truss 0.10.9rc547__tar.gz → 0.10.9rc548__tar.gz

{truss-0.10.9rc547 → truss-0.10.9rc548}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: truss
-Version: 0.10.9rc547
+Version: 0.10.9rc548
 Summary: A seamless bridge from model development to model delivery
 Project-URL: Repository, https://github.com/basetenlabs/truss
 Project-URL: Homepage, https://truss.baseten.co

{truss-0.10.9rc547 → truss-0.10.9rc548}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "truss"
-version = "0.10.9rc547"
+version = "0.10.9rc548"
 description = "A seamless bridge from model development to model delivery"
 authors = [
     { name = "Pankaj Gupta", email = "no-reply@baseten.co" },

{truss-0.10.9rc547 → truss-0.10.9rc548}/truss/contexts/local_loader/docker_build_emulator.py

@@ -1,3 +1,4 @@
+import re
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Dict, List
@@ -31,12 +32,26 @@ class DockerBuildEmulator:
         self._context_dir = context_dir
 
     def run(self, fs_root_dir: Path) -> DockerBuildEmulatorResult:
-        def _resolve_env(key: str) -> str:
-            if key.startswith("$"):
-                key = key.replace("$", "", 1)
-                v = result.env[key]
-                return v
-            return key
+        def _resolve_env(in_value: str) -> str:
+            # Valid environment variable name pattern
+            var_name_pattern = r'[A-Za-z_][A-Za-z0-9_]*'
+            
+            # Handle ${VAR} syntax
+            def replace_braced_var(match):
+                var_name = match.group(1)
+                return result.env.get(var_name, match.group(0))  # Return original if not found
+            
+            # Handle $VAR syntax (word boundary ensures we don't match parts of other vars)
+            def replace_simple_var(match):
+                var_name = match.group(1)
+                return result.env.get(var_name, match.group(0))  # Return original if not found
+            
+            # Replace ${VAR} patterns first, using % substitution to avoid additional braces noise with f-strings
+            value = re.sub(r'\$\{(%s)\}' % var_name_pattern, replace_braced_var, in_value)
+            # Then replace remaining $VAR patterns (only at word boundaries)
+            value = re.sub(r'\$(%s)\b' % var_name_pattern, replace_simple_var, value)
+            
+            return value
 
         def _resolve_values(keys: List[str]) -> List[str]:
             return list(map(_resolve_env, keys))
@@ -53,11 +68,14 @@ class DockerBuildEmulator:
             if cmd.instruction == DockerInstruction.ENTRYPOINT:
                 result.entrypoint = list(values)
             if cmd.instruction == DockerInstruction.COPY:
+                # Filter out --chown flags
+                filtered_values = [v for v in values if not v.startswith("--chown")]
+                
                 # NB(nikhil): Skip COPY commands with --from flag (multi-stage builds)
-                if len(values) != 2:
+                if len(filtered_values) != 2:
                     continue
 
-                src, dst = values
+                src, dst = filtered_values
                 src = src.replace("./", "", 1)
                 dst = dst.replace("/", "", 1)
                 copy_tree_or_file(self._context_dir / src, fs_root_dir / dst)

{truss-0.10.9rc547 → truss-0.10.9rc548}/truss/templates/base.Dockerfile.jinja

@@ -13,19 +13,21 @@ ENV PYTHON_EXECUTABLE="{{ python_executable }}"
 {%- set app_user_uid = 60000 %}
 {%- set control_server_dir = "/control" %}
 {%- set default_owner = "root:root" %}
-# The non-root user's home directory.
-# uv will use $HOME to install packages.
+{# The non-root user's home directory. #}
+{# uv will use $HOME to install packages. #}
 ENV HOME=/home/{{ app_username }}
-# Directory containing inference server code.
+{# Directory containing inference server code. #}
 ENV APP_HOME=/{{ app_username }}
 RUN mkdir -p ${APP_HOME} {{ control_server_dir }}
-# Create a non-root user to run model containers.
+{# Create a non-root user to run model containers. #}
 RUN useradd -u {{ app_user_uid }} -ms /bin/bash {{ app_username }}
 {% endblock %} {#- endblock user_setup #}
 
 {#- at the very beginning, set non-interactive mode for apt #}
 ENV DEBIAN_FRONTEND=noninteractive
 
+{# If non-root user is enabled and model container admin commands are enabled, install sudo #}
+{# to allow the non-root user to install packages. #}
 {%- if non_root_user and enable_model_container_admin_commands %}
 RUN apt update && apt install -y sudo
 {%- set allowed_admin_commands = ["/usr/bin/apt install *", "/usr/bin/apt update"] %}
@@ -66,7 +68,7 @@ RUN if ! command -v uv >/dev/null 2>&1; then \
     command -v curl >/dev/null 2>&1 || (apt update && apt install -y curl) && \
     curl -LsSf --retry 5 --retry-delay 5 https://astral.sh/uv/{{ UV_VERSION }}/install.sh | sh; \
 fi
-# Add the user's local bin to the path, used by uv.
+{# Add the user's local bin to the path, used by uv. #}
 ENV PATH=${PATH}:${HOME}/.local/bin
 {% endblock %}
 

{truss-0.10.9rc547 → truss-0.10.9rc548}/truss/templates/cache.Dockerfile.jinja

@@ -1,5 +1,6 @@
 FROM python:3.11-slim AS cache_warmer
 
+ENV APP_HOME=/app
 RUN mkdir -p ${APP_HOME}/model_cache
 WORKDIR ${APP_HOME}
 
@@ -8,9 +9,9 @@ ENV HUGGING_FACE_HUB_TOKEN="{{hf_access_token}}"
 {% endif %}
 
 RUN apt-get -y update; apt-get -y install curl; curl -s https://baseten-public.s3.us-west-2.amazonaws.com/bin/b10cp-5fe8dc7da-linux-amd64 -o /app/b10cp; chmod +x /app/b10cp
-ENV B10CP_PATH_TRUSS="/app/b10cp"
+ENV B10CP_PATH_TRUSS="${APP_HOME}/b10cp"
 COPY --chown={{ default_owner }} ./cache_requirements.txt ${APP_HOME}/cache_requirements.txt
-RUN pip install -r /app/cache_requirements.txt --no-cache-dir && rm -rf /root/.cache/pip
+RUN pip install -r ${APP_HOME}/cache_requirements.txt --no-cache-dir && rm -rf /root/.cache/pip
 COPY --chown={{ default_owner }} ./cache_warmer.py /cache_warmer.py
 
 {% for credential in credentials_to_cache  %}

{truss-0.10.9rc547 → truss-0.10.9rc548}/truss/templates/server.Dockerfile.jinja

@@ -46,7 +46,7 @@ RUN {{ sys_pip_install_command }} -r {{ server_requirements_filename }} --no-cac
 
 {% block app_copy %}
 {%- if model_cache_v1 %}
-# Copy data before code for better caching
+{# Copy data before code for better caching #}
 {%- include "copy_cache_files.Dockerfile.jinja" -%}
 {%- endif %} {#- endif model_cache_v1 #}
 
@@ -68,7 +68,7 @@ COPY --chown={{ default_owner }} ./{{ config.data_dir }} ${APP_HOME}/data
 {%- endif %} {#- endif data_dir_exists #}
 
 {%- if model_cache_v2 %}
-# v0.0.9, keep synced with server_requirements.txt
+{# v0.0.9, keep synced with server_requirements.txt #}
 RUN curl -sSL --fail --retry 5 --retry-delay 2 -o /usr/local/bin/truss-transfer-cli https://github.com/basetenlabs/truss/releases/download/v0.10.9rc0/truss-transfer-cli-v0.10.9rc0-linux-x86_64-unknown-linux-musl
 RUN chmod +x /usr/local/bin/truss-transfer-cli
 RUN mkdir /static-bptr
@@ -101,6 +101,13 @@ COPY --chown={{ default_owner }} ./{{ config.model_module_dir }} ${APP_HOME}/mod
 {% endblock %} {#- endblock app_copy #}
 
 {% block run %}
+{# Macro to change ownership of directories and switch to regular user #}
+{%- macro chown_and_switch_to_regular_user_if_enabled(additional_chown_dirs=[]) -%}
+{%- if non_root_user %}
+RUN chown -R {{ app_username }}:{{ app_username }} {% for dir in additional_chown_dirs %}{{ dir }} {% endfor %}${HOME} ${APP_HOME}
+USER {{ app_username }}
+{%- endif %} {#- endif non_root_user #}
+{%- endmacro -%}
 
     {%- if config.docker_server %}
 RUN apt-get update -y && apt-get install -y --no-install-recommends \
@@ -108,9 +115,9 @@ RUN apt-get update -y && apt-get install -y --no-install-recommends \
 COPY --chown={{ default_owner }} ./docker_server_requirements.txt ${APP_HOME}/docker_server_requirements.txt
 
