Skip to content

change: When rootlessDocker is enabled, return a fixed SageMaker IP #5236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jul 16, 2025

Conversation

Jiali-Xing
Copy link
Contributor

@Jiali-Xing Jiali-Xing commented Jul 12, 2025

Issue #, if available:
N/A - Internal requirement for SageMaker Studio rootless Docker support

Description of changes:
Enhanced get_docker_host() function in src/sagemaker/local/utils.py to support rootless Docker environments:

  • Detect rootless Docker by checking for Cgroup Driver: none in docker info output
  • Return fixed IP 172.17.0.1 for rootless Docker instead of localhost
  • Maintain backward compatibility with traditional Docker setups
  • Enable SageMaker local mode to work correctly in Studio's rootless Docker environment

Testing done:

  • Added unit tests for rootless Docker detection (test_get_docker_host_rootless_docker)
  • Added unit tests for traditional Docker fallback scenarios (test_get_docker_host_traditional_docker)

We then launch JupyterLab App in 1). a domain without rootlessDocker and 2). a domain with enabled rootlessDocker. And then we create and upload pysdk wheel artifact and install it in the JupyterLab App terminal. We run python -c "from sagemaker.local.utils import get_docker_host; print(get_docker_host())"

  • Verified that in 1). traditional Docker environment it returns localhost as expected.
  • In the 2). domain with rootless Docker enabled, it returns fixed IP 172.17.0.1.

Ref: https://quip-amazon.com/EvbfAyrac6Nh/SageMaker-Studio-V2-Docker-access-in-VPCOnly-mode#temp:C:bDf835bbc571f5245dfb5e32037b

Merge Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your pull request.

General

  • I have read the CONTRIBUTING doc
  • I certify that the changes I am introducing will be backward compatible, and I have discussed concerns about this, if any, with the Python SDK team
  • I used the commit message format described in CONTRIBUTING
  • I have passed the region in to all S3 and STS clients that I've initialized as part of this change.
  • I have updated any necessary documentation, including READMEs and API docs (if appropriate)

Tests

  • I have added tests that prove my fix is effective or that my feature works (if appropriate)
  • I have added unit and/or integration tests as appropriate to ensure backward compatibility of the changes
  • I have checked that my tests are not configured for a specific region or account (if appropriate)
  • I have used unique_name_from_base to create resource names in integ tests (if appropriate)
  • If adding any dependency in requirements.txt files, I have spell checked and ensured they exist in PyPi

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@Jiali-Xing Jiali-Xing requested a review from a team as a code owner July 12, 2025 00:01
@Jiali-Xing Jiali-Xing requested a review from rsareddy0329 July 12, 2025 00:01
"RootlessDocker not detected, falling back to remote host IP or localhost."
)
except subprocess.SubprocessError:
pass
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this log or return the exception ? Passing will be a confusing experience to the users

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point! I have updated my PR to log the exception.

# log the result of check
logger.warning("RootlessDocker detected (Cgroup Driver: none), returning fixed IP.")
# SageMaker rootless Docker detected - return fixed IP
return "172.17.0.1"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this a general IP address used throughout docker ?
Where are we getting this value from?

Copy link
Contributor Author

@Jiali-Xing Jiali-Xing Jul 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The IP is from the LLC document. This is supposed to be configured by SageMaker. Sravya told me that we will use this specific IP.
https://tiny.amazon.com/eulnovpq/motivation

@Jiali-Xing Jiali-Xing temporarily deployed to manual-approval July 14, 2025 21:01 — with GitHub Actions Inactive
@sravyasdh
Copy link

@Jiali-Xing

Confirmed backward compatibility with existing remote Docker functionality

Can you add more details on how you tested this? For example, how did you spin up docker container with and without rootless mode enabled? How did you try to access the ports? Was all the testing done on JL? Did you test locally?

if process.returncode == 0: # Check return code instead of stderr
output_text = output.decode("utf-8")
# Check for rootless Docker by looking at Cgroup Driver
if "Cgroup Driver: none" in output_text:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is this value for rootful docker?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For rootful docker right now it is cgroupfs.

@sravyasdh
Copy link

Can you also verify this in local mode before merging?

@nargokul nargokul merged commit ed3c296 into aws:master Jul 16, 2025
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants