[DRAFT] Docker images for CSCS

docker/cscs/Dockerfile

@@ -0,0 +1,39 @@
+FROM nvcr.io/nvidia/pytorch:24.12-py3
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  nano curl ffmpeg \
+  libsm6 libxext6 libnss3 \
+  libxi6 libxrandr2 libxcomposite1 libxcursor1 libxdamage1 libxfixes3 libxrender1 \
+  libasound2t64 libatk1.0-0 libgtk-3-0 libreoffice libjpeg-dev libpango-1.0-0 \
+  python3-lxml \
+  && ln -fs /usr/share/zoneinfo/Europe/Zurich /etc/localtime \
+  && echo "Europe/Zurich" > /etc/timezone \
+  && rm -rf /var/lib/apt/lists/*
+
+# You should not add the cu126 extra as the base image already contains torch
+ARG UV_OVERRIDE
+ENV UV_ARGUMENTS="--extra all"
+ENV UV_ARGUMENTS=${UV_OVERRIDE:-$UV_ARGUMENTS}
+
+WORKDIR /app
+
+# Set up Python virtual environment
+RUN python -m venv --system-site-packages .venv \
+  && .venv/bin/pip install --no-cache-dir uv weasyprint
+
+# Install dependencies (cached unless uv.lock changes)
+# torch/torchvision are already provided by the base image
+COPY pyproject.toml uv.lock /app/
+RUN .venv/bin/uv sync --frozen --no-install-project ${UV_ARGUMENTS} \
+  --no-install-package torch --no-install-package torchvision
+
+# Install mmore from local source code
+COPY . /app
+RUN .venv/bin/uv pip install --no-cache --no-deps -e .
+
+# Runtime
+ENV PATH="/app/.venv/bin:$PATH"
+ENV DASK_DISTRIBUTED__WORKER__DAEMON=False
+
+ENTRYPOINT ["/bin/bash"]

docker/cscs/README.md

@@ -0,0 +1,26 @@
+# CSCS (NVIDIA PyTorch)
+
+Based on `nvcr.io/nvidia/pytorch:24.12-py3`. This image is tailored for [CSCS](https://www.cscs.ch/) clusters, where the base image provides CUDA, cuDNN, and PyTorch pre-installed.
+
+## Build
+
+CSCS Alps uses ARM64 (`linux/arm64`). If building from a non-ARM host, pass `--platform linux/arm64`.
+
+```bash
+sudo docker build -f docker/cscs/Dockerfile --platform linux/arm64 -t mmore:cscs .
+```
+
+Custom extras (overrides the default `--extra all`):
+
+```bash
+sudo docker build -f docker/cscs/Dockerfile --platform linux/arm64 --build-arg UV_OVERRIDE="--extra all" -t mmore:cscs .
+```
+
+## Push to a registry
+
+Tag and push to a registry accessible from CSCS (replace `<registry>` with your target):
+
+```bash
+docker tag mmore:cscs <registry>/mmore:latest
+docker push <registry>/mmore:latest
+```

docker/leap/Dockerfile

@@ -15,6 +15,9 @@ FROM ${DEVICE:-gpu} AS build
 ARG UV_OVERRIDE
 ENV UV_ARGUMENTS=${UV_OVERRIDE:-$UV_ARGUMENTS}
 
+ARG USER_UID=1000
+ARG USER_GID=1000
+
 # Install system dependencies
 RUN zypper --non-interactive refresh && \
     zypper --non-interactive install -y \
@@ -27,18 +30,24 @@ RUN zypper --non-interactive refresh && \
     echo "Europe/Zurich" > /etc/timezone && \
     zypper clean --all
 
+# Create non-root user
+RUN groupadd --gid ${USER_GID} mmoreuser \
+ && useradd --uid ${USER_UID} --gid ${USER_GID} -m mmoreuser
+
 WORKDIR /app
+RUN chown mmoreuser:mmoreuser /app
+USER mmoreuser
 
 # Set up Python virtual environment
 RUN python3.11 -m venv .venv \
  && .venv/bin/pip install --no-cache-dir uv weasyprint
 
 # Install dependencies (cached unless uv.lock changes)
-COPY pyproject.toml uv.lock /app/
+COPY --chown=mmoreuser:mmoreuser pyproject.toml uv.lock /app/
 RUN .venv/bin/uv sync --frozen --no-install-project ${UV_ARGUMENTS}
 
 # Install mmore from local source code
-COPY . /app
+COPY --chown=mmoreuser:mmoreuser . /app
 RUN .venv/bin/uv pip install --no-cache --no-deps -e .
 
 # --- Runtime ---

docker/leap/README.md

@@ -1,6 +1,6 @@
 # openSUSE Leap
 
-Based on `opensuse/leap:15.6`. This image targets CSCS rather than RCP, and therefore does not create a non-root user.
+Based on `opensuse/leap:15.6`.
 
 ## Build
 
@@ -24,12 +24,17 @@ Custom extras (overrides the default `--extra all,cu126` or `--extra all,cpu`):
 sudo docker build -f docker/leap/Dockerfile --build-arg UV_OVERRIDE="--extra all,cu126" -t mmore:leap .
 ```
 
+Custom user UID/GID (e.g. for RCP):
+```bash
+sudo docker build -f docker/leap/Dockerfile --build-arg USER_UID=$(id -u) --build-arg USER_GID=$(id -g) -t mmore:leap .
+```
+
 ## Run
 
 ```bash
 # GPU
-sudo docker run --gpus all -it -v ./examples:/app/examples -v ./.cache:/root/.cache mmore:leap
+sudo docker run --gpus all -it -v ./examples:/app/examples -v ./.cache:/mmoreuser/.cache mmore:leap
 
 # CPU-only
-sudo docker run -it -v ./examples:/app/examples -v ./.cache:/root/.cache mmore:leap-cpu
+sudo docker run -it -v ./examples:/app/examples -v ./.cache:/mmoreuser/.cache mmore:leap-cpu
 ```

docs/rcp_and_production.md

@@ -2,6 +2,8 @@
 
 This document provides comprehensive guidelines for deploying MMORE on the RCP (and later to production).
 
+> **Deploying on CSCS?** A dedicated Docker image is available: see the [CSCS Dockerfile README](../docker/cscs/README.md).
+
 ## Docker Image Requirements
 
 **Important**: You must build your own Docker image with your specific user ID and group ID to avoid permission issues in the production environment.