From 648c3ebee673cf0ece078a94d07a24ef0c7e63ca Mon Sep 17 00:00:00 2001 From: "Kevin H. Luu" Date: Thu, 28 May 2026 23:34:16 -0700 Subject: [PATCH] [CI] Separate non-root smoke tests from image build step (#43712) Co-authored-by: Claude Opus 4.6 (1M context) --- .buildkite/image_build/image_build.yaml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.buildkite/image_build/image_build.yaml b/.buildkite/image_build/image_build.yaml index 5d6ce7309e8..f401f60ec96 100644 --- a/.buildkite/image_build/image_build.yaml +++ b/.buildkite/image_build/image_build.yaml @@ -6,14 +6,26 @@ steps: timeout_in_minutes: 600 commands: - if [[ "$BUILDKITE_BRANCH" == "main" ]]; then .buildkite/image_build/image_build.sh $REGISTRY $REPO $BUILDKITE_COMMIT $BRANCH $IMAGE_TAG $IMAGE_TAG_LATEST; else .buildkite/image_build/image_build.sh $REGISTRY $REPO $BUILDKITE_COMMIT $BRANCH $IMAGE_TAG; fi - # Non-root smoke 1: the default (root) image must still be importable + retry: + automatic: + - exit_status: -1 # Agent was lost + limit: 2 + - exit_status: -10 # Agent was lost + limit: 2 + + - label: ":docker: :smoking: Non-root smoke tests" + key: image-smoke-test + depends_on: + - image-build + commands: + # Smoke 1: the default (root) image must still be importable # under a non-root UID via `--user 2000:0`. Validates the `vllm` passwd # entry + group-0-writable /home/vllm + uv path cleanup from #31959. # Uses `import vllm` rather than `vllm serve --help` because the latter # instantiates `VllmConfig` which requires a GPU attached to the # container. - docker run --rm --user 2000:0 --entrypoint python3 "$IMAGE_TAG" -c "import vllm; print(vllm.__version__)" - # Non-root smoke 2: assert the non-root enabling invariants are baked + # Smoke 2: assert the non-root enabling invariants are baked # into the image. Runs as UID 2000:0 via a shell so we can verify # filesystem perms + passwd/group file state + wrapper presence without # triggering vLLM's GPU-requiring config-init path. The opt-in