diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 51cf93e108..b016b86644 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -26,8 +26,8 @@ RUN apt-get install -y libibverbs-dev \ pkg-config \ patchelf -RUN wget https://go.dev/dl/go1.22.12.linux-amd64.tar.gz \ - && tar -C /usr/local -xzf go1.22.12.linux-amd64.tar.gz +RUN wget https://go.dev/dl/go1.26.10.linux-amd64.tar.gz \ + && tar -C /usr/local -xzf go1.26.10.linux-amd64.tar.gz RUN git clone https://github.com/alibaba/yalantinglibs.git \ && cd yalantinglibs \ diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3f68759e64..d9dd959422 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -209,6 +209,8 @@ jobs: - name: Configure project run: | apt update -y + apt-get install -y --only-upgrade ca-certificates + dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816 bash -x dependencies.sh -y mkdir build cd build diff --git a/dependencies.sh b/dependencies.sh index ae49fd1f65..5ad52c71ab 100755 --- a/dependencies.sh +++ b/dependencies.sh @@ -23,7 +23,7 @@ NC="\033[0m" # No Color # Configuration REPO_ROOT=`pwd` GITHUB_PROXY=${GITHUB_PROXY:-"https://github.com"} -GOVER=1.23.8 +GOVER=1.26.10 YALANTINGLIBS_VERSION=0.5.7 # Function to print section headers diff --git a/docker/mooncake.Dockerfile b/docker/mooncake.Dockerfile index 33542086fb..f7f698d6ba 100644 --- a/docker/mooncake.Dockerfile +++ b/docker/mooncake.Dockerfile @@ -8,6 +8,14 @@ ARG UBUNTU_VERSION=22.04 FROM nvidia/cuda:${CUDA_VERSION}-devel-ubuntu${UBUNTU_VERSION} AS builder +# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket +# until the upstream base image is rebuilt; fail if it is still old. +RUN apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \ + rm -rf /var/lib/apt/lists/* && \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \ + dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; } + ENV DEBIAN_FRONTEND=noninteractive \ PYTHONUNBUFFERED=1 @@ -71,6 +79,14 @@ RUN OUTPUT_DIR=dist ./scripts/build_wheel.sh ############################################################################### FROM nvidia/cuda:${CUDA_VERSION}-runtime-ubuntu${UBUNTU_VERSION} AS runtime +# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket +# until the upstream base image is rebuilt; fail if it is still old. +RUN apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \ + rm -rf /var/lib/apt/lists/* && \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \ + dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; } + ENV DEBIAN_FRONTEND=noninteractive \ PYTHONUNBUFFERED=1 \ PIP_NO_CACHE_DIR=1 @@ -78,6 +94,7 @@ ENV DEBIAN_FRONTEND=noninteractive \ # Install runtime dependencies required by Mooncake RUN apt-get update && \ apt-get install -y --no-install-recommends \ + ca-certificates \ python3 \ python3-pip \ ibverbs-providers \ diff --git a/docker/musa.Dockerfile b/docker/musa.Dockerfile index d47564a321..fb28aabcf5 100644 --- a/docker/musa.Dockerfile +++ b/docker/musa.Dockerfile @@ -8,6 +8,14 @@ ARG UBUNTU_VERSION=22.04 FROM mthreads/musa:${MUSA_VERSION}-devel-ubuntu${UBUNTU_VERSION}-amd64 AS builder +# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket +# until the upstream base image is rebuilt; fail if it is still old. +RUN apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \ + rm -rf /var/lib/apt/lists/* && \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \ + dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; } + ENV DEBIAN_FRONTEND=noninteractive \ PYTHONUNBUFFERED=1 @@ -61,6 +69,14 @@ RUN OUTPUT_DIR=dist ./scripts/build_wheel.sh ############################################################################### FROM mthreads/musa:${MUSA_VERSION}-devel-ubuntu${UBUNTU_VERSION}-amd64 AS runtime +# CVE fix: pull the patched ca-certificates from the Ubuntu security pocket +# until the upstream base image is rebuilt; fail if it is still old. +RUN apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade ca-certificates && \ + rm -rf /var/lib/apt/lists/* && \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)" && \ + dpkg --compare-versions "$v" ge 20260816 || { echo "ca-certificates $v is older than 20260816" >&2; exit 1; } + ENV DEBIAN_FRONTEND=noninteractive \ PYTHONUNBUFFERED=1 \ PIP_NO_CACHE_DIR=1 @@ -68,6 +84,7 @@ ENV DEBIAN_FRONTEND=noninteractive \ # Install runtime dependencies required by Mooncake RUN apt-get update && \ apt-get install -y --no-install-recommends \ + ca-certificates \ python3 \ python3-pip \ ibverbs-providers \ diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml index d2b9590ad8..93c4f6b198 100644 --- a/monitoring/docker-compose.yml +++ b/monitoring/docker-compose.yml @@ -2,7 +2,7 @@ version: '3.8' services: prometheus: - image: prom/prometheus:v2.54.0 + image: prom/prometheus:v3.15.1 container_name: prometheus restart: unless-stopped ports: @@ -20,7 +20,8 @@ services: - monitoring grafana: - image: grafana/grafana-oss:11.0.0 + build: ./grafana + image: mooncake-grafana:13.2.4 container_name: grafana restart: unless-stopped ports: diff --git a/monitoring/grafana/Dockerfile b/monitoring/grafana/Dockerfile new file mode 100644 index 0000000000..63a1e124e5 --- /dev/null +++ b/monitoring/grafana/Dockerfile @@ -0,0 +1,9 @@ +FROM grafana/grafana:13.2.4 + +# CVE fix: pull the patched ca-certificates from the Alpine repo until the +# upstream image is rebuilt; fail if it is still old. +USER root +RUN apk upgrade --no-cache ca-certificates && \ + v="$(apk info -e -v ca-certificates | sed 's/^ca-certificates-//')" && \ + [ "$(apk version -t "$v" 20261020-r0)" != "<" ] || { echo "ca-certificates $v is older than 20261020-r0" >&2; exit 1; } +USER 472 diff --git a/monitoring/run.sh b/monitoring/run.sh index 39257e572d..de59f723cb 100755 --- a/monitoring/run.sh +++ b/monitoring/run.sh @@ -23,13 +23,14 @@ docker run -d \ -p 9090:9090 \ -v "$SCRIPT_DIR/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml" \ --add-host host.docker.internal:host-gateway \ - prom/prometheus:v2.54.0 \ + prom/prometheus:v3.15.1 \ --config.file=/etc/prometheus/prometheus.yml \ --storage.tsdb.retention.time=15d \ --web.console.libraries=/usr/share/prometheus/console_libraries \ --web.console.templates=/usr/share/prometheus/consoles echo "Starting Grafana..." +docker build -t mooncake-grafana:13.2.4 "$SCRIPT_DIR/grafana" || exit 1 docker run -d \ --name grafana \ --restart unless-stopped \ @@ -41,7 +42,7 @@ docker run -d \ -v grafana-data:/var/lib/grafana \ -v "$SCRIPT_DIR/grafana/provisioning:/etc/grafana/provisioning" \ -v "$SCRIPT_DIR/grafana/dashboards:/etc/grafana/dashboards" \ - grafana/grafana-oss:11.0.0 + mooncake-grafana:13.2.4 echo "Monitoring stack started!" echo "Prometheus: http://localhost:9090" diff --git a/mooncake-common/etcd/go.mod b/mooncake-common/etcd/go.mod index d795f03837..5c462d095f 100644 --- a/mooncake-common/etcd/go.mod +++ b/mooncake-common/etcd/go.mod @@ -1,27 +1,26 @@ module github.com/kvcache-ai/Mooncake/mooncake-common/etcd -go 1.23.0 +go 1.25.0 -toolchain go1.23.7 +toolchain go1.26.10 -require go.etcd.io/etcd/client/v3 v3.5.21 +require go.etcd.io/etcd/client/v3 v3.5.33 require ( github.com/coreos/go-semver v0.3.0 // indirect github.com/coreos/go-systemd/v22 v22.3.