Update dockerfile and add docker build action

[jkulhanek]

This PR updates current Dockerfile:

• It builds gsplat
• Reduces image size by using multistage build and removing dev dependencies.
• Removes changed user -> enables installing inside docker + simplifies apptainer uses.

It also adds a github action to build the docker image and push it to associated NerfStudio ghcr packages repository. (We need to enable this first, however).

[pwais]

NB: this change basically gets rid of the user and security / "OCI Standards" changes introduced in #2961

The user also needs a more modern version of docker to use multi-stage builds / syntax=docker/dockerfile:1 but that's probably less of an issue today than a year ago. You might still put # syntax=docker/dockerfile:1 at the top.

Not that I'm advocating for restoring the cited changes / user account stuff, but as a nerfstudio user it's really confusing that other PR was accepted in the first place 🤷‍♂️

[jkulhanek]

I actually think changing user is not a good practice. We would require uses to build their own images with their own user id? Seems like this is not ideal for releasing a docker image. Also, I though using sudo is a bad practice for docker nowadays. Also, while #2961 works for podman, it breaks apptainer which I think is more common, and the current solution could also work rootless in podman (just running image, not sure about the compilation).

[pwais]

FWIW The main case where I've seen a user-ful / sudo docker image helpful at scale was in large teams where a running docker container would need to connect to external developer services and thus a default user account helped provide basic / canonical auth. But this is an open source project w/out public dev services and so I don't recommend it (and TBH I could not grok the arguments given in #2961 ).

I would advocate the nerfstudio image be fairly vanilla and then the end user can compose / build atop the image whatever accounts and such they need. E.g. much of the changes in #2961 could have been an add-on / community plugin, with perhaps also a demo of actually using those features. (I've never seen podman / apptainer required at scale, but I guess some contemporary GPU clusters do that because hardware drivers are hard to manage).

[brentyi]

(aside from one comment I tried this and it looks good to me!)

[jkulhanek]

Do we want to build with every push into main or with every release?

[brentyi]

Currently we have: docker pull ghcr.io/nerfstudio-project/nerfstudio:1.1.3

What would that look like if we built with every commit?

[jkulhanek]

We would still have docker pull ghcr.io/nerfstudio-project/nerfstudio:1.1.3 for releases and docker pull ghcr.io/nerfstudio-project/nerfstudio:latest or docker pull ghcr.io/nerfstudio-project/nerfstudio for current main.

[brentyi]

In that case doing on every commit makes sense to me! If there are Docker-related problems it'd also help us catch them earlier. (as opposed to only testing the Docker action when we do a release)

[jkulhanek]

Seems like the gsplat build is running out of CPU/mem...

The hosted runner: GitHub Actions 20 lost communication with the server. Anything in your workflow that terminates the runner process, starves it for CPU/Memory, or blocks its network access can cause this error.

Does anyone have an idea? Perhaps limit the number of CPU cores for the gsplat build?

[brentyi]

@jkulhanek it seems like setting MAX_JOBS helped, does that seem reasonable?

[jkulhanek]

@jkulhanek it seems like setting MAX_JOBS helped, does that seem reasonable?
Sure, looks ok to me.

[jkulhanek]

I've changed the settings on nerfstudio docker package to inherit the organization permissions and I've locked myself out of it. @brentyi, can you please re-add me as the admin of the package? The build was failing on write permissions which I hope to have fixed before locking myself out.

[brentyi]

@brentyi, can you please re-add me as the admin of the package?

Should be done!

[jkulhanek]

Which version of gsplat do we want to build with? Last main, last released or some fixed version (1.0.0) to match pip install?

[thawn]

@jkulhanek thanks for your excellent work. I pulled docker://ghcr.io/nerfstudio-project/nerfstudio:pr-3283 with singularity and it works well 👍

Your work towards reducing image size seems to have payed off. The image is just 5GB instead of 8 - 11GB.

[jkulhanek]

If the build passes it should be ready to be merged. I've updated the docs.

[thawn]

@jkulhanek the image attestation failed. Any idea why?

[jkulhanek]

Looks good. Merging.

[brentyi]

Thanks for your efforts here @jkulhanek!!