Skip to content

fix(gpu): unbreak the GPU image — ARG scope, glibc floor, uid 1000 collision #628

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kriszyp merged 3 commits into from
Jul 31, 2026
Merged

fix(gpu): unbreak the GPU image — ARG scope, glibc floor, uid 1000 collision #628

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b7cf231
fix(gpu): declare CUDA_RUNTIME_IMAGE before the first FROM
kriszyp Jul 29, 2026
4373340
fix(gpu): use the ubuntu24.04 CUDA base so bundled uWS can load
kriszyp Jul 29, 2026
9c4b47e
fix(gpu): reclaim uid 1000 for harperdb, and fail the setup block loudly
kriszyp Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 34 additions & 8 deletions Dockerfile-gpu
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,23 @@
ARG NODE_BUILD_VERSION=24
ARG NODE_VERSION=24

# Runtime base. CUDA 13.x supports Turing (SM 7.5 / T4) — Turing is the minimum
# architecture in the 13.x line (Maxwell/Pascal/Volta were dropped). The 13.x
# runtime requires an R580+ host driver; on hosts pinned to an older driver
# branch, override with a CUDA 12.x cudnn-runtime base, e.g.:
# --build-arg CUDA_RUNTIME_IMAGE=nvidia/cuda:12.6.3-cudnn-runtime-ubuntu24.04
#
# Keep the ubuntu24.04 variant (glibc 2.39) whichever CUDA line you pick. This
# image bundles uWebSockets.js (copied from the build stage below), whose
# prebuilt Linux binaries link against GLIBC_2.38 — ubuntu22.04 ships glibc 2.35
# and the addon fails to load there, the same failure that put the standard
# image on Debian trixie. See the note at the top of ./Dockerfile.
#
# Must stay above the first FROM: an ARG referenced by a FROM has to be declared
# in the global scope, before any stage. Declared after a FROM it belongs to that
# stage, and the later FROM expands it to an empty base name.
ARG CUDA_RUNTIME_IMAGE=nvidia/cuda:13.3.0-cudnn-runtime-ubuntu24.04

@DavidCockerill DavidCockerill Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The glibc floor is documented, not enforced. The ARG exists to be overridden for older driver branches — you say so right here — so an override to a -ubuntu22.04 tag is a supported action that silently reproduces the uWS breakage this PR is fixing, with no build-time signal.

The property worth having: the run stage should fail the build if the bundled uWS binary can't load on the chosen base, rather than deferring it to container start. The repo already does build-time assertions of this kind — ./Dockerfile runs check-native-abi-pointer-compression.js and fails on a native-ABI mismatch — so this would be consistent rather than new machinery.

Non-blocking; your call whether it's worth the layer.

@kriszyp kriszyp Jul 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, and leaving this one open — the change moved the default base to ubuntu24.04, but your point stands: the ARG exists to be overridden, an override to a -ubuntu22.04 tag is supported, and nothing fails the build when the bundled uWS binary can't load on the chosen base.

Worth noting the precedent got stronger this week. #637 adds harper version as a build-time assertion on the install for exactly this reason — a documented expectation that isn't enforced eventually ships. The uWS/glibc floor is the same shape: cheap to assert at build time (load the addon in the run stage and fail), expensive to discover at container start.

Not folding it into this PR since it's a separate property from the three fixes here, but it shouldn't get lost. Happy to take it as a follow-up if you'd rather not block this one on it.

— KrAIs (Claude Opus 5)


FROM docker.io/node:${NODE_BUILD_VERSION} AS build

WORKDIR /usr/src/harper-pro
Expand All @@ -9,12 +26,6 @@ COPY . .

RUN env NO_USE_GIT=true npm run package

# Runtime base. CUDA 13.x supports Turing (SM 7.5 / T4) — Turing is the minimum
# architecture in the 13.x line (Maxwell/Pascal/Volta were dropped). The 13.x
# runtime requires an R580+ host driver; on hosts pinned to an older driver
# branch, override with a CUDA 12.x cudnn-runtime base, e.g.:
# --build-arg CUDA_RUNTIME_IMAGE=nvidia/cuda:12.6.3-cudnn-runtime-ubuntu22.04
ARG CUDA_RUNTIME_IMAGE=nvidia/cuda:13.3.0-cudnn-runtime-ubuntu22.04
FROM ${CUDA_RUNTIME_IMAGE} AS run

ARG NODE_VERSION=24
Expand All @@ -38,8 +49,23 @@ RUN <<-EOF
| tee /etc/apt/sources.list.d/nodesource.list
apt-get update
apt-get install -y nodejs
groupadd --gid 1000 harperdb
useradd --uid 1000 --gid 1000 --home-dir /home/harperdb --shell /bin/bash --no-create-home harperdb
# harperdb must own uid/gid 1000 — existing deployments' data volumes are
# chowned to it — so reclaim the id from any incumbent rather than moving
# harperdb. Ubuntu 24.04 bases ship a default `ubuntu` user at 1000; 22.04
# bases ship none, and CUDA_RUNTIME_IMAGE is overridable, so handle both.
# Renaming (as ./Dockerfile does for node:*'s `node` user) keeps the id stable.
EXISTING_USER="$(getent passwd 1000 | cut -d: -f1)" || true
if [ -n "$EXISTING_USER" ]; then
EXISTING_GROUP="$(getent group 1000 | cut -d: -f1)" || true
usermod -d /home/harperdb -l harperdb "$EXISTING_USER"
if [ -n "$EXISTING_GROUP" ]; then
groupmod -n harperdb "$EXISTING_GROUP"
fi
rm -rf "/home/$EXISTING_USER"
else
groupadd --gid 1000 harperdb
useradd --uid 1000 --gid 1000 --home-dir /home/harperdb --shell /bin/bash --no-create-home harperdb
fi
mkdir -p /home/harperdb
chown harperdb:harperdb /home/harperdb
rm -rf /var/lib/apt/lists/*
Expand Down
Loading