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/protobuf v1.5.4 // indirect - go.etcd.io/etcd/api/v3 v3.5.21 // indirect - go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect + go.etcd.io/etcd/api/v3 v3.5.33 // indirect + go.etcd.io/etcd/client/pkg/v3 v3.5.33 // indirect go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect go.uber.org/zap v1.17.0 // indirect - golang.org/x/net v0.38.0 // indirect - golang.org/x/sys v0.31.0 // indirect - golang.org/x/text v0.23.0 // indirect - google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect - google.golang.org/grpc v1.59.0 // indirect - google.golang.org/protobuf v1.33.0 // indirect + golang.org/x/net v0.58.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/text v0.41.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect + google.golang.org/grpc v1.83.2 // indirect + google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/mooncake-p2p-store/src/p2pstore/go.mod b/mooncake-p2p-store/src/p2pstore/go.mod index 8d29b5ab85..08c28d9af0 100644 --- a/mooncake-p2p-store/src/p2pstore/go.mod +++ b/mooncake-p2p-store/src/p2pstore/go.mod @@ -1,27 +1,26 @@ module github.com/kvcache-ai/Mooncake/mooncake-p2p-store/src/p2pstore -go 1.23.0 +go 1.25.0 -toolchain go1.24.1 +toolchain go1.26.10 -require go.etcd.io/etcd/client/v3 v3.5.15 +require go.etcd.io/etcd/client/v3 v3.5.33 require ( github.com/coreos/go-semver v0.3.0 // indirect github.com/coreos/go-systemd/v22 v22.3.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/protobuf v1.5.4 // indirect - go.etcd.io/etcd/api/v3 v3.5.15 // indirect - go.etcd.io/etcd/client/pkg/v3 v3.5.15 // indirect + go.etcd.io/etcd/api/v3 v3.5.33 // indirect + go.etcd.io/etcd/client/pkg/v3 v3.5.33 // indirect go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect go.uber.org/zap v1.17.0 // indirect - golang.org/x/net v0.38.0 // indirect - golang.org/x/sys v0.31.0 // indirect - golang.org/x/text v0.23.0 // indirect - google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect - google.golang.org/grpc v1.59.0 // indirect - google.golang.org/protobuf v1.33.0 // indirect + golang.org/x/net v0.58.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/text v0.41.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect + google.golang.org/grpc v1.83.2 // indirect + google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/mooncake-transfer-engine/example/http-metadata-server/go.mod b/mooncake-transfer-engine/example/http-metadata-server/go.mod index 84a942aa88..808969fbc4 100644 --- a/mooncake-transfer-engine/example/http-metadata-server/go.mod +++ b/mooncake-transfer-engine/example/http-metadata-server/go.mod @@ -1,8 +1,8 @@ module github.com/kvcache-ai/Mooncake/mooncake-transfer-engine/example/http-metadata-server -go 1.23.0 +go 1.26.0 -toolchain go1.23.8 +toolchain go1.26.10 require github.com/gin-gonic/gin v1.10.0 @@ -27,10 +27,10 @@ require ( github.com/twitchyliquid64/golang-asm v0.15.1 // indirect github.com/ugorji/go/codec v1.2.12 // indirect golang.org/x/arch v0.8.0 // indirect - golang.org/x/crypto v0.36.0 // indirect - golang.org/x/net v0.38.0 // indirect - golang.org/x/sys v0.31.0 // indirect - golang.org/x/text v0.23.0 // indirect + golang.org/x/crypto v0.58.0 // indirect + golang.org/x/net v0.61.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/text v0.43.0 // indirect google.golang.org/protobuf v1.34.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect )