Skip to content

Commit 82606e4

Browse files
foolhbfoolhb
authored
Add Dockerfiles for Neuron DLC with SDK 2.20.2 (#29)
*Issue #, if available:* *Description of changes:* By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
1 parent 632831d commit 82606e4

File tree

7 files changed

+74
-181
lines changed

7 files changed

+74
-181
lines changed

‎docker/pytorch/inference/1.13.1/Dockerfile.neuron‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ LABEL maintainer="Amazon AI"
55
LABEL com.amazonaws.sagemaker.capabilities.accept-bind-to-port=true
66

77
# Neuron SDK components version numbers
8-
ARG NEURON_FRAMEWORK_VERSION=1.13.1.2.11.7.0
8+
ARG NEURON_FRAMEWORK_VERSION=1.13.1.2.11.13.0
99
ARG NEURON_CC_VERSION=1.24.0.0
1010
ARG NEURONX_TOOLS_VERSION=2.19.0.0
1111

‎docker/pytorch/inference/1.13.1/Dockerfile.neuronx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ LABEL com.amazonaws.sagemaker.capabilities.accept-bind-to-port=true
77
# Neuron SDK components version numbers
88
ARG NEURONX_FRAMEWORK_VERSION=1.13.1.1.16.0
99
ARG NEURONX_DISTRIBUTED_VERSION=0.9.0
10-
ARG NEURONX_CC_VERSION=2.15.141.0
10+
ARG NEURONX_CC_VERSION=2.15.143.0
1111
ARG NEURONX_TRANSFORMERS_VERSION=0.12.313
12-
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.26.0-17a033bc8
13-
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.14.0-6e27b8d5b
12+
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.33.0-d2128d1aa
13+
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.19.0-5856c0b42
1414
ARG NEURONX_TOOLS_VERSION=2.19.0.0
1515

1616
ARG PYTHON=python3.10

‎docker/pytorch/inference/2.1.2/Dockerfile.neuronx‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ LABEL com.amazonaws.sagemaker.capabilities.accept-bind-to-port=true
66

77
# Neuron SDK components version numbers
88
ARG NEURONX_DISTRIBUTED_VERSION=0.9.0
9-
ARG NEURONX_CC_VERSION=2.15.141.0
10-
ARG NEURONX_FRAMEWORK_VERSION=2.1.2.2.3.1
9+
ARG NEURONX_CC_VERSION=2.15.143.0
10+
ARG NEURONX_FRAMEWORK_VERSION=2.1.2.2.3.2
1111
ARG NEURONX_TRANSFORMERS_VERSION=0.12.313
12-
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.26.0-17a033bc8
13-
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.14.0-6e27b8d5b
12+
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.33.0-d2128d1aa
13+
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.19.0-5856c0b42
1414
ARG NEURONX_TOOLS_VERSION=2.19.0.0
1515

1616
ARG PYTHON=python3.10

‎docker/pytorch/training/1.13.1/Dockerfile.neuronx‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ LABEL dlc_major_version="1"
66
# Neuron SDK components version numbers
77
ARG NEURONX_FRAMEWORK_VERSION=1.13.1.1.16.0
88
ARG NEURONX_DISTRIBUTED_VERSION=0.9.0
9-
ARG NEURONX_DISTRIBUTED_TRAINING_VERSION=1.0.0
10-
ARG NEURONX_CC_VERSION=2.15.141.0
11-
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.26.0-17a033bc8
12-
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.14.0-6e27b8d5b
9+
ARG NEURONX_DISTRIBUTED_TRAINING_VERSION=1.0.1
10+
ARG NEURONX_CC_VERSION=2.15.143.0
11+
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.33.0-d2128d1aa
12+
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.19.0-5856c0b42
1313
ARG NEURONX_TOOLS_VERSION=2.19.0.0
1414

1515
ARG PYTHON=python3.10
@@ -162,12 +162,11 @@ RUN git clone https://github.com/NVIDIA/apex.git /root/apex \
162162

163163
#Install dependencies from requirements and extras for SageMaker usecase
164164
RUN wget https://raw.githubusercontent.com/aws-neuron/neuronx-distributed-training/master/requirements.txt \
165-
&& pip install --no-deps --no-cache-dir --no-build-isolation -r requirements.txt /root/apex/dist/apex-0.1-py3-none-any.whl \
166-
&& pip install --force-reinstall "numba==0.57.1" \
167-
"multiprocess==0.70.16" \
168-
"numpy>=1.24.3,<=1.25.2" \
169-
"dill==0.3.8"
170-
165+
&& pip install --no-cache-dir -r requirements.txt /root/apex/dist/apex-0.1-py3-none-any.whl \
166+
&& pip install --force-reinstall "multiprocess==0.70.16" \
167+
"dill==0.3.8" \
168+
"torch==1.13.1"
169+
171170

172171
RUN ${PIP} install --force-reinstall --no-deps neuronx_distributed_training==$NEURONX_DISTRIBUTED_TRAINING_VERSION --extra-index-url https://pip.repos.neuron.amazonaws.com
173172

@@ -192,9 +191,7 @@ RUN pip install --no-cache-dir -U \
192191
"opencv-python>=4.8.1.78" \
193192
"plotly>=5.11,<6" \
194193
"seaborn>=0.12,<1" \
195-
"numba>=0.56.4,<0.57" \
196-
"shap>=0.41,<1" \
197-
"numpy<1.24,>1.21"
194+
"shap>=0.41,<1"
198195

199196
# EFA Installer does apt get. Make sure to run apt update before that
200197
RUN apt-get update

‎docker/pytorch/training/1.13.1/Dockerfile.neuronx.cve_allowlist.json‎

Lines changed: 3 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -1,84 +1,4 @@
11
{
2-
"CVE-2023-6730": {
3-
"description": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.",
4-
"remediation": {
5-
"recommendation": {
6-
"text": "None Provided"
7-
}
8-
},
9-
"score": 8.8,
10-
"score_details": {
11-
"cvss": {
12-
"adjustments": [],
13-
"score": 8.8,
14-
"scoreSource": "NVD",
15-
"scoringVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
16-
"version": "3.1"
17-
}
18-
},
19-
"severity": "HIGH",
20-
"source": "NVD",
21-
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6730",
22-
"status": "ACTIVE",
23-
"title": "CVE-2023-6730 - transformers, transformers",
24-
"vulnerability_id": "CVE-2023-6730",
25-
"vulnerable_packages": [
26-
{
27-
"epoch": 0,
28-
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.31.0.dist-info/METADATA",
29-
"name": "transformers",
30-
"packageManager": "PYTHONPKG",
31-
"version": "4.31.0"
32-
},
33-
{
34-
"epoch": 0,
35-
"filePath": "requirements.txt",
36-
"name": "transformers",
37-
"packageManager": "PIP",
38-
"version": "4.31.0"
39-
}
40-
]
41-
},
42-
"CVE-2023-7018": {
43-
"description": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.",
44-
"remediation": {
45-
"recommendation": {
46-
"text": "None Provided"
47-
}
48-
},
49-
"score": 7.8,
50-
"score_details": {
51-
"cvss": {
52-
"adjustments": [],
53-
"score": 7.8,
54-
"scoreSource": "NVD",
55-
"scoringVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
56-
"version": "3.1"
57-
}
58-
},
59-
"severity": "HIGH",
60-
"source": "NVD",
61-
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7018",
62-
"status": "ACTIVE",
63-
"title": "CVE-2023-7018 - transformers, transformers",
64-
"vulnerability_id": "CVE-2023-7018",
65-
"vulnerable_packages": [
66-
{
67-
"epoch": 0,
68-
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.31.0.dist-info/METADATA",
69-
"name": "transformers",
70-
"packageManager": "PYTHONPKG",
71-
"version": "4.31.0"
72-
},
73-
{
74-
"epoch": 0,
75-
"filePath": "requirements.txt",
76-
"name": "transformers",
77-
"packageManager": "PIP",
78-
"version": "4.31.0"
79-
}
80-
]
81-
},
822
"CVE-2024-31580": {
833
"description": "PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.",
844
"remediation": {
@@ -197,17 +117,17 @@
197117
"vulnerable_packages": [
198118
{
199119
"epoch": 0,
200-
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.31.0.dist-info/METADATA",
120+
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.36.0.dist-info/METADATA",
201121
"name": "transformers",
202122
"packageManager": "PYTHONPKG",
203-
"version": "4.31.0"
123+
"version": "4.36.0"
204124
},
205125
{
206126
"epoch": 0,
207127
"filePath": "requirements.txt",
208128
"name": "transformers",
209129
"packageManager": "PIP",
210-
"version": "4.31.0"
130+
"version": "4.36.0"
211131
}
212132
]
213133
},

