modal 1.6.3.dev11__tar.gz → 1.6.3.dev13__tar.gz

{modal-1.6.3.dev11 → modal-1.6.3.dev13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modal
-Version: 1.6.3.dev11
+Version: 1.6.3.dev13
 Summary: Python client library for Modal
 Author-email: Modal Labs <support@modal.com>
 License-Expression: Apache-2.0
@@ -23,7 +23,7 @@ Requires-Dist: grpclib<0.4.10,>=0.4.7; python_version < "3.14"
 Requires-Dist: grpclib<0.4.10,>=0.4.9; python_version >= "3.14"
 Requires-Dist: protobuf!=4.24.0,<8.0,>=3.19
 Requires-Dist: rich>=12.0.0
-Requires-Dist: synchronicity~=0.12.6
+Requires-Dist: synchronicity~=0.12.7
 Requires-Dist: toml
 Requires-Dist: types-certifi
 Requires-Dist: types-toml
@@ -33,6 +33,8 @@ Requires-Dist: typing_extensions>=4.14; python_version >= "3.15"
 Provides-Extra: api-proxy-support
 Requires-Dist: python-socks[asyncio]>=2.5; extra == "api-proxy-support"
 Requires-Dist: aiohttp-socks>=0.8; extra == "api-proxy-support"
+Provides-Extra: oauth
+Requires-Dist: pyjwt[crypto]>=2.7; extra == "oauth"
 Dynamic: license-file
 
 # Modal Python SDK

{modal-1.6.3.dev11 → modal-1.6.3.dev13}/modal/_image.py

@@ -40,6 +40,7 @@ from ._utils.blob_utils import MAX_OBJECT_SIZE_BYTES
 from ._utils.docker_utils import (
     extract_copy_command_patterns,
     find_dockerignore_file,
+    is_multi_stage_dockerfile,
     splittable_from_line_index,
 )
 from ._utils.function_utils import FunctionSourceInfo, parse_gpu_config
@@ -70,8 +71,8 @@ if typing.TYPE_CHECKING:
     import modal.client
 
 # This is used for both type checking and runtime validation
-ImageBuilderVersion = Literal["2023.12", "2024.04", "2024.10", "2025.06", "PREVIEW"]
-LATEST_IMAGE_BUILDER_VERSION: ImageBuilderVersion = "2025.06"
+ImageBuilderVersion = Literal["2023.12", "2024.04", "2024.10", "2025.06", "2026.10", "PREVIEW"]
+LATEST_IMAGE_BUILDER_VERSION: ImageBuilderVersion = "2026.10"
 
 # Note: we also define supported Python versions via logic at the top of the package __init__.py
 # so that we fail fast / clearly in unsupported containers. Additionally, we enumerate the supported
@@ -79,6 +80,7 @@ LATEST_IMAGE_BUILDER_VERSION: ImageBuilderVersion = "2025.06"
 # Consider consolidating these multiple sources of truth?
 SUPPORTED_PYTHON_SERIES: dict[ImageBuilderVersion, list[str]] = {
     "PREVIEW": ["3.11", "3.12", "3.13", "3.14", "3.14t", "3.15", "3.15t"],
+    "2026.10": ["3.11", "3.12", "3.13", "3.14", "3.14t", "3.15", "3.15t"],
     "2025.06": ["3.10", "3.11", "3.12", "3.13", "3.14", "3.14t", "3.15", "3.15t"],
     "2024.10": ["3.10", "3.11", "3.12", "3.13"],
     "2024.04": ["3.10", "3.11", "3.12"],
@@ -445,6 +447,40 @@ def _create_context_mount_function(
         return auto_created_context_mount_fn
 
