FROM mcr.microsoft.com/aifx/acpt/stable-ubuntu2204-cu126-py310-torch280:biweekly.202607.1

USER root

# OS packages: pinned inherited deps from the ACPT base image; fixes
# USN-8533-1, USN-8538-1, USN-8543-1, USN-8553-1, USN-8477-3,
# USN-8565-1, USN-8572-1, USN-8585-1, USN-8601-1, and USN-8611-1.
RUN apt-get update && apt-get install -y --no-install-recommends --only-upgrade \
    openssh-client=1:8.9p1-3ubuntu0.16 \
    libasound2=1.2.6.1-1ubuntu1.2 \
    libasound2-data=1.2.6.1-1ubuntu1.2 \
    wget=1.21.2-2ubuntu1.4 \
    dotnet-hostfxr-8.0=8.0.29-0ubuntu1~22.04.1 \
    dotnet-runtime-8.0=8.0.29-0ubuntu1~22.04.1 \
    dotnet-host-8.0=8.0.29-0ubuntu1~22.04.1 \
    tar=1.34+dfsg-1ubuntu0.1.22.04.6 \
    libsqlite3-0=3.37.2-2ubuntu0.7 \
    libkrb5support0=1.19.2-2ubuntu0.8 \
    libgssapi-krb5-2=1.19.2-2ubuntu0.8 \
    libk5crypto3=1.19.2-2ubuntu0.8 \
    libkrb5-3=1.19.2-2ubuntu0.8 \
    libpam-runtime=1.4.0-11ubuntu2.7 \
    libpam0g=1.4.0-11ubuntu2.7 \
    libpam-modules=1.4.0-11ubuntu2.7 \
    libpam-modules-bin=1.4.0-11ubuntu2.7 \
    libc-dev-bin=2.35-0ubuntu3.14 \
    libc6-dev=2.35-0ubuntu3.14 \
    locales=2.35-0ubuntu3.14 \
    libc6=2.35-0ubuntu3.14 \
    libc-bin=2.35-0ubuntu3.14 \
 && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install -r requirements.txt --no-cache-dir
# openmim still imports pkg_resources, which is removed from setuptools>=82.
# Keep a temporary compatibility pin for mim installation, then restore setuptools.
RUN /opt/conda/bin/python -m pip install --no-cache-dir 'setuptools<82' \
 && conda run -n ptca python -m pip install --no-cache-dir 'setuptools<82'

# Note: mmdet should be installed via mim to access the model zoo config folder.
RUN mim install mmdet==3.3.0
# Temporary workaround for https://github.com/open-mmlab/mmdetection/issues/11668 (when mmdet updated, remove lines below)
RUN mim install mmcv==2.2.0 -f https://download.openmmlab.com/mmcv/dist/cu118/torch2.2/index.html --no-cache-dir
# setuptools: pinned inherited dep from the ACPT base image; fixes GHSA-h35f-9h28-mq5c.
RUN /opt/conda/bin/python -m pip install --no-cache-dir --upgrade 'setuptools==83.0.0' \
 && conda run -n ptca python -m pip install --no-cache-dir --upgrade 'setuptools==83.0.0'
RUN sed -i 's/2.2.0/2.3.0/' /opt/conda/envs/ptca/lib/python3.10/site-packages/mmdet/__init__.py

# onnx-weekly: pinned transitive dep of azureml-acft-accelerator; it caps
# onnx<=1.17.0, fixes GHSA-3r9x-f23j-gc73 and GHSA-hqmj-h5c6-369m.
RUN pip uninstall -y onnx && pip install --no-cache-dir 'onnx-weekly>=1.22.0.dev20260504'

# pyarrow: pinned transitive dep of datasets; image install downgrades the base, fixes CVE-2026-25087.
# cryptography: pinned transitive dep of azureml-core; image install downgrades the base, fixes GHSA-537c-gmf6-5ccf.
RUN conda run -n ptca python -m pip install --no-cache-dir --upgrade \
    'pyarrow>=23.0.1' \
    'cryptography>=48.0.1'

# torch: pinned transitive dep of the ACFT image stack; this image overrides
# the ACPT base version, fixes GHSA-rrmf-rvhw-rf47.
RUN conda run -n ptca python -m pip uninstall -y torchaudio \
 && conda run -n ptca python -m pip install --no-cache-dir --upgrade \
    --index-url https://download.pytorch.org/whl/cu126 \
    'torch==2.13.0' \
    'torchvision==0.28.0'

# The conda pip upgrade can reinstall the rattler solver. The base image does
# not need it for runtime, and its compiled extension currently carries Rust CVEs.
RUN conda config --system --set solver classic \
 && /opt/conda/bin/python3.13 -m pip uninstall -y py-rattler conda-rattler-solver 2>/dev/null || true \
 && rm -rf /opt/conda/lib/python3.13/site-packages/rattler* /opt/conda/lib/python3.13/site-packages/conda_rattler_solver* /opt/conda/lib/python3.13/site-packages/py_rattler* /opt/conda/conda-meta/py-rattler-*.json /opt/conda/conda-meta/conda-rattler-solver-*.json

RUN conda clean -a -y && rm -rf /opt/miniconda/pkgs/