[Bug]: LiteLLM docker no longer buildable due to Chainguard image update

[Dima-Mediator]

What happened?

Happy Thanksgiving!

3 days ago, Chainguard has updated their python:latest-dev image to Python 3.14
(see https://images.chainguard.dev/directory/image/python/versions)

LiteLLM is no longer buildable in Docker, and build fails on (see below) due to 3.13 vs 3.14 conflict.

RUN apk add --no-cache gcc python3-dev openssl openssl-dev 

Meanwhile, Chainguard does not distribute older base images without "talk to us" (they need to get paid). Lol.

We would not dare to begin porting LiteLLM to 3.14 ourselves, there is likely at least some hell with dependencies, etc;

What's the maintainers plan, and what should the community do when we need to build our own images?

Relevant log output

Are you a ML Ops Team?

No

What LiteLLM version are you on ?

v1.80.5

Twitter / LinkedIn details

No response

[nikoizs]

We have the same issue also on older version (1.78.5)

[Dima-Mediator]

Well, all versions are affected. I guess the maintainers are aware, as there has not been any release (even nightly) for last 4 days.

[hueyjeong]

Thanks to the OP and the commenters, I realized the base image was the culprit. I switched to python:3.13-slim, which allowed me to finally build and fix my code.

I was originally trying to patch the code to handle 'thinking' leaking into the model output, but the build failure was blocking me.

However, I'm hesitant to submit a PR. Whether it's the Dockerfile change or the code fix, I honestly don't trust my modifications enough to contribute them back. 😂

Have a nice day!

# Base image for building (Debian Slim)
ARG LITELLM_BUILD_IMAGE=python:3.13-slim

# Runtime image (Debian Slim)
ARG LITELLM_RUNTIME_IMAGE=python:3.13-slim

# --- Builder stage ---
FROM $LITELLM_BUILD_IMAGE AS builder

# Set the working directory to /app
WORKDIR /app

USER root

# Install build dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    build-essential \
    libssl-dev \
    nodejs \
    npm \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --upgrade pip>=24.3.1 && \
    pip install build

# Copy the current directory contents into the container at /app
COPY . .

# Fix line endings for shell scripts in builder stage
RUN sed -i 's/\r$//' docker/build_admin_ui.sh docker/install_auto_router.sh

# Build Admin UI
RUN chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh

# Build the package
RUN rm -rf dist/* && python -m build

# There should be only one wheel file now, assume the build only creates one
RUN ls -1 dist/*.whl | head -1

# Install the package
RUN pip install dist/*.whl

# install dependencies as wheels
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt

# ensure pyjwt is used, not jwt
RUN pip uninstall jwt -y || true
RUN pip uninstall PyJWT -y || true
RUN pip install PyJWT==2.9.0 --no-cache-dir

# Runtime stage
FROM $LITELLM_RUNTIME_IMAGE AS runtime

# Ensure runtime stage runs as root
USER root

# Install runtime dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    openssl \
    ca-certificates \
    tzdata \
    nodejs \
    npm \
    && rm -rf /var/lib/apt/lists/*

# Upgrade pip to fix CVE-2025-8869
RUN pip install --upgrade pip>=24.3.1

WORKDIR /app
# Copy the current directory contents into the container at /app
COPY . .
RUN ls -la /app

# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
COPY --from=builder /app/dist/*.whl .
COPY --from=builder /wheels/ /wheels/

# Install the built wheel using pip; again using a wildcard if it's the only file
RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels

# Remove test files and keys from dependencies
# Debian's path is /usr/local/lib/python3.13/site-packages, so scope is adjusted to /usr/local/lib
RUN find /usr/local/lib -type f -path "*/tornado/test/*" -delete && \
    find /usr/local/lib -type d -path "*/tornado/test" -delete

# Fix line endings for shell scripts in runtime stage
RUN sed -i 's/\r$//' docker/install_auto_router.sh docker/entrypoint.sh docker/prod_entrypoint.sh

# Install semantic_router and aurelio-sdk using script
RUN chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh

# Generate prisma client
RUN prisma generate
RUN chmod +x docker/entrypoint.sh
RUN chmod +x docker/prod_entrypoint.sh

EXPOSE 4000/tcp

RUN apt-get update && \
    apt-get install -y --no-install-recommends supervisor && \
    rm -rf /var/lib/apt/lists/*

COPY docker/supervisord.conf /etc/supervisord.conf

ENTRYPOINT ["docker/prod_entrypoint.sh"]

# Append "--detailed_debug" to the end of CMD to view detailed debug logs
CMD ["--port", "4000"]

[emerzon]

my workaround was to move to the wolfi-base images. Not doing a PR since I am not sure this is a good definitive fix, but to be considered:
Updated Dockerfile:

# Base image for building
#ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/python:latest-dev
ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base

# Runtime image
#ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/python:latest-dev
ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base

# Builder stage
FROM $LITELLM_BUILD_IMAGE AS builder

# Set the working directory to /app
WORKDIR /app

USER root

# Install build dependencies
RUN apk add --no-cache bash gcc py3-pip python3 python3-dev openssl openssl-dev


RUN python -m pip install build

# Copy the current directory contents into the container at /app
COPY . .

# Build Admin UI
RUN chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh

# Build the package
RUN rm -rf dist/* && python -m build

# There should be only one wheel file now, assume the build only creates one
RUN ls -1 dist/*.whl | head -1

# Install the package
RUN pip install dist/*.whl

# install dependencies as wheels
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt

# ensure pyjwt is used, not jwt
RUN pip uninstall jwt -y
RUN pip uninstall PyJWT -y
RUN pip install PyJWT==2.9.0 --no-cache-dir

# Runtime stage
FROM $LITELLM_RUNTIME_IMAGE AS runtime

# Ensure runtime stage runs as root
USER root

# Install runtime dependencies
RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip

# Upgrade pip to fix CVE-2025-8869
#RUN python -m pip install --upgrade pip>=24.3.1

WORKDIR /app
# Copy the current directory contents into the container at /app
COPY . .
RUN ls -la /app

# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
COPY --from=builder /app/dist/*.whl .
COPY --from=builder /wheels/ /wheels/

# Install the built wheel using pip; again using a wildcard if it's the only file
RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels

# Remove test files and keys from dependencies
RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
    find /usr/lib -type d -path "*/tornado/test" -delete

# Install semantic_router and aurelio-sdk using script
RUN chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh

# Generate prisma client
RUN prisma generate
RUN chmod +x docker/entrypoint.sh
RUN chmod +x docker/prod_entrypoint.sh

EXPOSE 4000/tcp

RUN apk add --no-cache supervisor
COPY docker/supervisord.conf /etc/supervisord.conf

ENTRYPOINT ["docker/prod_entrypoint.sh"]

# Append "--detailed_debug" to the end of CMD to view detailed debug logs
CMD ["--port", "4000"] 

[emerzon]

Fixed by #17406