Bring forward some CVE fixes from 23.03 release

ci/conda/recipes/morpheus/meta.yaml

@@ -84,7 +84,7 @@ outputs:
         - docker-py 5.0.*
         - grpcio # Version determined from cudf
         - libmrc
-        - mlflow >1.29,<2
+        - mlflow >=2.2.1,<3
         - mrc
         - networkx 3.1.*
         - numpydoc 1.4.*

docker/Dockerfile

@@ -83,7 +83,6 @@ RUN --mount=type=cache,id=apt,target=/var/cache/apt \
         cuda-cupti-${CUDA_MAJOR_VER}-${CUDA_MINOR_VER} \
         cuda-gdb-${CUDA_MAJOR_VER}-${CUDA_MINOR_VER} \
         curl \
-        git-lfs \
         jq \
         libcublas-${CUDA_MAJOR_VER}-${CUDA_MINOR_VER} \
         libcufft-${CUDA_MAJOR_VER}-${CUDA_MINOR_VER} \
@@ -116,9 +115,8 @@ RUN --mount=type=cache,id=conda_pkgs,target=/opt/conda/pkgs,sharing=locked \
     conda config --set ssl_verify false &&\
     conda config --add pkgs_dirs /opt/conda/pkgs &&\
     # Install mamba, boa and git here. Conda build breaks with other git installs
-    /opt/conda/bin/mamba install -y -n base -c conda-forge "boa" "git >=2.35.3" "git-lfs" "python=${PYTHON_VER}" "tini=0.19" &&\
-    source activate base &&\
-    git lfs install
+    /opt/conda/bin/mamba install -y -n base -c conda-forge "boa" "git >=2.35.3" "python=${PYTHON_VER}" "tini=0.19" &&\
+    source activate base
     # conda clean -afy
 
 # ============ Stage: conda_env ============
@@ -258,9 +256,6 @@ COPY "./models" "./models"
 COPY "./scripts" "./scripts"
 COPY ["*.md", "LICENSE", "./"]
 
-# remedy for CVE-2015-20107
-RUN find / -name '*mailcap*.*py*' -delete
-
 # Use morpheus by default
 CMD [ "morpheus" ]
 

docker/conda/environments/cuda11.8_dev.yml

@@ -59,7 +59,7 @@ dependencies:
     - include-what-you-use=0.18
     - isort
     - librdkafka=1.7.0
-    - mlflow>1.29,<2
+    - mlflow>=2.2.1,<3
     - mrc=23.07
     - myst-parser==1.0.0
     - networkx=3.1

docker/conda/environments/cuda11.8_examples.yml

@@ -30,7 +30,7 @@ dependencies:
     - dask==2023.1.1
     - dill=0.3.6
     - distributed==2023.1.1
-    - mlflow>1.29.0,<2
+    - mlflow>=2.2.1,<3
     - papermill=2.3.4
     - s3fs==2022.8.2
     - pip

models/mlflow/docker/Dockerfile

@@ -15,7 +15,7 @@
 
 ARG FROM_IMAGE="condaforge/miniforge-pypy3"
 ARG PYTHON_VER=3.11
-ARG TAG=22.11.1-4
+ARG TAG=23.1.0-1
 FROM ${FROM_IMAGE}:${TAG} AS base
 
 WORKDIR /mlflow
@@ -44,24 +44,20 @@ RUN sed -i 's/conda activate base/conda activate mlflow/g' ~/.bashrc
 SHELL ["/opt/conda/bin/conda", "run", "-n", "mlflow", "/bin/bash", "-c"]
 
 ARG TRITON_DIR=/mlflow/triton-inference-server
-ARG TRITON_VER=r23.03
+ARG TRITON_VER=r23.05
 
 RUN mkdir ${TRITON_DIR} && \
     cd ${TRITON_DIR} && \
-    git clone -b ${TRITON_VER} --depth 1 https://github.com/triton-inference-server/server && \
+    git clone -b ${TRITON_VER} --depth 1 -n --filter=tree:0 https://github.com/triton-inference-server/server && \
     source activate mlflow && \
-    cd ${TRITON_DIR}/server/deploy/mlflow-triton-plugin && \
+    cd ${TRITON_DIR}/server && \
+    git sparse-checkout set --no-cone deploy/mlflow-triton-plugin && \
+    cd deploy/mlflow-triton-plugin && \
     pip install .
 
 RUN ln -sf ${TRITON_DIR}/server/deploy/mlflow-triton-plugin/scripts/publish_model_to_mlflow.py /mlflow && \
     mkdir /mlflow/artifacts
 
-# remedy for CVE-2015-20107
-RUN find / -name '*mailcap*.*py*' -delete
-
-# remedy for CVE-2022-42919
-RUN find / -path '*multiprocessing/util.py' -exec sed -i 's/=\s*_platform_supports_abstract_sockets()/= False/g' {} +
-
 EXPOSE 5000
 
 # Set the entrypoint to use the entrypoint.sh script which sets the conda env

models/mlflow/docker/conda/mlflow-env.yml

@@ -18,12 +18,8 @@ channels:
   - conda-forge
   - defaults
 dependencies:
-  - python=3.11
-  - pip
+  - boto3
   - onnx
-  - openssl>=1.1.1s,<3
   - psycopg2<3
-  - pip:
-    - boto3
-    - mlflow>1.29.0,<2
-    - pymysql
+  - pymysql
+  - python=3.11