 
+_REGISTRY_AUTH_KEY_SETS: dict["api_pb2.RegistryAuthType.ValueType", list[set[str]]] = {
+    api_pb2.REGISTRY_AUTH_TYPE_AWS: [
+        {"AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"},
+        {"AWS_ROLE_ARN", "AWS_REGION"},
+    ],
+    api_pb2.REGISTRY_AUTH_TYPE_GCP: [{"SERVICE_ACCOUNT_JSON"}],
+    api_pb2.REGISTRY_AUTH_TYPE_STATIC_CREDS: [{"REGISTRY_USERNAME", "REGISTRY_PASSWORD"}],
+}
+
+_REGISTRY_AUTH_NAMES = {
+    api_pb2.REGISTRY_AUTH_TYPE_AWS: "AWS",
+    api_pb2.REGISTRY_AUTH_TYPE_GCP: "GCP",
+    api_pb2.REGISTRY_AUTH_TYPE_STATIC_CREDS: "username and password",
+}
+
+_REGISTRY_SECRET_KEYS_HELP = (
+    "Registry Secret must include exactly one of: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_REGION "
+    "(or AWS_ROLE_ARN and AWS_REGION) for AWS ECR; SERVICE_ACCOUNT_JSON for GCP Artifact Registry; "
+    "or REGISTRY_USERNAME and REGISTRY_PASSWORD for other registries."
+)
+
+
+def _infer_registry_auth_type(keys: set[str]) -> "api_pb2.RegistryAuthType.ValueType":
+    matches = [auth for auth, key_sets in _REGISTRY_AUTH_KEY_SETS.items() if any(ks <= keys for ks in key_sets)]
+    if not matches:
+        raise InvalidError(f"{_REGISTRY_SECRET_KEYS_HELP} Found keys: {', '.join(sorted(keys)) or 'none'}.")
+    if len(matches) > 1:
+        names = ", ".join(_REGISTRY_AUTH_NAMES[auth] for auth in matches)
+        raise InvalidError(
+            f"Registry Secret has keys for more than one kind of authentication ({names}). {_REGISTRY_SECRET_KEYS_HELP}"
+        )
+    return matches[0]
+
+
 class _ImageRegistryConfig:
     """mdmd:hidden"""
 
@@ -453,13 +489,21 @@ class _ImageRegistryConfig:
         # TODO: change to _PUBLIC after worker starts handling it.
         registry_auth_type: "api_pb2.RegistryAuthType.ValueType" = api_pb2.REGISTRY_AUTH_TYPE_UNSPECIFIED,
         secret: _Secret | None = None,
+        *,
+        infer_auth_type: bool = False,
     ):
         self.registry_auth_type = registry_auth_type
         self.secret = secret
-
-    def get_proto(self) -> api_pb2.ImageRegistryConfig:
+        self.infer_auth_type = infer_auth_type
+
+    async def get_proto(self) -> api_pb2.ImageRegistryConfig:
+        registry_auth_type = self.registry_auth_type
+        if self.infer_auth_type and self.secret:
+            # The Secret is an Image dependency, so it's hydrated by now and its keys are cached
+            keys = await self.secret._get_keys()
+            registry_auth_type = _infer_registry_auth_type(keys)
         return api_pb2.ImageRegistryConfig(
-            registry_auth_type=self.registry_auth_type,
+            registry_auth_type=registry_auth_type,
             secret_id=(self.secret.object_id if self.secret else ""),
         )
 
@@ -762,7 +806,7 @@ class _Image(_Object, type_prefix="im"):
                 secret_ids=[secret.object_id for secret in secrets],
                 context_mount_id=(context_mount.object_id if context_mount else ""),
                 gpu_config=gpu_config,
-                image_registry_config=image_registry_config.get_proto(),
+                image_registry_config=await image_registry_config.get_proto(),
                 runtime=config.get("function_runtime"),
                 runtime_debug=config.get("function_runtime_debug"),
                 build_function=_build_function,
@@ -2255,16 +2299,21 @@ class _Image(_Object, type_prefix="im"):
         remaining commands run. This might be useful if you want a custom Python installation or to
         set a `SHELL`. Prefer `run_commands()` when possible though.
 
-        To authenticate against a private registry with static credentials, you must set the `secret` parameter to
-        a `modal.Secret` containing a username (`REGISTRY_USERNAME`) and
-        an access token or password (`REGISTRY_PASSWORD`).
+        To pull from a private registry, set the `secret` parameter to a `modal.Secret` holding
+        registry credentials. The kind of authentication follows from the keys in the Secret:
+
+        - AWS ECR: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and `AWS_REGION` (optionally `AWS_SESSION_TOKEN`),
+          or `AWS_ROLE_ARN` and `AWS_REGION` to assume a role with [OIDC](https://modal.com/docs/guide/oidc-integration).
+          See `Image.from_aws_ecr()` for details.
+        - GCP Artifact Registry: `SERVICE_ACCOUNT_JSON`, holding the service account key's JSON.
+          See `Image.from_gcp_artifact_registry()` for details.
+        - Other registries: a username (`REGISTRY_USERNAME`) and an access token or password (`REGISTRY_PASSWORD`).
 
-        To authenticate against private registries with credentials from a cloud provider,
-        use `Image.from_gcp_artifact_registry()` or `Image.from_aws_ecr()`.
+        The Secret must have the keys for exactly one of these; otherwise an error is raised.
 
         Args:
             tag: Registry image reference (e.g. ``python:3.11-slim``).
-            secret: Optional secret for static registry credentials.
+            secret: Optional Secret with registry credentials; its keys determine the kind of authentication.
             setup_dockerfile_commands: Extra Dockerfile lines run after ``FROM`` during base setup.
             force_build: If True, skip cached image builds.
             add_python: Optional standalone Python series to inject when the base image lacks Python.
@@ -2278,6 +2327,10 @@ class _Image(_Object, type_prefix="im"):
             modal.Image.from_registry("python:3.11-slim-bookworm")
             modal.Image.from_registry("ubuntu:22.04", add_python="3.11")
             modal.Image.from_registry("nvcr.io/nvidia/pytorch:22.12-py3")
+            modal.Image.from_registry(
+                "ghcr.io/my-org/my-image:latest",
+                secret=modal.Secret.from_name("my-registry-secret"),
+            )
             ```
         """
 
@@ -2292,7 +2345,7 @@ class _Image(_Object, type_prefix="im"):
             )
 
         if "image_registry_config" not in kwargs and secret is not None:
-            kwargs["image_registry_config"] = _ImageRegistryConfig(api_pb2.REGISTRY_AUTH_TYPE_STATIC_CREDS, secret)
+            kwargs["image_registry_config"] = _ImageRegistryConfig(secret=secret, infer_auth_type=True)
 
         def build_dockerfile(version: ImageBuilderVersion) -> DockerfileSpec:
             commands = _Image._registry_setup_commands(tag, version, setup_dockerfile_commands, add_python)
@@ -2472,28 +2525,33 @@ class _Image(_Object, type_prefix="im"):
         *,
         force_build: bool = False,
         context_dir: Path | str | None = None,
-        env: dict[str, str | None] | None = None,
+        ignore: Sequence[str] | Callable[[Path], bool] = AUTO_DOCKERIGNORE,
+        build_args: dict[str, str] = {},
+        registry_secret: _Secret | None = None,
         secrets: Collection[_Secret] | None = None,
+        env: dict[str, str | None] | None = None,
         gpu: str | None = None,
         add_python: str | None = None,
-        build_args: dict[str, str] = {},
-        ignore: Sequence[str] | Callable[[Path], bool] = AUTO_DOCKERIGNORE,
     ) -> "_Image":
         """Build a Modal image from a local Dockerfile.
 
         If your Dockerfile does not have Python installed, you can use the `add_python` parameter
         to specify a version of Python to add to the image.
 
+        A `registry_secret` can be provided to pull the base image from a private registry.
+        Currently this is supported only for single-stage Dockerfiles.
+
         Args:
             path: Path to the Dockerfile on the local machine.
             force_build: If True, skip cached image builds.
             context_dir: Build context directory for resolving relative COPY paths.
+            ignore: Ignore rules for the implicit context mount (defaults to auto ``.dockerignore`` behavior).
+            build_args: Dockerfile ``ARG`` values forwarded to the build.
+            registry_secret: Optional Secret with credentials for pulling the base image from a private registry.
+            secrets: Secrets injected as environment variables in the build container.
             env: Environment variables set in the build container.
-            secrets: Secrets injected as environment variables during the build.
-            gpu: GPU type to attach to the builder container.
+            gpu: GPU type to attach to the build container.
             add_python: Standalone Python version to add when the Dockerfile does not install Python.
-            build_args: Dockerfile ``ARG`` values forwarded to the build.
-            ignore: Ignore rules for the implicit context mount (defaults to auto ``.dockerignore`` behavior).
 
