Skip to content

Conversation

@ObadaS
Copy link
Collaborator

@ObadaS ObadaS commented Jun 10, 2025

A brief description of the purpose of the changes contained in this PR.

This PR updates the Containerfile.compute_worker_podman and Containerfile.compute_worker_podman_gpu.
Updated base image version to get the latest security fixes, removed all the unnecessary lines to create lighter images (especially the GPU image)

I also updated the compute_worker.py file to add more security and make it more compatible to Podman.

Checklist for hand testing

For Docker compute workers (compute_worker.py updates)

  • Test a submission on any competition

For Podman

  • Enable the podman service which will create the socket : systemctl --user enable --now podman
  • Build images : podman build -t codalab/codabench_worker_podman:latest -f Containerfile.compute_worker_podman
  • Create the /codabench folder
  • Create the data folder inside the /codabench
  • Chown it to the user that will run the podman container ( sudo chown -R user:user /codabench)
  • Create the .env file
  • Launch a container using the podman image we generated with the following command (either execute the command where the .env file is, or change the launch command below to have the full path of the .env):
podman run -d \
 --volume /run/user/$(id -u)/podman/podman.sock:/run/user/1000/podman/podman.sock:U \
 --env-file .env \
 --name compute_worker \
 --security-opt="label=disable" \
 --userns host \
 --restart unless-stopped \
 --log-opt max-size=50m \
 --log-opt max-file=3 \
 --cap-drop all \
 --volume /codabench:/codabench:U,z \
 codalab/codabench_worker_podman:latest

GPU command :

podman run -d \
    --env-file .env \
    --device nvidia.com/gpu=all \
    --name gpu_compute_worker \
    --device /dev/fuse \
    --security-opt="label=disable" \
    --restart unless-stopped \
    --log-opt max-size=50m \
    --log-opt max-file=3 \
    --hostname ${HOSTNAME} \
    --userns host \
    --volume /home/codalab/worker/codabench:/codabench:z,U \
    --cap-drop=all \
    --volume /run/user/$(id -u)/podman/podman.sock:/run/user/1000/podman/podman.sock:U \
    codalab/codabench_worker_podman_gpu:latest
  • Test the compute worker by submitting something on a competition

Checklist

  • Code review by me
  • Hand tested by me
  • I'm proud of my work
  • Code review by reviewer
  • Hand tested by reviewer
  • Include Podman in CircleCi tests
  • CircleCi tests are passing
  • Ready to merge

@ObadaS
Copy link
Collaborator Author

ObadaS commented Jun 12, 2025

I also wanted to note that I don't think the Circle-CI tests does anything with podman images, I am pretty sure that it only uses docker images build from Dockerfiles

@ObadaS ObadaS changed the title Podman updates Podman updates & More Competition container security Jun 18, 2025
@ihsaan-ullah
Copy link
Collaborator

✅ Test 1: Test if submission works using docker container (testing changes in compute_worker.py)

@wlln
Copy link
Collaborator

wlln commented Sep 25, 2025

It works on a fresh Almalinux 9.6 install with podman 5.4.0.
It also works on Archlinux with podman 5.4.0.

I haven't tested it with GPUs at the moment, though.

@Didayolo Didayolo mentioned this pull request Oct 7, 2025
3 tasks
@Didayolo Didayolo merged commit 30791eb into develop Oct 7, 2025
1 check passed
@Didayolo Didayolo deleted the podmanUpdates branch October 7, 2025 13:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants