install geometric dependencies before invalidating caches with source…

… copy (#224)

* install geometric dependencies before invalidating caches with source code copy

* add requirements-cve to docker build

* expand dockerignore

* update requirements-cve

* add jupyter server cve

* add comment for jupyter-server

.dockerignore

@@ -0,0 +1 @@
+.gitignore

Dockerfile

@@ -79,6 +79,12 @@ ENV UV_LINK_MODE=copy \
   UV_PYTHON_DOWNLOADS=never \
   UV_SYSTEM_PYTHON=true
 
+# Install the bionemo-geomtric requirements ahead of copying over the rest of the repo, so that we can cache their
+# installation. These involve building some torch extensions, so they can take a while to install.
+RUN --mount=type=bind,source=./sub-packages/bionemo-geometric/requirements.txt,target=/requirements-pyg.txt \
+  --mount=type=cache,id=uv-cache,target=/root/.cache,sharing=locked \
+  uv pip install --no-build-isolation -r /requirements-pyg.txt
+
 WORKDIR /workspace/bionemo2
 
 # Install 3rd-party deps and bionemo submodules.
@@ -88,8 +94,9 @@ COPY ./sub-packages /workspace/bionemo2/sub-packages
 # Note, we need to mount the .git folder here so that setuptools-scm is able to fetch git tag for version.
 RUN --mount=type=bind,source=./.git,target=./.git \
   --mount=type=cache,id=uv-cache,target=/root/.cache,sharing=locked \
+  --mount=type=bind,source=./requirements-cve.txt,target=/requirements-cve.txt \
   <<EOT
-uv pip install --no-build-isolation ./3rdparty/* ./sub-packages/bionemo-*
+uv pip install --no-build-isolation ./3rdparty/* ./sub-packages/bionemo-* -r /requirements-cve.txt
 rm -rf ./3rdparty
 rm -rf /tmp/*
 EOT

requirements-cve.txt

@@ -1,6 +1,7 @@
 onnx>=1.16.0
 setuptools>=70.0.0
 aiohttp>=3.9.4
-jupyterlab>=3.6.7
+jupyterlab>=3.6.8
+jupyter_server>=2.14.1  # https://github.com/advisories/GHSA-hrw6-wg82-cm62
 Werkzeug>=3.0.3
 nltk>=3.9.1

sub-packages/bionemo-geometric/pyproject.toml

@@ -14,7 +14,8 @@ classifiers = ["Private :: Do Not Upload", "Programming Language :: Python :: 3.
 dynamic = ["version"]
 dependencies = [
     'bionemo-core',
-    # Version pins for the pip package. If updating these, also update the image pins in requirements.txt.
+    # Version pins for the pip package. If updating these, also update the image pins in requirements.txt. Ideally we
+    # should allow these dependencies to float in the package definition.
     'torch-cluster==1.6.3',
     'torch-geometric==2.5.0',
     'torch-scatter==2.1.2',