         Returns:
             An `Image` built from the Dockerfile plus Modal runtime dependencies.
@@ -2539,6 +2597,12 @@ class _Image(_Object, type_prefix="im"):
                 add_python="3.12",
                 ignore=FilePatternMatcher.from_file("/path/to/dockerignore"),
             )
+
+            # Pull the Dockerfile's base image from a private registry.
+            image = modal.Image.from_dockerfile(
+                "./Dockerfile",
+                registry_secret=modal.Secret.from_name("my-registry-secret"),
+            )
             ```
         """
 
@@ -2551,7 +2615,15 @@ class _Image(_Object, type_prefix="im"):
             ignore=ignore, dockerfile_path=Path(path), context_dir=context_dir
         )
 
-        def dockerfile_image(commands: list[str], base_images: dict[str, _Image] | None = None) -> _Image:
+        registry_config = (
+            _ImageRegistryConfig(secret=registry_secret, infer_auth_type=True) if registry_secret is not None else None
+        )
+
+        def dockerfile_image(
+            commands: list[str],
+            base_images: dict[str, _Image] | None = None,
+            image_registry_config: _ImageRegistryConfig | None = None,
+        ) -> _Image:
             return _Image._from_args(
                 base_images=base_images,
                 dockerfile_function=lambda version: DockerfileSpec(commands=commands, context_files={}),
@@ -2559,13 +2631,10 @@ class _Image(_Object, type_prefix="im"):
                 gpu_config=gpu_config,
                 secrets=secrets,
                 build_args=build_args,
+                image_registry_config=image_registry_config,
                 force_build=force_build,
             )
 
-        # --- Now add in the modal dependencies, and, optionally a Python distribution
-        # This happening in two steps is probably a vestigial consequence of previous limitations,
-        # but it will be difficult to merge them without forcing rebuilds of images.
-
         def add_python_mount(builder_version: ImageBuilderVersion) -> _Mount | None:
             return (
                 _Mount.from_name(
@@ -2601,24 +2670,36 @@ class _Image(_Object, type_prefix="im"):
                 )
             with open(os.path.expanduser(path)) as f:
                 dockerfile_lines = f.read().split("\n")
+            if registry_secret is not None and is_multi_stage_dockerfile(dockerfile_lines):
+                raise InvalidError("`registry_secret` is not supported with multi-stage Dockerfiles.")
 
             # Builder versions after 2025.06 put the FROM line of a single-stage Dockerfile in its own image.
             # Dockerfiles the split could change (see splittable_from_line_index) stay in one layer.
             from_index = splittable_from_line_index(dockerfile_lines) if builder_version > "2025.06" else None
             if from_index is None:
-                image = python_image(dockerfile_image(dockerfile_lines))
+                image = dockerfile_image(dockerfile_lines, image_registry_config=registry_config)
             else:
-                from_lines = dockerfile_lines[: from_index + 1]
+                # Drop the lines above FROM so Dockerfiles that differ only in header comments or blank lines
+                # share the cached image. Those lines can only be comments or blank lines, since
+                # splittable_from_line_index rejects parser directives.
+                from_lines = [dockerfile_lines[from_index]]
+                # Only this layer pulls from the registry; the layers above it build on top of it.
                 from_image = _Image._from_args(
                     dockerfile_function=lambda version: DockerfileSpec(commands=from_lines, context_files={}),
+                    image_registry_config=registry_config,
                     force_build=force_build,
                 )
                 rest = dockerfile_lines[from_index + 1 :]
                 rest_is_empty = all(not line.strip() or line.strip().startswith("#") for line in rest)
                 if rest_is_empty:
-                    image = python_image(from_image)
+                    image = from_image
                 else:
-                    image = python_image(dockerfile_image(["FROM base", *rest], base_images={"base": from_image}))
+                    image = dockerfile_image(["FROM base", *rest], base_images={"base": from_image})
+            if add_python or builder_version <= "2025.06":
+                # Before 2025.06 we always created a python_image() layer because it's where we installed the
+                # client dependencies. From 2025.06, we no longer install client dependencies in base layers,
+                # so this was a no-op layer when add_python= is not used. Skip it on later image builders.
+                image = python_image(image)
             await resolver.load(image, load_context)
             self._hydrate_from_other(image)
             self._serve_mounts = image._serve_mounts