‎docker/pytorch/training/2.1.2/Dockerfile.neuronx‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ LABEL dlc_major_version="1"
55

66
# Neuron SDK components version numbers
77
ARG NEURONX_DISTRIBUTED_VERSION=0.9.0
8-
ARG NEURONX_DISTRIBUTED_TRAINING_VERSION=1.0.0
9-
ARG NEURONX_CC_VERSION=2.15.141.0
10-
ARG NEURONX_FRAMEWORK_VERSION=2.1.2.2.3.1
11-
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.26.0-17a033bc8
12-
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.14.0-6e27b8d5b
8+
ARG NEURONX_DISTRIBUTED_TRAINING_VERSION=1.0.1
9+
ARG NEURONX_CC_VERSION=2.15.143.0
10+
ARG NEURONX_FRAMEWORK_VERSION=2.1.2.2.3.2
11+
ARG NEURONX_COLLECTIVES_LIB_VERSION=2.22.33.0-d2128d1aa
12+
ARG NEURONX_RUNTIME_LIB_VERSION=2.22.19.0-5856c0b42
1313
ARG NEURONX_TOOLS_VERSION=2.19.0.0
1414

1515
ARG PYTHON=python3.10
@@ -146,8 +146,9 @@ RUN ${PIP} config set global.extra-index-url https://pip.repos.neuron.amazonaws.
146146
RUN ${PIP} install --force-reinstall --no-deps neuronx_distributed==$NEURONX_DISTRIBUTED_VERSION --extra-index-url https://pip.repos.neuron.amazonaws.com
147147

148148
## Installation for Neuronx Distributed Training framework
149-
# Install Cython
150-
RUN pip install --no-cache-dir Cython
149+
# Install Cython & wheel
150+
RUN ${PIP} install --no-cache-dir Cython \
151+
&& ${PIP} install --no-cache-dir wheel
151152

152153
# Copy the apex_setup.py file
153154
COPY apex_setup.py /root/apex_setup.py
@@ -161,11 +162,10 @@ RUN git clone https://github.com/NVIDIA/apex.git /root/apex \
161162

162163
#Install dependencies from requirements and extras for SageMaker usecase
163164
RUN wget https://raw.githubusercontent.com/aws-neuron/neuronx-distributed-training/master/requirements.txt \
164-
&& pip install --no-deps --no-cache-dir --no-build-isolation -r requirements.txt /root/apex/dist/apex-0.1-py3-none-any.whl \
165-
&& pip install --force-reinstall "numba==0.57.1" \
166-
"multiprocess==0.70.16" \
167-
"numpy>=1.24.3,<=1.25.2" \
168-
"dill==0.3.8"
165+
&& ${PIP} install --no-cache-dir -r requirements.txt /root/apex/dist/apex-0.1-py3-none-any.whl \
166+
&& ${PIP} install --force-reinstall "multiprocess==0.70.16" \
167+
"dill==0.3.8" \
168+
"torch==2.1.2"
169169

170170

171171
RUN ${PIP} install --force-reinstall --no-deps neuronx_distributed_training==$NEURONX_DISTRIBUTED_TRAINING_VERSION --extra-index-url https://pip.repos.neuron.amazonaws.com
@@ -191,9 +191,7 @@ RUN pip install --no-cache-dir -U \
191191
"opencv-python>=4.8.1.78" \
192192
"plotly>=5.11,<6" \
193193
"seaborn>=0.12,<1" \
194-
"numba>=0.56.4,<0.57" \
195-
"shap>=0.41,<1" \
196-
"numpy<1.24,>1.21"
194+
"shap>=0.41,<1"
197195

198196
# EFA Installer does apt get. Make sure to run apt update before that
199197
RUN apt-get update

