 'gpu' }}
run: |
echo "GPU Platform Matrix"
echo "BASE_IMAGE=$GPU_BASE_IMAGE" >> $GITHUB_ENV
echo "IMAGE_SUFFIX=-$GPU_IMAGE_SUFFIX" >> $GITHUB_ENV

- name: "Generate Docker images tags 🏷️"
Expand Down Expand Up @@ -123,5 +119,6 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
build-args: BASE_IMAGE=${{ env.BASE_IMAGE }}
platforms: linux/amd64,linux/arm64
sbom: true
provenance: true
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,3 +127,5 @@ dmypy.json

# Pyre type checker
.pyre/

CLAUDE.md
Loading
Loading