{modal-1.6.3.dev11 → modal-1.6.3.dev13}/modal/_utils/docker_utils.py

@@ -79,6 +79,15 @@ _FROM_ALIAS_PATTERN = re.compile(r"\sAS\s+\S+\s*$", re.IGNORECASE)
 _PARSER_DIRECTIVE_PATTERN = re.compile(r"^#\s*[a-zA-Z][a-zA-Z0-9]*\s*=")
 
 
+def is_multi_stage_dockerfile(dockerfile_lines: Sequence[str]) -> bool:
+    """Return whether more than one line starts with a FROM instruction.
+
+    Can have false-positives for Dockerfiles with a Heredoc bodies of continuation lines
+    that contain "from" tokens.
+    """
+    return sum(1 for line in dockerfile_lines if _FROM_PATTERN.match(line)) > 1
+
+
 def splittable_from_line_index(dockerfile_lines: Sequence[str]) -> int | None:
     """Return the line index of the FROM instruction if it can be built as its own image.
 
@@ -96,7 +105,7 @@ def splittable_from_line_index(dockerfile_lines: Sequence[str]) -> int | None:
         return None
     if any(_PARSER_DIRECTIVE_PATTERN.match(line.strip()) for line in dockerfile_lines[:start]):
         return None
-    if any(_FROM_PATTERN.match(line) for line in dockerfile_lines[start + 1 :]):
+    if is_multi_stage_dockerfile(dockerfile_lines):
         return None
     return start
 

{modal-1.6.3.dev11 → modal-1.6.3.dev13}/modal/_utils/grpc_utils.py

@@ -9,7 +9,7 @@ import time
 import typing
 import urllib.parse
 import uuid
-from collections.abc import AsyncIterator, Sequence
+from collections.abc import AsyncIterator, Callable, Mapping, Sequence
 from dataclasses import dataclass, field
 from functools import cache
 from typing import Any, Optional, TypeVar, Union
@@ -42,6 +42,7 @@ from .logger import logger
 
 RequestType = TypeVar("RequestType", bound=Message)
 ResponseType = TypeVar("ResponseType", bound=Message)
+MetadataProvider = Callable[[], Mapping[str, str]]
 
 if typing.TYPE_CHECKING:
     import modal._grpc_client
@@ -224,17 +225,29 @@ class ConnectionManager:
     should share the same connection.
     """
 
-    def __init__(self, client: "modal.client._Client", metadata: dict[str, str] = {}):
+    def __init__(
+        self,
+        client: "modal.client._Client",
+        metadata: dict[str, str] = {},
+        metadata_provider: MetadataProvider | None = None,
+    ):
         self._client = client
         # This metadata is injected into all requests on all channels created by this manager.
         self._metadata = metadata
+        self._metadata_provider = metadata_provider
         self._channels: dict[str, asyncio.Future[grpclib.client.Channel]] = {}
 
     async def get_or_create_channel(self, server_url: str) -> grpclib.client.Channel:
         fut = self._channels.get(server_url)
         if fut is None or (fut.done() and (fut.cancelled() or fut.exception() is not None)):
             # Cache the attempt rather than the channel, so callers racing to connect share one.
-            fut = asyncio.ensure_future(create_channel_with_fallbacks(server_url, self._metadata))
+            fut = asyncio.ensure_future(
+                create_channel_with_fallbacks(
+                    server_url,
+                    self._metadata,
+                    metadata_provider=self._metadata_provider,
+                )
+            )
             self._channels[server_url] = fut
         # Shielded so one caller giving up doesn't cancel the connection for the others.
         return await asyncio.shield(fut)
@@ -357,6 +370,7 @@ def listen_for_server_warnings(channel: grpclib.client.Channel) -> None:
 def create_channel(
     server_url: str,
     metadata: dict[str, str] = {},
+    metadata_provider: MetadataProvider | None = None,
 ) -> grpclib.client.Channel:
     """Creates a grpclib.Channel to be used by a GRPC stub.
 
