Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docker/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -542,7 +542,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
else \
BITSANDBYTES_VERSION="0.46.1"; \
fi; \
uv pip install --system accelerate hf_transfer modelscope "bitsandbytes>=${BITSANDBYTES_VERSION}" 'timm>=1.0.17' 'runai-model-streamer[s3]>=0.14.0'
uv pip install --system accelerate hf_transfer modelscope "bitsandbytes>=${BITSANDBYTES_VERSION}" 'timm>=1.0.17' 'runai-model-streamer[s3,gcs]>=0.14.0'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

For reproducible builds, especially in a production Docker image (vllm-openai-base), it's crucial to pin dependency versions. The packages accelerate, hf_transfer, and modelscope are not pinned to a specific version. This could lead to unexpected issues or breakages in the future if a new version of these packages is released with breaking changes.

I recommend pinning these packages to known working versions using ==. For example:

    uv pip install --system \
        accelerate==<known_good_version> \
        hf_transfer==<known_good_version> \
        modelscope==<known_good_version> \
        "bitsandbytes>=${BITSANDBYTES_VERSION}" \
        'timm>=1.0.17' \
        'runai-model-streamer[s3,gcs]>=0.14.0'

While other packages in this line have minimum versions (>=), using exact versions (==) is generally safer for production images to ensure build stability.


ENV VLLM_USAGE_SOURCE production-docker-image

Expand Down