Patch PT 2.7 (SM, EC2, ARM64) , 2.8 (EC2 ) Training Images

pytorch/training/buildspec-arm64-2-7-ec2.yml

@@ -5,7 +5,7 @@ framework: &FRAMEWORK pytorch
 version: &VERSION 2.7.0
 short_version: &SHORT_VERSION "2.7"
 arch_type: arm64
-autopatch_build: "True"
+#autopatch_build: "True"
 
 repository_info:
   training_repository: &TRAINING_REPOSITORY

pytorch/training/docker/2.7/py3/Dockerfile.cpu

@@ -182,8 +182,12 @@ RUN pip install --no-cache-dir \
     "idna>=3.7" \
     "tqdm>=4.66.3" \
     "requests>=2.32.0" \
-    "setuptools>=70.0.0" \
+    "setuptools>=75.0.0" \
     "urllib3>=2.5.0" \
+    "pyasn1>=0.6.2" \
+    "wheel>=0.46.2" \
+    pytz \
+    tzdata \
     "awscli<2" \
     "opencv-python==4.11.0.86" \
     mpi4py \

pytorch/training/docker/2.7/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+    "85151": "DoS vulnerability in protobuf <=6.33.4. Fix requires protobuf>6.33.4, but SageMaker SDK 2.9.0-3.0 constraint protobuf<6.32 prevents upgrade. This is SageMaker-specific and does not affect EC2 images."
+}

pytorch/training/docker/2.7/py3/Dockerfile.sagemaker.cpu.py_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+    "85151": "DoS vulnerability in protobuf <=6.33.4. Fix requires protobuf>6.33.4, but SageMaker SDK 2.9.0-3.0 constraint protobuf<6.32 prevents upgrade. This is SageMaker-specific and does not affect EC2 images."
+}

pytorch/training/docker/2.7/py3/cu128/Dockerfile.arm64.gpu

@@ -187,6 +187,7 @@ RUN python -m pip install --upgrade pip --trusted-host pypi.org --trusted-host f
 
 # Install pip packages
 RUN pip install --no-cache-dir \
+    "setuptools>=75.0.0" \
     cython \
     boto3 \
     scipy \

pytorch/training/docker/2.7/py3/cu128/Dockerfile.gpu

@@ -57,7 +57,7 @@ RUN chmod +x /usr/local/bin/bash_telemetry.sh \
 
 RUN pip install --no-cache-dir \
     numpy \
-    "setuptools>=70.0.0"  \
+    "setuptools>=75.0.0"  \
     ninja \
     cython \
     pybind11 \
@@ -137,6 +137,10 @@ RUN pip install --no-cache-dir \
     "tqdm>=4.66.3" \
     "requests>=2.32.0" \
     "urllib3>=2.5.0" \
+    "pyasn1>=0.6.2" \
+    "wheel>=0.46.2" \
+    pytz \
+    tzdata \
     "awscli>=1.42.14,<2" \
     # opencv-python 4.12.0.88 reuqires numpy<2.3.0, which is not compatible with previous prod image(2.3.1)
     "opencv-python==4.11.0.86" \
@@ -235,4 +239,4 @@ RUN bash setup_oss_compliance.sh ${PYTHON} && rm setup_oss_compliance.sh
 RUN rm -rf /root/.cache | true
 
 ENTRYPOINT ["bash", "-m", "start_with_right_hostname.sh"]
-CMD ["/bin/bash"]
+CMD ["/bin/bash"]

pytorch/training/docker/2.7/py3/cu128/Dockerfile.sagemaker.gpu.os_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+    "85151": "DoS vulnerability in protobuf <=6.33.4. Fix requires protobuf>6.33.4, but SageMaker SDK 2.9.0-3.0 constraint protobuf<6.32 prevents upgrade. This is SageMaker-specific and does not affect EC2 images."
+}

pytorch/training/docker/2.7/py3/cu128/Dockerfile.sagemaker.gpu.py_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+    "85151": "DoS vulnerability in protobuf <=6.33.4. Fix requires protobuf>6.33.4, but SageMaker SDK 2.9.0-3.0 constraint protobuf<6.32 prevents upgrade. This is SageMaker-specific and does not affect EC2 images."
+}

pytorch/training/docker/2.8/py3/Dockerfile.cpu

@@ -186,8 +186,12 @@ RUN pip install --no-cache-dir \
     "idna>=3.7" \
     "tqdm>=4.66.3" \
     "requests>=2.32.0" \
-    "setuptools>=70.0.0" \
+    "setuptools>=75.0.0" \
     "urllib3>=2.5.0" \
+    "pyasn1>=0.6.2" \
+    "wheel>=0.46.2" \
+    pytz \
+    tzdata \
     awscli \
     opencv-python==4.11.0.86 \
     mpi4py \
@@ -288,7 +292,7 @@ RUN pip install --no-cache-dir -U \
     sagemaker-pytorch-training \
     sagemaker-training \
     # Add sniffio explicitly as it's not included in sagemaker==2.254.1 dependencies
-    sniffio  
+    sniffio
 
 # Install extra packages
 RUN pip install --no-cache-dir -U \
@@ -314,4 +318,3 @@ RUN bash setup_oss_compliance.sh ${PYTHON} && rm setup_oss_compliance.sh
 
 ENTRYPOINT ["bash", "-m", "start_with_right_hostname.sh"]
 CMD ["/bin/bash"]
-

pytorch/training/docker/2.8/py3/Dockerfile.sagemaker.cpu.py_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+    "85151": "DoS vulnerability in protobuf <=6.33.4. Fix requires protobuf>6.33.4, but SageMaker SDK 2.254.1 constrains protobuf. This is SageMaker-specific and does not affect EC2 images."
+}

pytorch/training/docker/2.8/py3/cu129/Dockerfile.gpu

@@ -105,8 +105,12 @@ RUN pip install --no-cache-dir \
     "idna>=3.7" \
     "tqdm>=4.66.3" \
     "requests>=2.32.0" \
-    "setuptools>=70.0.0" \
+    "setuptools>=75.0.0" \
     "urllib3>=2.5.0" \
+    "pyasn1>=0.6.2" \
+    "wheel>=0.46.2" \
+    pytz \
+    tzdata \
     ninja \
     opencv-python==4.11.0.86 \
     mpi4py \
@@ -289,4 +293,4 @@ RUN apt-get update \
  && rm -rf /var/lib/apt/lists/*
 
 ENTRYPOINT ["bash", "-m", "start_with_right_hostname.sh"]
-CMD ["/bin/bash"]
+CMD ["/bin/bash"]

pytorch/training/docker/2.8/py3/cu129/Dockerfile.sagemaker.gpu.py_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+    "85151": "DoS vulnerability in protobuf <=6.33.4. Fix requires protobuf>6.33.4, but SageMaker SDK 2.254.1 constrains protobuf. This is SageMaker-specific and does not affect EC2 images."
+}