@@ -387,6 +401,10 @@ def create_channel(
     async def send_request(event: grpclib.events.SendRequest) -> None:
         for k, v in metadata.items():
             event.metadata[k] = v
+        if metadata_provider is not None:
+            provided_metadata = await asyncio.to_thread(metadata_provider)
+            for k, v in provided_metadata.items():
+                event.metadata[k] = v
 
         if o.hostname is not None:
             # GRPC actually injects a :authority pseudo-header containing the hostname.
@@ -412,6 +430,7 @@ async def create_channel_with_fallbacks(
     server_url: str,
     metadata: dict[str, str] = {},
     stagger_delay: float = 3.0,
+    metadata_provider: MetadataProvider | None = None,
 ) -> grpclib.client.Channel:
     """Create a connected channel, supporting comma-separated fallback URLs.
 
@@ -440,7 +459,7 @@ async def create_channel_with_fallbacks(
                 await asyncio.wait_for(failed[index - 1].wait(), timeout=index * stagger_delay)
             except asyncio.TimeoutError:
                 pass
-        channel = create_channel(url, metadata)
+        channel = create_channel(url, metadata, metadata_provider)
         try:
             await channel.__connect__()
         except BaseException:

modal-1.6.3.dev13/modal/_utils/oauth.py

@@ -0,0 +1,66 @@
+# Copyright Modal Labs 2026
+import base64
+import hashlib
+import json
+import time
+import uuid
+from collections.abc import Mapping
+from typing import Any
+
+from modal.exception import InvalidError
+
+_OAUTH_CLIENT_ASSERTION_AUDIENCE = "modal-server"
+_OAUTH_CLIENT_ASSERTION_LIFETIME_SECONDS = 5 * 60
+_MIN_RSA_KEY_SIZE = 2048
+
+
+class OAuthAssertionProvider:
+    """Mint short-lived private_key_jwt assertions for OAuth client authentication."""
+
+    def __init__(self, client_id: str, private_key_pem: str):
+        try:
+            import jwt
+            from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+            from jwt.algorithms import RSAAlgorithm
+            from jwt.exceptions import InvalidKeyError
+        except ImportError:
+            raise ImportError(
+                "Private-key OAuth authentication requires the 'oauth' extra. "
+                "Install it with `pip install 'modal[oauth]'`."
+            ) from None
+
+        private_key_pem = private_key_pem.replace("\\n", "\n")
+        try:
+            private_key = RSAAlgorithm(RSAAlgorithm.SHA256).prepare_key(private_key_pem)
+        except (TypeError, InvalidKeyError):
+            raise InvalidError("oauth_jwt_key must be an unencrypted RSA private key encoded as PEM.") from None
+        if not isinstance(private_key, RSAPrivateKey):
+            raise InvalidError("oauth_jwt_key must be an RSA private key.")
+        if private_key.key_size < _MIN_RSA_KEY_SIZE:
+            raise InvalidError("oauth_jwt_key must be at least 2048 bits.")
+
+        public_jwk: dict[str, Any] = RSAAlgorithm.to_jwk(private_key.public_key(), as_dict=True)
+        thumbprint_jwk = {field: public_jwk[field] for field in ("e", "kty", "n")}
+        canonical_jwk = json.dumps(thumbprint_jwk, sort_keys=True, separators=(",", ":")).encode()
+
+        self._client_id = client_id
+        self._private_key = private_key
+        self._kid = base64.urlsafe_b64encode(hashlib.sha256(canonical_jwk).digest()).rstrip(b"=").decode()
+        self._jwt = jwt
+
+    def __call__(self) -> Mapping[str, str]:
+        issued_at = int(time.time())
+        assertion = self._jwt.encode(
+            {
+                "iss": self._client_id,
+                "sub": self._client_id,
+                "aud": _OAUTH_CLIENT_ASSERTION_AUDIENCE,
+                "iat": issued_at,
+                "exp": issued_at + _OAUTH_CLIENT_ASSERTION_LIFETIME_SECONDS,
+                "jti": str(uuid.uuid4()),
+            },
+            self._private_key,
+            algorithm="RS256",
+            headers={"kid": self._kid},
+        )
+        return {"x-modal-oauth-client-assertion": assertion}

modal-1.6.3.dev13/modal/builder/PREVIEW.txt

@@ -0,0 +1,17 @@
+aiohappyeyeballs==2.7.1
+aiohttp==3.14.5
+aiosignal==1.4.0
+attrs==26.1.0
+cbor2==5.9.0
+certifi==2026.10.19
+frozenlist==1.8.0
+grpclib==0.4.9
+h2==4.4.1
+hpack==4.2.0
+hyperframe==6.1.0
+idna==3.20
+multidict==7.1.0
+propcache==0.5.4
+protobuf==7.36.2
+typing_extensions==4.16.0
+yarl==1.25.1

{modal-1.6.3.dev11 → modal-1.6.3.dev13}/modal/builder/base-images.json

@@ -1,6 +1,7 @@
 {
     "debian": {
         "PREVIEW": "trixie",
+        "2026.10": "trixie",
         "2025.06": "bookworm",
         "2024.10": "bookworm",
         "2024.04": "bookworm",
@@ -38,6 +39,7 @@
     },
     "micromamba": {
         "PREVIEW": "2.9.0-debian13-slim",
+        "2026.10": "2.9.0-debian13-slim",
         "2025.06": "2.1.1-debian12-slim",
         "2024.10": "1.5.10-bookworm-slim",
         "2024.04": "1.5.8-bookworm-slim",
@@ -45,6 +47,7 @@
     },
     "package_tools": {
         "PREVIEW": "pip wheel uv",
+        "2026.10": "pip wheel uv",
         "2025.06": "pip wheel uv",
         "2024.10": "pip wheel uv",
         "2024.04": "pip wheel uv",

{modal-1.6.3.dev11 → modal-1.6.3.dev13}/modal/cli/config.py

@@ -33,6 +33,8 @@ def show(redact: bool, include_internal: bool, json: bool):
         config_dict["oauth_refresh_token"] = "***"
     if redact and config_dict.get("oauth_client_secret"):
         config_dict["oauth_client_secret"] = "***"
+    if redact and config_dict.get("oauth_jwt_key"):
+        config_dict["oauth_jwt_key"] = "***"
 
     # Accept --json as a no-op for consistency; we may change the default formatting later
     OutputManager.get().print_json(dumps(config_dict))

