Use the PPU pip service on ACS

When you start the inner PPU container, mount the necessary environment variables and files for credential-free authentication.

# To use the pip service provided by PTG
id=$(docker run --network host -tid --privileged {ppu-image-uri} bash)

# Modify the container startup command as follows: add four ALIBABA_CLOUD* environment variables and one file mount.

# To use the pip service provided by Alibaba Cloud
id=$(docker run --network host -tid --privileged \
-e ALIBABA_CLOUD_OIDC_PROVIDER_ARN=$ALIBABA_CLOUD_OIDC_PROVIDER_ARN \
-e ALIBABA_CLOUD_ROLE_ARN=$ALIBABA_CLOUD_ROLE_ARN \
-e ALIBABA_CLOUD_OIDC_TOKEN_FILE=$ALIBABA_CLOUD_OIDC_TOKEN_FILE \
-e ALIBABA_CLOUD_STS_ENDPOINT=$ALIBABA_CLOUD_STS_ENDPOINT \
-v /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/:/var/run/secrets/ack.alibabacloud.com/rrsa-tokens/ \
{ppu-image-uri} bash)

Install the credential-free plugin inside the inner PPU container. You can then use the pip service without credentials. Compared to the pip service provided by PTG, you only need to replace the index URL in the installation command.

# Other Linux package installation steps are omitted.

# The following steps demonstrate how to install pip packages using the service provided by Alibaba Cloud.
## 1. First, install the credential-free plugin aiext-pypi-plugin.
pip install aiext-pypi-plugin -i http://mirrors.cloud.aliyuncs.com/aiext-pypi/aiext-pypi-plugin/simple --trusted-host mirrors.cloud.aliyuncs.com

## 2. You can then install the required pip wheel packages without credentials. For example:
pip install torch==2.5.1 vllm==0.7.3 -i https://aiext-pypi.mirrors.aliyuncs.com/pg1-pip/ubuntu_cu123/simple/

## 3. After the pip installation is complete, we recommend cleaning up the environment.
pip uninstall -y aiext-pypi-plugin
rm ~/.netrc   # Clean up as needed, or edit the file to remove only the content related to machine aiext-pypi.mirrors.aliyuncs.com.

Make the necessary modifications to your Dockerfile. Install the credential-free plugin, and then you can use the pip service without credentials. Compared to the pip service provided by PTG, you only need to replace the index URL in the installation command.

# If you use a standard image provided by ACS
FROM egslingjun-registry.cn-wulanchabu.cr.aliyuncs.com/egslingjun/{image:tag}

# Other Dockerfile steps are omitted.

# The following steps demonstrate how to install pip packages using the service provided by Alibaba Cloud.
## 1. Set the credential-free related environment variables.
ARG ALIBABA_CLOUD_STS_ENDPOINT
ARG ALIBABA_CLOUD_OIDC_PROVIDER_ARN
ARG ALIBABA_CLOUD_ROLE_ARN
ENV ALIBABA_CLOUD_STS_ENDPOINT=${ALIBABA_CLOUD_STS_ENDPOINT}
ENV ALIBABA_CLOUD_OIDC_PROVIDER_ARN=${ALIBABA_CLOUD_OIDC_PROVIDER_ARN}
ENV ALIBABA_CLOUD_ROLE_ARN=${ALIBABA_CLOUD_ROLE_ARN}
ENV ALIBABA_CLOUD_OIDC_TOKEN_FILE=/mount/rrsa-tokens/token

## 2. Install the credential-free plugin aiext-pypi-plugin. Note: The plugin currently does not support requests executed with 'python -m pip'.

RUN pip install aiext-pypi-plugin -i http://mirrors.cloud.aliyuncs.com/aiext-pypi/aiext-pypi-plugin/simple --trusted-host mirrors.cloud.aliyuncs.com

## 3. Add the --mount option before each 'pip install' command. For example:
RUN --mount=type=bind,source=/var/run/secrets/ack.alibabacloud.com/rrsa-tokens,target=/mount/rrsa-tokens \
    pip install torch==2.5.1 -i https://aiext-pypi.mirrors.aliyuncs.com/pg1-pip/ubuntu_cu123/simple/
RUN --mount=type=bind,source=/var/run/secrets/ack.alibabacloud.com/rrsa-tokens,target=/mount/rrsa-tokens \
   pip install vllm==0.7.3 -i https://aiext-pypi.mirrors.aliyuncs.com/pg1-pip/ubuntu_cu123/simple/

## 4. After the pip installation is complete, we recommend cleaning up the environment.
RUN pip uninstall -y aiext-pypi-plugin

Add the four ALIBABA_CLOUD* build arguments to the buildah build command in the Buildah Pod. Modify the command as follows:

# To use the pip service provided by PTG
buildah --storage-driver=overlay build --no-cache -t test:v1 .

# Modify the command as follows, adding four ALIBABA_CLOUD* build arguments:

# To use the pip service provided by Alibaba Cloud
buildah --storage-driver=overlay build --no-cache \
--build-arg ALIBABA_CLOUD_OIDC_PROVIDER_ARN=$ALIBABA_CLOUD_OIDC_PROVIDER_ARN \
--build-arg ALIBABA_CLOUD_ROLE_ARN=$ALIBABA_CLOUD_ROLE_ARN \
--build-arg ALIBABA_CLOUD_STS_ENDPOINT=$ALIBABA_CLOUD_STS_ENDPOINT \
-t demo:v1 .