1717
1818# Specify DOCKER_IMAGE_MIRROR if you want to use a mirror of hub.docker.com
1919ARG DOCKER_IMAGE_MIRROR=""
20- FROM ${DOCKER_IMAGE_MIRROR}ubuntu:22 .04 AS workshop
20+ FROM ${DOCKER_IMAGE_MIRROR}ubuntu:24 .04 AS workshop
2121
2222ARG USERNAME
2323
@@ -29,6 +29,8 @@ RUN if ! [ "$(arch)" = "aarch64" ] ; then exit 1; fi
2929RUN apt-get update && apt-get install -y \
3030 # We need pip to install things, this will also bring in a minimal python3
3131 python3-pip \
32+ # So that we can create a virtual environment
33+ python3-venv \
3234 # So that we can call python instead of python3
3335 python-is-python3 \
3436 # To allow users to install new things if they want
@@ -43,8 +45,12 @@ RUN apt-get install -y wget
4345# DOCKER_USER for the Docker user
4446ENV DOCKER_USER=${USERNAME}
4547
46- # Setup default user
47- RUN useradd --create-home -s /bin/bash -m $DOCKER_USER && echo "$DOCKER_USER:Portland" | chpasswd && adduser $DOCKER_USER sudo
48+ # Create user only if it doesn't already exist
49+ RUN id "$DOCKER_USER" >/dev/null 2>&1 || useradd --create-home -s /bin/bash -m "$DOCKER_USER"
50+
51+ # Set password and add to sudo group
52+ RUN echo "$DOCKER_USER:Portland" | chpasswd && adduser "$DOCKER_USER" sudo || true
53+
4854RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
4955RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
5056
@@ -60,12 +66,6 @@ RUN echo 'export PATH="$HOME/.local/bin:$PATH"' >> /etc/bash.bashrc
6066# Grab the SECURITY.md from the root directory
6167COPY --from=rootdir SECURITY.md /home/$DOCKER_USER/
6268
63- # Update to newer pip/setuptools/wheel (setuptools >= 78.1.1 due to CVE-2024-6345,
64- # CVE-2022-40897 and CVE-2025-47273, wheel >= 0.38.0 due to CVE-2022-40898 and
65- # pip >= 25.2 due to CVE-2025-8869 and CVE-2023-5752) and delete old system
66- # version (we essentially use apt:python3-pip to bootstrap pip)
67- RUN pip install --upgrade pip~=25.2 setuptools~=78.1.1 wheel~=0.45.1
68-
6969# Remove system Python stuff. Should be safe to wipe after the line above, because
7070# python3 -m pip now uses the /usr/local install. Also removes unused protobuf
7171# packages to resolve CVE-2025-4565.
@@ -77,10 +77,10 @@ RUN apt-get update && apt-get purge -y \
7777 python3-distutils \
7878 python3-lib2to3 \
7979 python3-dev \
80- python3.10 -dev \
81- libprotobuf23 \
82- libprotobuf-lite23 \
83- libprotoc23 \
80+ python3.12 -dev \
81+ libprotobuf32t64 \
82+ libprotobuf-lite32t64 \
83+ libprotoc32t64 \
8484 protobuf-compiler \
8585 && apt-get autoremove -y \
8686 && rm -rf /var/lib/apt/lists/*
@@ -89,6 +89,17 @@ RUN apt-get update && apt-get purge -y \
8989WORKDIR /home/$DOCKER_USER
9090USER $DOCKER_USER
9191
92+ # Create a per-user virtualenv and use that for everything Python
93+ RUN python -m venv /home/$DOCKER_USER/.venv
94+
95+ # Make the venv python/pip first on PATH for all subsequent layers and at runtime
96+ ENV PATH="/home/$DOCKER_USER/.venv/bin:$PATH"
97+
98+ # Update to newer pip/setuptools/wheel (setuptools >= 70.0.0 due to CVE-2024-6345
99+ # and CVE-2025-47273, wheel >= 0.38.0 due to CVE-2022-40898) and delete old system
100+ # version (we essentially use apt:python3-pip to bootstrap pip)
101+ RUN pip install --upgrade pip~=25.2 setuptools~=78.1.1 wheel~=0.45.1
102+
92103# Check TENSORFLOW_WHEEL was set and copy
93104RUN test -n "$TENSORFLOW_WHEEL"
94105COPY $TENSORFLOW_WHEEL /home/$DOCKER_USER/
@@ -106,7 +117,7 @@ COPY --chown=$DOCKER_USER examples/ /home/$DOCKER_USER/
106117COPY --chown=$DOCKER_USER tensorflow/ /home/$DOCKER_USER/tensorflow
107118
108119# Move build into final image as a single layer.
109- FROM ${DOCKER_IMAGE_MIRROR}ubuntu:22 .04
120+ FROM ${DOCKER_IMAGE_MIRROR}ubuntu:24 .04
110121
111122ARG USERNAME
112123
@@ -117,4 +128,8 @@ RUN chown $DOCKER_USER:$DOCKER_USER /home/$DOCKER_USER
117128
118129USER $DOCKER_USER
119130WORKDIR /home/$DOCKER_USER
131+
132+ # Ensure the venv is on PATH in the final image as well
133+ ENV PATH="/home/$DOCKER_USER/.venv/bin:$PATH"
134+
120135CMD ["bash" , "-l" ]
0 commit comments