{modal-1.6.3.dev11 → modal-1.6.3.dev13}/modal/cli/endpoint.py

@@ -260,26 +260,35 @@ async def list_(*, json: bool = False, env: Optional[str] = None):
 @click.option(
     "--name",
     default=None,
-    help="Endpoint name. Defaults to inference-{number} if not provided.",
+    help="Endpoint name. If omitted, Modal chooses a name.",
 )
 @click.option(
     "--model",
     required=True,
     help="Hugging Face repo ID for the base model architecture (e.g., 'Qwen/Qwen3.6-27B-FP8').",
 )
+@click.option(
+    "--shared",
+    is_flag=True,
+    default=False,
+    help="Create a Shared Endpoint. Defaults to a Dedicated Endpoint.",
+)
 @click.option(
     "--routing-region",
     "routing_region",
     multiple=True,
     callback=_single_routing_region_callback,
-    help=f"Region to route inference requests through. Defaults to {_DEFAULT_ROUTING_REGION}.",
+    help=(
+        f"Region to route inference requests through. Defaults to {_DEFAULT_ROUTING_REGION}. "
+        "Shared Endpoint routing cannot currently be customized."
+    ),
 )
 @click.option(
     "--compute-region",
     "compute_regions",
     multiple=True,
     help=(
-        "Region to run Endpoint containers in. May be specified multiple times. "
+        "Region to run Dedicated Endpoint containers in. May be specified multiple times. "
         "This incurs a region selection price multiplier."
     ),
 )
@@ -287,13 +296,16 @@ async def list_(*, json: bool = False, env: Optional[str] = None):
     "--colocate-compute",
     is_flag=True,
     default=False,
-    help="Run all containers within the routing region. This incurs a region selection price multiplier.",
+    help=(
+        "Run all Dedicated Endpoint containers within the routing region. "
+        "This incurs a region selection price multiplier."
+    ),
 )
 @click.option(
     "--unauthenticated",
     is_flag=True,
     default=False,
-    help="Allow unauthenticated HTTP requests to the endpoint.",
+    help="Allow unauthenticated HTTP requests to a Dedicated Endpoint.",
 )
 @click.option("--custom-hf-repo", default=None, help="Hugging Face repo ID for fine-tuned model weights.")
 @click.option("--custom-hf-revision", default=None, help="Git revision for --custom-hf-repo.")
@@ -304,6 +316,7 @@ async def list_(*, json: bool = False, env: Optional[str] = None):
 async def create(
     name: Optional[str],
     model: Optional[str] = None,
+    shared: bool = False,
     routing_region: str = _DEFAULT_ROUTING_REGION,
     compute_regions: tuple[str, ...] = (),
     colocate_compute: bool = False,
@@ -317,13 +330,21 @@ async def create(
 ):
     """Deploy a new Endpoint.
 
+    Creates a Dedicated Endpoint by default, with support for custom weights and compute placement.
+    Use --shared to serve a supported base model with Modal-managed capacity.
+
     Examples:
 
-    Create an Endpoint from a base model:
+    Create a Dedicated Endpoint from a base model:
     ```bash
     modal endpoint create --model Qwen/Qwen3.6-27B-FP8
     ```
 
+    Create a Shared Endpoint from a supported base model:
+    ```bash
+    modal endpoint create --shared --model moonshotai/Kimi-K3
+    ```
+
     Create an Endpoint with an explicit name:
     ```bash
     modal endpoint create --name qwen-chat --model Qwen/Qwen3.6-27B-FP8
@@ -348,6 +369,22 @@ async def create(
     ```
 
     """
+    if shared:
+        for option, provided in (
+            ("--compute-region", bool(compute_regions)),
+            ("--colocate-compute", colocate_compute),
+            ("--unauthenticated", unauthenticated),
+            ("--custom-hf-repo", custom_hf_repo is not None),
+            ("--custom-hf-revision", custom_hf_revision is not None),
+            ("--custom-hf-token", custom_hf_token is not None),
+            ("--custom-volume-name", custom_volume_name is not None),
+            ("--custom-volume-path", custom_volume_path is not None),
+        ):
+            if provided:
+                raise click.UsageError(f"{option} cannot be used with --shared.")
+        if routing_region != _DEFAULT_ROUTING_REGION:
+            raise click.UsageError(f"Shared Endpoints require --routing-region {_DEFAULT_ROUTING_REGION}.")
+
     if compute_regions and colocate_compute:
         raise click.UsageError("--compute-region and --colocate-compute are mutually exclusive.")
     if custom_hf_repo and custom_volume_name:
@@ -403,13 +440,18 @@ async def create(
         model=model_source,
         environment_name=environment_name,
         unauthenticated=unauthenticated,
+        serving_mode=(api_pb2.ENDPOINT_SERVING_MODE_SHARED if shared else api_pb2.ENDPOINT_SERVING_MODE_DEDICATED),
     )
     if name:
         req.name = name
     resp = await client._stub.EndpointCreate(req)
 
     output = OutputManager.get()
-    output.print(f"[green]✓[/green] Endpoint '{resp.name}' ({resp.endpoint_id}) was created and started provisioning.")
+    serving_mode = "Shared" if shared else "Dedicated"
+    output.print(
+        f"[green]✓[/green] {serving_mode} Endpoint '{resp.name}' ({resp.endpoint_id}) "
+        "was created and started provisioning."
+    )
     if resp.model_name:
         output.print(f'  → Send [cyan]"model": "{resp.model_name}"[/cyan] in requests to the Endpoint.')
     if resp.endpoint_page_url: