truss 0.10.9rc548__tar.gz → 0.10.9rc550__tar.gz

{truss-0.10.9rc548 → truss-0.10.9rc550}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: truss
-Version: 0.10.9rc548
+Version: 0.10.9rc550
 Summary: A seamless bridge from model development to model delivery
 Project-URL: Repository, https://github.com/basetenlabs/truss
 Project-URL: Homepage, https://truss.baseten.co

{truss-0.10.9rc548 → truss-0.10.9rc550}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "truss"
-version = "0.10.9rc548"
+version = "0.10.9rc550"
 description = "A seamless bridge from model development to model delivery"
 authors = [
     { name = "Pankaj Gupta", email = "no-reply@baseten.co" },

{truss-0.10.9rc548 → truss-0.10.9rc550}/truss/templates/base.Dockerfile.jinja

@@ -8,6 +8,7 @@ FROM {{ base_image_name_and_tag }} AS truss_server
 {%- set python_executable = config.base_image.python_executable_path or 'python3' %}
 ENV PYTHON_EXECUTABLE="{{ python_executable }}"
 
+{%- set bundled_packages_path = "/packages" %}  {# path for bundled packages #}
 {%- set app_username = "app" %}  {# needed later for USER directive#}
 {% block user_setup %}
 {%- set app_user_uid = 60000 %}
@@ -30,7 +31,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 {# to allow the non-root user to install packages. #}
 {%- if non_root_user and enable_model_container_admin_commands %}
 RUN apt update && apt install -y sudo
-{%- set allowed_admin_commands = ["/usr/bin/apt install *", "/usr/bin/apt update"] %}
+{%- set allowed_admin_commands = ["/usr/bin/apt install *", "/usr/bin/apt update", "/usr/bin/apt remove *"] %}
 RUN echo "Defaults:{{ app_username }} passwd_tries=0\n{{ app_username }} ALL=(root) NOPASSWD: {{ allowed_admin_commands | join(", ") }}" > /etc/sudoers.d/app-packages
 RUN chmod 0440 /etc/sudoers.d/app-packages
 {#- optional but good practice: check if the sudoers file is valid #}
@@ -119,7 +120,7 @@ WORKDIR $APP_HOME
 
 {% block bundled_packages_copy %}
     {%- if bundled_packages_dir_exists %}
-COPY --chown={{ default_owner }} ./{{ config.bundled_packages_dir }} /packages
+COPY --chown={{ default_owner }} ./{{ config.bundled_packages_dir }} {{ bundled_packages_path }}
 {%- endif %}
 {% endblock %}
 

{truss-0.10.9rc548 → truss-0.10.9rc550}/truss/templates/control/control/helpers/truss_patch/model_container_patch_applier.py

@@ -1,4 +1,6 @@
 import logging
+import os
+import shutil
 import subprocess
 from pathlib import Path
 from typing import Optional
@@ -91,27 +93,38 @@ class ModelContainerPatchApplier:
         )
         action = python_requirement_patch.action
 
-        if action == Action.REMOVE:
-            subprocess.run(
-                [
-                    self._pip_path,
-                    "uninstall",
-                    "-y",
+        if self._pip_path == "uv-control-env":
+            # Use uv pip with the control environment's Python
+            if action == Action.REMOVE:
+                subprocess.run([
+                    "uv", "pip", "uninstall", "-y",
                     python_requirement_patch.requirement,
-                ],
-                check=True,
-            )
-        elif action in [Action.ADD, Action.UPDATE]:
-            subprocess.run(
-                [
-                    self._pip_path,
-                    "install",
+                    "--python", "/control/.env/bin/python"
+                ], check=True)
+            elif action in [Action.ADD, Action.UPDATE]:
+                subprocess.run([
+                    "uv", "pip", "install",
                     python_requirement_patch.requirement,
                     "--upgrade",
-                ],
-                check=True,
-            )
+                    "--python", "/control/.env/bin/python"
+                ], check=True)
         else:
+            # Deprecated: use traditional pip executable
+            # This code block should eventually be removed,
+            # because we now use uv.
+            if action == Action.REMOVE:
+                subprocess.run([
+                    self._pip_path, "uninstall", "-y",
+                    python_requirement_patch.requirement,
+                ], check=True)
+            elif action in [Action.ADD, Action.UPDATE]:
+                subprocess.run([
+                    self._pip_path, "install",
+                    python_requirement_patch.requirement,
+                    "--upgrade",
+                ], check=True)
+        
+        if action not in [Action.REMOVE, Action.ADD, Action.UPDATE]:
             raise ValueError(f"Unknown python requirement patch action {action}")
 
     def _apply_system_package_patch(self, system_package_patch: SystemPackagePatch):
@@ -120,17 +133,34 @@ class ModelContainerPatchApplier:
         )
         action = system_package_patch.action
 
+        # Check if we're running as root
+        # Deprecated: this code should be removed eventually.
+        is_root = os.getuid() == 0
+        
+        # If not root, check for sudo availability
+        if not is_root:
+            if not shutil.which("sudo"):
+                raise RuntimeError(
+                    "Cannot install system packages for security reasons, please redeploy the model. "
+                    "System package installation requires elevated privileges that are not available in this environment."
+                )
+        
+        # Build the apt command with sudo if needed
+        apt_prefix = [] if is_root else ["sudo"]
+
         if action == Action.REMOVE:
             subprocess.run(
-                ["apt", "remove", "-y", system_package_patch.package], check=True
+                apt_prefix + ["apt", "remove", "-y", system_package_patch.package], 
+                check=True
             )
         elif action in [Action.ADD, Action.UPDATE]:
-            subprocess.run(["apt", "update"], check=True)
+            subprocess.run(apt_prefix + ["apt", "update"], check=True)
             subprocess.run(
-                ["apt", "install", "-y", system_package_patch.package], check=True
+                apt_prefix + ["apt", "install", "-y", system_package_patch.package], 
+                check=True
             )
         else:
-            raise ValueError(f"Unknown python requirement patch action {action}")
+            raise ValueError(f"Unknown system package patch action {action}")
 
     def _apply_config_patch(self, config_patch: ConfigPatch):
         self._app_logger.debug(f"Applying config patch {config_patch.to_dict()}")
@@ -176,10 +206,17 @@ class ModelContainerPatchApplier:
 
 
 def _identify_pip_path() -> str:
+    # For uv-managed environments, we don't use a pip executable directly
+    # Instead, we return a special marker that indicates we should use uv pip
+    control_python = Path("/control/.env/bin/python")
+    if control_python.exists():
+        return "uv-control-env"  # Special marker
+    
+    # Fallback to system pip if control environment doesn't exist
     if Path("/usr/local/bin/pip3").exists():
         return "/usr/local/bin/pip3"
-
+    
     if Path("/usr/local/bin/pip").exists():
         return "/usr/local/bin/pip"
-
-    raise RuntimeError("Unable to find pip, make sure it's installed.")
+    
+    raise RuntimeError("Unable to find pip, make sure it's installed.")

{truss-0.10.9rc548 → truss-0.10.9rc550}/truss/templates/server.Dockerfile.jinja

@@ -104,7 +104,7 @@ COPY --chown={{ default_owner }} ./{{ config.model_module_dir }} ${APP_HOME}/mod
 {# Macro to change ownership of directories and switch to regular user #}
 {%- macro chown_and_switch_to_regular_user_if_enabled(additional_chown_dirs=[]) -%}
 {%- if non_root_user %}
-RUN chown -R {{ app_username }}:{{ app_username }} {% for dir in additional_chown_dirs %}{{ dir }} {% endfor %}${HOME} ${APP_HOME}
+RUN chown -R {{ app_username }}:{{ app_username }} {% for dir in additional_chown_dirs %}{{ dir }} {% endfor %}${HOME} ${APP_HOME}{% if bundled_packages_dir_exists %} {{ bundled_packages_path }}{% endif %}
 USER {{ app_username }}
 {%- endif %} {#- endif non_root_user #}
 {%- endmacro -%}
@@ -115,9 +115,9 @@ RUN apt-get update -y && apt-get install -y --no-install-recommends \
 COPY --chown={{ default_owner }} ./docker_server_requirements.txt ${APP_HOME}/docker_server_requirements.txt
 
 {# NB(nikhil): Use the same python version for custom server proxy as the control server, for consistency. #}
-RUN HOME=/root uv python install {{ control_python_version }}
-RUN HOME=/root uv venv /docker_server/.venv --python {{ control_python_version }}
-RUN HOME=/root uv pip install --python /docker_server/.venv/bin/python -r /app/docker_server_requirements.txt --no-cache-dir
+RUN uv python install {{ control_python_version }}
+RUN uv venv /docker_server/.venv --python {{ control_python_version }}
+RUN uv pip install --python /docker_server/.venv/bin/python -r /app/docker_server_requirements.txt --no-cache-dir
 {% set proxy_config_path = "/etc/nginx/conf.d/proxy.conf" %}
 {% set supervisor_config_path = "/etc/supervisor/supervisord.conf" %}
 {% set supervisor_server_url = "http://localhost:8080" %}