Dockerfile

FROM nvidia/cuda:12.8.1-devel-ubuntu22.04

ENV DEBIAN_FRONTEND=noninteractive \
	TZ=Europe/Paris

# for headless GPU rendering
ENV MUJOCO_GL="egl"
ENV PYOPENGL_PLATFORM="egl"

#requirements for headless GPU rendering, see also https://github.com/mmatl/pyrender/issues/149
# ENV NVIDIA_DRIVER_CAPABILITIES=compute,graphics,utility,video
ENV NVIDIA_VISIBLE_DEVICES=all
ENV NVIDIA_DRIVER_CAPABILITIES=all

# Remove any third-party apt sources to avoid issues with expiring keys.
# Install some basic utilities AND critical EGL/Mesa packages
RUN rm -f /etc/apt/sources.list.d/*.list && \
    apt-get update && apt-get install -y --no-install-recommends \
    curl \
    ca-certificates \
    sudo \
    git \
    wget \
    procps \
    git-lfs \
    zip \
    unzip \
    htop \
    vim \
    ffmpeg \
    nano \
    bzip2 \
    libx11-6 \
    # EGL packages
    libegl1 \
    libgles2 \
    libglfw3 \
    libglfw3-dev \
    freeglut3-dev \

    # mesa packages..  we should NOT use this,
    # because software rendering sucks.
    #libegl1-mesa \
    #libegl1-mesa-dev \
    #libgl1-mesa-glx \
    #libgl1-mesa-dri \
    #libgles2-mesa \
    #libgles2-mesa-dev \
    #mesa-utils \
    #mesa-utils-extra \

    # X11 libraries because why not
    xvfb \
    x11-utils \
    # Build tools
    build-essential \
    libsndfile-dev \
    software-properties-common \
 && rm -rf /var/lib/apt/lists/*

# Create the NVIDIA EGL vendor config
RUN mkdir -p /usr/share/glvnd/egl_vendor.d && \
    echo '{"file_format_version": "1.0.0", "ICD": {"library_path": "libEGL_nvidia.so.0"}}' > /usr/share/glvnd/egl_vendor.d/10_nvidia.json

# Create additional EGL configs that might be needed
#RUN echo '{"file_format_version": "1.0.0", "ICD": {"library_path": "libEGL_mesa.so.0"}}' > /usr/share/glvnd/egl_vendor.d/50_mesa.json

# Create symlinks for NVIDIA EGL libraries if they exist in different locations
RUN if [ -f /usr/local/cuda/lib64/libEGL_nvidia.so.0 ]; then \
        ln -sf /usr/local/cuda/lib64/libEGL_nvidia.so.0 /usr/lib/x86_64-linux-gnu/libEGL_nvidia.so.0; \
    fi && \
    if [ -f /usr/local/nvidia/lib64/libEGL_nvidia.so.0 ]; then \
        ln -sf /usr/local/nvidia/lib64/libEGL_nvidia.so.0 /usr/lib/x86_64-linux-gnu/libEGL_nvidia.so.0; \
    fi

# Set up library paths for EGL
ENV LD_LIBRARY_PATH="/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/lib/x86_64-linux-gnu:/usr/local/cuda/lib64:${LD_LIBRARY_PATH}"

# more EGL environment variables
ENV EGL_PLATFORM=device

# commented out, as we disable mesa
#ENV MESA_GL_VERSION_OVERRIDE=4.5
#ENV MESA_GLSL_VERSION_OVERRIDE=450

ENV __EGL_VENDOR_LIBRARY_DIRS=/usr/share/glvnd/egl_vendor.d

RUN add-apt-repository ppa:flexiondotorg/nvtop && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends nvtop

RUN curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash - && \
    apt-get install -y nodejs && \
    npm install -g configurable-http-proxy

# Create a working directory
WORKDIR /app

# Create a non-root user and switch to it
RUN adduser --disabled-password --gecos '' --shell /bin/bash user \
 && chown -R user:user /app
RUN echo "user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-user
USER user

# All users can use /home/user as their home directory
ENV HOME=/home/user
RUN mkdir $HOME/.cache $HOME/.config \
 && chmod -R 777 $HOME

# Set up the Conda environment
ENV CONDA_AUTO_UPDATE_CONDA=false \
    PATH=$HOME/miniconda/bin:$PATH
RUN curl -sLo ~/miniconda.sh https://repo.continuum.io/miniconda/Miniconda3-py313_25.5.1-0-Linux-x86_64.sh \
 && chmod +x ~/miniconda.sh \
 && ~/miniconda.sh -b -p ~/miniconda \
 && rm ~/miniconda.sh \
 && conda clean -ya

ENV CONDA_OVERRIDE_CUDA="12.8"

# Make sure that Jax and cuSPARSE are properly installed for CUDA 12.x
RUN conda install nvidia/label/cuda-12.8.1::cuda-toolkit nvidia/label/cuda-12.8.1::libcusparse
RUN conda install "jaxlib=*=*cuda*" jax -c conda-forge

WORKDIR $HOME/app

#######################################
# Start root user section
#######################################

USER root

# User Debian packages
## Security warning : Potential user code executed as root (build time)
RUN --mount=target=/root/packages.txt,source=packages.txt \
    apt-get update && \
    xargs -r -a /root/packages.txt apt-get install -y --no-install-recommends \
    && rm -rf /var/lib/apt/lists/*

RUN --mount=target=/root/on_startup.sh,source=on_startup.sh,readwrite \
	bash /root/on_startup.sh

RUN mkdir /data && chown user:user /data

RUN mkdir /data/samples && chown user:user /data/samples

# Create device nodes that might be needed for GPU access
RUN mkdir -p /dev/dri && \
    chmod 755 /dev/dri

#######################################
# End root user section
#######################################

USER user

# Python packages
RUN --mount=target=requirements.txt,source=requirements.txt \
    pip install --no-cache-dir --upgrade -r requirements.txt

# Copy the current directory contents into the container at $HOME/app setting the owner to the user
COPY --chown=user . $HOME/app

RUN chmod +x start_server.sh

COPY --chown=user login.html /home/user/miniconda/lib/python3.13/site-packages/jupyter_server/templates/login.html

COPY --chown=user samples/ /data/samples/

ENV PYTHONUNBUFFERED=1 \
	GRADIO_ALLOW_FLAGGING=never \
	GRADIO_NUM_PORTS=1 \
	GRADIO_SERVER_NAME=0.0.0.0 \
	GRADIO_THEME=huggingface \
	SYSTEM=spaces \
	SHELL=/bin/bash

CMD ["./start_server.sh"]