 {# NB(nikhil): Use the same python version for custom server proxy as the control server, for consistency. #}
-RUN uv python install {{ control_python_version }}
-RUN uv venv /docker_server/.venv --python {{ control_python_version }}
-RUN uv pip install --python /docker_server/.venv/bin/python -r /app/docker_server_requirements.txt --no-cache-dir
+RUN HOME=/root uv python install {{ control_python_version }}
+RUN HOME=/root uv venv /docker_server/.venv --python {{ control_python_version }}
+RUN HOME=/root uv pip install --python /docker_server/.venv/bin/python -r /app/docker_server_requirements.txt --no-cache-dir
 {% set proxy_config_path = "/etc/nginx/conf.d/proxy.conf" %}
 {% set supervisor_config_path = "/etc/supervisor/supervisord.conf" %}
 {% set supervisor_server_url = "http://localhost:8080" %}
@@ -120,13 +127,8 @@ ENV SUPERVISOR_SERVER_URL="{{ supervisor_server_url }}"
 ENV SERVER_START_CMD="/docker_server/.venv/bin/supervisord -c {{ supervisor_config_path }}"
 {#- default configuration uses port 80, which requires root privileges, so we remove it #}
 RUN rm -f /etc/nginx/sites-enabled/default
-{%- if non_root_user %}
 {#- nginx writes to /var/lib/nginx, /var/log/nginx, and /run directories #}
-{% set nginx_dirs = ["/var/lib/nginx", "/var/log/nginx", "/run"] %}
-RUN chown -R {{ app_username }}:{{ app_username }} {{ nginx_dirs | join(" ") }}
-RUN chown -R {{ app_username }}:{{ app_username }} ${HOME} ${APP_HOME}
-USER {{ app_username }}
-{%- endif %} {#- endif non_root_user #}
+{{ chown_and_switch_to_regular_user_if_enabled(["/var/lib/nginx", "/var/log/nginx", "/run"]) }}
 ENTRYPOINT ["/docker_server/.venv/bin/supervisord", "-c", "{{ supervisor_config_path }}"]
 
     {%- elif requires_live_reload %} {#- elif requires_live_reload #}
@@ -134,19 +136,13 @@ ENV HASH_TRUSS="{{ truss_hash }}"
 ENV CONTROL_SERVER_PORT="8080"
 ENV INFERENCE_SERVER_PORT="8090"
 ENV SERVER_START_CMD="/control/.env/bin/python /control/control/server.py"
-{%- if non_root_user %}
-RUN chown -R {{ app_username }}:{{ app_username }} ${HOME} ${APP_HOME}
-USER {{ app_username }}
-{%- endif %} {#- endif non_root_user #}
+{{ chown_and_switch_to_regular_user_if_enabled() }}
 ENTRYPOINT ["/control/.env/bin/python", "/control/control/server.py"]
 
     {%- else %} {#- else (default inference server) #}
 ENV INFERENCE_SERVER_PORT="8080"
 ENV SERVER_START_CMD="{{ python_executable }} /app/main.py"
-{%- if non_root_user %}
-RUN chown -R {{ app_username }}:{{ app_username }} ${HOME} ${APP_HOME}
-USER {{ app_username }}
-{%- endif %} {#- endif non_root_user #}
+{{ chown_and_switch_to_regular_user_if_enabled() }}
 ENTRYPOINT ["{{ python_executable }}", "/app/main.py"]
     {%- endif %} {#- endif config.docker_server / live_reload #}
 

{truss-0.10.9rc547 → truss-0.10.9rc548}/truss/tests/templates/control/control/test_server_integration.py

@@ -21,6 +21,56 @@ from prometheus_client.parser import text_string_to_metric_families
 PATCH_PING_MAX_DELAY_SECS = 3
 
 
+def _start_truss_server(
+    stdout_capture_file_path: str,
+    truss_control_container_fs: Path,
+    with_patch_ping_flow: bool,
+    patch_ping_server_port: int,
+    ctrl_port: int,
+    inf_port: int,
+):
+    """Module-level function to avoid pickling issues with multiprocessing."""
+    if with_patch_ping_flow:
+        os.environ["PATCH_PING_URL_TRUSS"] = (
+            f"http://localhost:{patch_ping_server_port}"
+        )
+    sys.stdout = open(stdout_capture_file_path, "w")
+    app_path = truss_control_container_fs / "app"
+    sys.path.append(str(app_path))
+    control_path = truss_control_container_fs / "control" / "control"
+    sys.path.append(str(control_path))
+
+    from server import ControlServer
+
+    control_server = ControlServer(
+        python_executable_path=sys.executable,
+        inf_serv_home=str(app_path),
+        control_server_port=ctrl_port,
+        inference_server_port=inf_port,
+    )
+    control_server.run()
+
+
+def _start_patch_ping_server(patch_ping_server_port: int):
+    """Module-level function to avoid pickling issues with multiprocessing."""
+    import json
+    import random
+    import time
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_POST(self):
+            time.sleep(random.uniform(0, PATCH_PING_MAX_DELAY_SECS))
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(
+                bytes(json.dumps({"is_current": True}), encoding="utf-8")
+            )
+
+    httpd = HTTPServer(("localhost", patch_ping_server_port), Handler)
+    httpd.serve_forever()
+
+
 @dataclass
 class ControlServerDetails:
     control_server_process: Process
@@ -270,51 +320,24 @@ def _configured_control_server(
     inf_port = ctrl_port + 1
     patch_ping_server_port = ctrl_port + 2
 
-    def start_truss_server(stdout_capture_file_path):
-        if with_patch_ping_flow:
-            os.environ["PATCH_PING_URL_TRUSS"] = (
-                f"http://localhost:{patch_ping_server_port}"
-            )
-        sys.stdout = open(stdout_capture_file_path, "w")
-        app_path = truss_control_container_fs / "app"
-        sys.path.append(str(app_path))
-        control_path = truss_control_container_fs / "control" / "control"
-        sys.path.append(str(control_path))
-
-        from server import ControlServer
-
-        control_server = ControlServer(
-            python_executable_path=sys.executable,
-            inf_serv_home=str(app_path),
-            control_server_port=ctrl_port,
-            inference_server_port=inf_port,
-        )
-        control_server.run()
-
-    def start_patch_ping_server():
-        import json
-        import random
-        import time
-        from http.server import BaseHTTPRequestHandler, HTTPServer
-
-        class Handler(BaseHTTPRequestHandler):
-            def do_POST(self):
-                time.sleep(random.uniform(0, PATCH_PING_MAX_DELAY_SECS))
-                self.send_response(200)
-                self.end_headers()
-                self.wfile.write(
-                    bytes(json.dumps({"is_current": True}), encoding="utf-8")
-                )
-
-        httpd = HTTPServer(("localhost", patch_ping_server_port), Handler)
-        httpd.serve_forever()
-
     stdout_capture_file = tempfile.NamedTemporaryFile()
-    subproc = Process(target=start_truss_server, args=(stdout_capture_file.name,))
+    subproc = Process(
+        target=_start_truss_server,
+        args=(
+            stdout_capture_file.name,
+            truss_control_container_fs,
+            with_patch_ping_flow,
+            patch_ping_server_port,
+            ctrl_port,
+            inf_port,
+        ),
+    )
     subproc.start()
     proc_id = subproc.pid
     if with_patch_ping_flow:
-        patch_ping_server_proc = Process(target=start_patch_ping_server)
+        patch_ping_server_proc = Process(
+            target=_start_patch_ping_server, args=(patch_ping_server_port,)
+        )
         patch_ping_server_proc.start()
     try:
         time.sleep(2.0)

{truss-0.10.9rc547 → truss-0.10.9rc548}/truss/tests/templates/server/test_truss_server.py

@@ -10,23 +10,28 @@ from pathlib import Path
 import pytest
 
 
-@pytest.mark.integration
-def test_truss_server_termination(truss_container_fs):
-    port = 10123
+def _start_truss_server(stdout_capture_file_path: str, truss_container_fs: Path, port: int):
+    """Module-level function to avoid pickling issues with multiprocessing."""
+    sys.stdout = open(stdout_capture_file_path, "w")
+    app_path = truss_container_fs / "app"
+    sys.path.append(str(app_path))
+    os.chdir(app_path)
+
+    from truss_server import TrussServer
 
-    def start_truss_server(stdout_capture_file_path):
-        sys.stdout = open(stdout_capture_file_path, "w")
-        app_path = truss_container_fs / "app"
-        sys.path.append(str(app_path))
-        os.chdir(app_path)
+    server = TrussServer(http_port=port, config_or_path=app_path / "config.yaml")
+    server.start()
 
-        from truss_server import TrussServer
 
-        server = TrussServer(http_port=port, config_or_path=app_path / "config.yaml")
-        server.start()
+@pytest.mark.integration
+def test_truss_server_termination(truss_container_fs):
+    port = 10123
 
     stdout_capture_file = tempfile.NamedTemporaryFile()
-    subproc = Process(target=start_truss_server, args=(stdout_capture_file.name,))
+    subproc = Process(
+        target=_start_truss_server, 
+        args=(stdout_capture_file.name, truss_container_fs, port)
+    )
     subproc.start()
     proc_id = subproc.pid
     time.sleep(2.0)

{truss-0.10.9rc547 → truss-0.10.9rc548}/truss/tests/test_model_inference.py

@@ -990,8 +990,10 @@ def test_is_healthy_returns_503_on_load_failure():
                 # when the model goes down, this will throw an exception
                 break
         diff = container.diff()
-        assert "/root/inference_server_crashed.txt" in diff
-        assert diff["/root/inference_server_crashed.txt"] == "A"
+        # the crash file is written to the app user's home directory
+        crash_file_path = "/home/app/inference_server_crashed.txt"
+        assert crash_file_path in diff
+        assert diff[crash_file_path] == "A"
 
 
 @pytest.mark.integration