‎docker/pytorch/training/2.1.2/Dockerfile.neuronx.cve_allowlist.json‎

Lines changed: 40 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,34 @@
11
{
2-
"CVE-2023-6730": {
3-
"description": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.",
2+
"CVE-2022-40897": {
3+
"description": "Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.",
44
"remediation": {
55
"recommendation": {
66
"text": "None Provided"
77
}
88
},
9-
"score": 8.8,
9+
"score": 5.9,
1010
"score_details": {
1111
"cvss": {
1212
"adjustments": [],
13-
"score": 8.8,
13+
"score": 5.9,
1414
"scoreSource": "NVD",
15-
"scoringVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
15+
"scoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
1616
"version": "3.1"
1717
}
1818
},
19-
"severity": "HIGH",
19+
"severity": "MEDIUM",
2020
"source": "NVD",
21-
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6730",
21+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40897",
2222
"status": "ACTIVE",
23-
"title": "CVE-2023-6730 - transformers, transformers",
24-
"vulnerability_id": "CVE-2023-6730",
23+
"title": "CVE-2022-40897 - setuptools",
24+
"vulnerability_id": "CVE-2022-40897",
2525
"vulnerable_packages": [
2626
{
2727
"epoch": 0,
28-
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.31.0.dist-info/METADATA",
29-
"name": "transformers",
30-
"packageManager": "PYTHONPKG",
31-
"version": "4.31.0"
32-
},
33-
{
34-
"epoch": 0,
35-
"filePath": "requirements.txt",
36-
"name": "transformers",
37-
"packageManager": "PIP",
38-
"version": "4.31.0"
39-
}
40-
]
41-
},
42-
"CVE-2023-7018": {
43-
"description": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.",
44-
"remediation": {
45-
"recommendation": {
46-
"text": "None Provided"
47-
}
48-
},
49-
"score": 7.8,
50-
"score_details": {
51-
"cvss": {
52-
"adjustments": [],
53-
"score": 7.8,
54-
"scoreSource": "NVD",
55-
"scoringVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
56-
"version": "3.1"
57-
}
58-
},
59-
"severity": "HIGH",
60-
"source": "NVD",
61-
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7018",
62-
"status": "ACTIVE",
63-
"title": "CVE-2023-7018 - transformers, transformers",
64-
"vulnerability_id": "CVE-2023-7018",
65-
"vulnerable_packages": [
66-
{
67-
"epoch": 0,
68-
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.31.0.dist-info/METADATA",
69-
"name": "transformers",
28+
"filePath": "usr/local/lib/python3.10/site-packages/setuptools-59.5.0.dist-info/METADATA",
29+
"name": "setuptools",
7030
"packageManager": "PYTHONPKG",
71-
"version": "4.31.0"
72-
},
73-
{
74-
"epoch": 0,
75-
"filePath": "requirements.txt",
76-
"name": "transformers",
77-
"packageManager": "PIP",
78-
"version": "4.31.0"
31+
"version": "59.5.0"
7932
}
8033
]
8134
},
@@ -197,17 +150,17 @@
197150
"vulnerable_packages": [
198151
{
199152
"epoch": 0,
200-
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.31.0.dist-info/METADATA",
153+
"filePath": "usr/local/lib/python3.10/site-packages/transformers-4.36.0.dist-info/METADATA",
201154
"name": "transformers",
202155
"packageManager": "PYTHONPKG",
203-
"version": "4.31.0"
156+
"version": "4.36.0"
204157
},
205158
{
206159
"epoch": 0,
207160
"filePath": "requirements.txt",
208161
"name": "transformers",
209162
"packageManager": "PIP",
210-
"version": "4.31.0"
163+
"version": "4.36.0"
211164
}
212165
]
213166
},
@@ -282,5 +235,30 @@
282235
"version": "1.8.6"
283236
}
284237
]
238+
},
239+
"CVE-2024-6345": {
240+
"description": "A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.",
241+
"remediation": {
242+
"recommendation": {
243+
"text": "None Provided"
244+
}
245+
},
246+
"score": 0.0,
247+
"score_details": {},
248+
"severity": "UNTRIAGED",
249+
"source": "NVD",
250+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6345",
251+
"status": "ACTIVE",
252+
"title": "CVE-2024-6345 - setuptools",
253+
"vulnerability_id": "CVE-2024-6345",
254+
"vulnerable_packages": [
255+
{
256+
"epoch": 0,
257+
"filePath": "usr/local/lib/python3.10/site-packages/setuptools-59.5.0.dist-info/METADATA",
258+
"name": "setuptools",
259+
"packageManager": "PYTHONPKG",
260+
"version": "59.5.0"
261+
}
262+
]
285263
}
286264
}

0 commit comments

Comments
 (0)