[Docker] Use zstd for CI images and offer a Docker Hub variant (#55608)
Signed-off-by: Nils Matteson <nilsmatteson@icloud.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Nils Matteson committed
Sep 21, 2026 at 13:40 UTC
9fe1cbd463055314863a6de210d5f898200a0a9a
4 files changed
+60
-3
.buildkite/image_build/image_build.sh
+5
-3
@@ -154,7 +154,7 @@ print_bake_config() {
154
local bake_tmp
155
bake_tmp="$(mktemp -d)"
156
BAKE_CONFIG_FILE="${bake_tmp}/bake-config-build-${BUILDKITE_BUILD_NUMBER:-local}.json"
157
- docker buildx bake -f "${VLLM_BAKE_FILE_PATH}" -f "${CI_HCL_PATH}" --print "${TARGET}" | tee "${BAKE_CONFIG_FILE}" || true
157
+ docker buildx bake "${BAKE_FILES[@]}" --print "${TARGET}" | tee "${BAKE_CONFIG_FILE}" || true
158
echo "Saved bake config to ${BAKE_CONFIG_FILE}"
159
echo "--- :arrow_down: Uploading bake config to Buildkite"
160
(cd "$(dirname "${BAKE_CONFIG_FILE}")" && buildkite-agent artifact upload "$(basename "${BAKE_CONFIG_FILE}")")
@@ -230,8 +230,10 @@ TARGET="test-ci"
230
VLLM_BAKE_FILE_PATH="${VLLM_BAKE_FILE_PATH:-docker/docker-bake.hcl}"
231
BUILDER_NAME="${BUILDER_NAME:-vllm-builder}"
232
CI_HCL_URL="${CI_HCL_URL:-https://raw.githubusercontent.com/vllm-project/ci-infra/main/docker/ci.hcl}"
233
-CI_HCL_PATH="/tmp/ci.hcl"
233
+CI_HCL_PATH="${CI_HCL_PATH:-/tmp/ci.hcl}"
234
+ZSTD_HCL_PATH="${ZSTD_HCL_PATH:-.buildkite/image_build/zstd.hcl}"
235
BUILDKIT_SOCKET="/run/buildkit/buildkitd.sock"
236
+BAKE_FILES=(-f "${VLLM_BAKE_FILE_PATH}" -f "${CI_HCL_PATH}" -f "${ZSTD_HCL_PATH}")
237
238
prepare_cache_tags
239
ecr_login
@@ -309,7 +311,7 @@ BUILD_TMP_DIR="$(mktemp -d)"
311
trap 'rm -rf -- "${BUILD_TMP_DIR}"' EXIT
312
BUILD_METADATA_FILE="${BUILD_TMP_DIR}/build-metadata.json"
313
BUILD_STATUS=0
312
-docker --debug buildx bake -f "${VLLM_BAKE_FILE_PATH}" -f "${CI_HCL_PATH}" \
314
+docker --debug buildx bake "${BAKE_FILES[@]}" \
315
--progress plain --metadata-file "${BUILD_METADATA_FILE}" "${TARGET}" || BUILD_STATUS=$?
316
317
record_buildkit_trace "${BUILD_METADATA_FILE}" || true
.buildkite/image_build/zstd.hcl
new
+3
@@ -0,0 +1,3 @@
1
+target "test-ci" {
2
+ output = ["type=registry,compression=zstd,compression-level=3,force-compression=true,oci-mediatypes=true"]
3
+}
.buildkite/scripts/publish-release-images.sh
+7
@@ -61,6 +61,13 @@ if target_enabled cuda-13-0; then
61
docker manifest create "vllm/vllm-openai:v${RELEASE_VERSION}" "vllm/vllm-openai:v${RELEASE_VERSION}-x86_64" "vllm/vllm-openai:v${RELEASE_VERSION}-aarch64"
62
docker manifest push vllm/vllm-openai:latest
63
docker manifest push "vllm/vllm-openai:v${RELEASE_VERSION}"
64
+
65
+ ZSTD_DIGEST=$(docker buildx imagetools inspect \
66
+ "public.ecr.aws/q9t5s3a7/vllm-release-repo:${COMMIT}-x86_64" \
67
+ --format '{{json .Manifest.Digest}}' | tr -d '"')
68
+ .buildkite/scripts/publish-zstd-image.sh \
69
+ "public.ecr.aws/q9t5s3a7/vllm-release-repo@${ZSTD_DIGEST}" \
70
+ "vllm/vllm-openai:v${RELEASE_VERSION}-x86_64-zstd"
71
fi
72
73
# ---- CUDA 12.9 ----
.buildkite/scripts/publish-zstd-image.sh
new
+45
@@ -0,0 +1,45 @@
1
+#!/bin/bash
2
+# SPDX-License-Identifier: Apache-2.0
3
+# SPDX-FileCopyrightText: Copyright contributors to the vLLM project
4
+
5
+set -euo pipefail
6
+
7
+if [ "$#" -ne 2 ]; then
8
+ echo "Usage: $0 SOURCE@sha256:DIGEST DESTINATION-zstd" >&2
9
+ exit 2
10
+fi
11
+
12
+SOURCE=$1
13
+DESTINATION=$2
14
+if [[ ! "$SOURCE" =~ ^[a-zA-Z0-9][a-zA-Z0-9._:/-]*@sha256:[a-f0-9]{64}$ ]] ||
15
+ [[ ! "$DESTINATION" =~ ^[a-zA-Z0-9][a-zA-Z0-9._:/-]*:[a-zA-Z0-9_][a-zA-Z0-9_.-]*-zstd$ ]]; then
16
+ echo "ERROR: source must use an immutable sha256 digest and destination must end in -zstd" >&2
17
+ exit 2
18
+fi
19
+
20
+BUILDER=
21
+cleanup() {
22
+ status=$?
23
+ trap - EXIT INT TERM
24
+ if [ -n "$BUILDER" ] && ! docker buildx rm --force "$BUILDER"; then
25
+ echo "ERROR: failed to remove Buildx builder $BUILDER" >&2
26
+ [ "$status" -ne 0 ] || status=1
27
+ fi
28
+ exit "$status"
29
+}
30
+trap cleanup EXIT
31
+trap 'exit 130' INT
32
+trap 'exit 143' TERM
33
+
34
+BUILDER=$(docker buildx create \
35
+ --driver docker-container \
36
+ --driver-opt network=host \
37
+ --driver-opt 'image=moby/buildkit:v0.32.2@sha256:28a898719c18a33f4e8000685287fa36fd0dd9560c6440227d3a732d79bb41d8')
38
+
39
+printf '# check=error=true\n\nFROM %s\n' "$SOURCE" | docker buildx build \
40
+ --builder "$BUILDER" \
41
+ --platform linux/amd64 \
42
+ --progress plain \
43
+ --provenance=mode=min \
44
+ --output "type=image,name=${DESTINATION},push=true,compression=zstd,compression-level=3,force-compression=true,oci-mediatypes=true" \
45
+ -