New RunLLM response generated: >>>*# Question* Hi Everyone.... I have a query regarding the pods of my project running on kubernetes which is using nvidia GPU's. I build my own custom image with a Dockerfile looks like this:

# Dockerfile
FROM <http://nvcr.io/nvidia/cuda:11.0.3-base-ubuntu20.04|nvcr.io/nvidia/cuda:11.0.3-base-ubuntu20.04>

# Set the working directory in the container
WORKDIR /app
ENV LANG C.UTF-8
ENV LC_ALL C.UTF-8
ENV PYTHONPATH /app

# Update the package list and install necessary packages
RUN apt-get update && \
    apt-get install -y python3 python3-venv python3-pip && \
    apt-get clean

# Copy the requirements file into the container
ENV VENV /opt/venv

COPY <http://requirements.in|requirements.in> .

# Create a virtual environment and install the required packages
RUN python3 -m venv ${VENV} && \
    . ${VENV}/bin/activate && \
    pip install --no-cache-dir -r <http://requirements.in|requirements.in>
    
ENV PATH="${VENV}/bin:$PATH"


COPY . .

# Alternatively, you can use ENTRYPOINT to automatically activate the virtual environment
# ENTRYPOINT ["/bin/bash", "-c", "source venv/bin/activate && exec bash"]
ARG tag
ENV FLYTE_INTERNAL_IMAGE $tag

It successfully runs with pyflyte run --remote --image="<build image>" workflows/main.py workflow_name And pods are using GPU's too. But Pods are running as a root instead of random pid. And It's safety concern for us. we can not allow to run any process as a root. Is there anything I did wrong in building image. Or any settings I have to do with flyte for this. Please help! Thank you # Answer To ensure that your Flyte pods do not run as root, you need to configure the

securityContext

in your Kubernetes PodTemplate. This can be done by specifying the

runAsUser

and

runAsGroup

fields in the PodTemplate to ensure the pods run with a non-root user. Here is an example of how you can configure the security context in your PodTemplate:

apiVersion: v1
kind: PodTemplate
metadata:
  name: secure-flyte-pod
template:
  spec:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      fsGroup: 1001
    containers:
      - name: main-container
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
    initContainers:
      - name: flyte-copilot-downloader
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]

This configuration ensures that the containers run with a non-root user (user ID 1001) and group (group ID 1001), and all capabilities are dropped for enhanced security. Would you like more details on how to implement these configurations? Sources: - Flyte Raw Containers Discussion - PodTemplate Configuration Issue