AWS sagemaker documentation change
Summary
Simplified Dockerfile section by removing templates and adding detailed AWS CLI instructions for attaching images to SageMaker domain
Security assessment
The changes focus on improving documentation structure and adding AWS CLI procedures, with no mention of security vulnerabilities or new security features.
Diff
diff --git a/sagemaker/latest/dg/studio-updated-jl-provide-users-with-images.md index d13622ec4..93fc3d22e 100644 --- a/sagemaker/latest/dg/studio-updated-jl-provide-users-with-images.md +++ b/sagemaker/latest/dg/studio-updated-jl-provide-users-with-images.md @@ -5 +5 @@ -Step 1: Create the DockerfileStep 2: Build the DockerfileStep 3: Push the image to the Amazon Elastic Container Registry repositoryStep 4: Attach image to the Amazon SageMaker AI domain of your users +Step 1: Create the DockerfileStep 2: Build the imageStep 3: Push the image to the Amazon Elastic Container Registry repositoryStep 4: Attach image to the Amazon SageMaker AI domain of your users @@ -53 +53 @@ Your Dockerfile must meet the specifications provided in [Dockerfile specificati -Use the following Dockerfile template to create an Amazon Linux 2 image: +For Dockerfile templates, see [Health check and URL for applications](./studio-updated-jl-image-specifications.html#studio-updated-jl-admin-guide-custom-images-app-healthcheck). @@ -55,46 +55 @@ Use the following Dockerfile template to create an Amazon Linux 2 image: - - FROM public.ecr.aws/amazonlinux/amazonlinux:2 - - ARG NB_USER="sagemaker-user" - ARG NB_UID="1000" - ARG NB_GID="100" - RUN yum install --assumeyes python3 shadow-utils && \ - useradd --create-home --shell /bin/bash --gid "${NB_GID}" --uid ${NB_UID} ${NB_USER} && \ - yum clean all && \ - python3 -m pip install jupyterlab - - RUN python3 -m pip install --upgrade pip - - RUN python3 -m pip install --upgrade urllib3==1.26.6 - - USER ${NB_UID} - CMD jupyter lab --ip 0.0.0.0 --port 8888 \ - --ServerApp.base_url="/jupyterlab/default" \ - --ServerApp.token='' \ - --ServerApp.allow_origin='*' - - - - -Use the following Dockerfile template to create an Amazon SageMaker Distribution Image: - - - FROM public.ecr.aws/sagemaker/sagemaker-distribution:latest-cpu - ARG NB_USER="sagemaker-user" - ARG NB_UID=1000 - ARG NB_GID=100 - - ENV MAMBA_USER=$NB_USER - - USER root - - RUN apt-get update - RUN micromamba install sagemaker-inference --freeze-installed --yes --channel conda-forge --name base - - USER $MAMBA_USER - - ENTRYPOINT ["jupyter-lab"] - CMD ["--ServerApp.ip=0.0.0.0", "--ServerApp.port=8888", "--ServerApp.allow_origin=*", "--ServerApp.token=''", "--ServerApp.base_url=/jupyterlab/default"] - - -## Step 2: Build the Dockerfile +## Step 2: Build the image @@ -137,0 +93,2 @@ After you’ve pushed the image, you must access it from your Amazon SageMaker A +**Attach the image using the SageMaker AI console** + @@ -156,0 +114,63 @@ After you’ve pushed the image, you must access it from your Amazon SageMaker A +**Attach the image using the AWS CLI** + +Use the following procedure to attach the image to a SageMaker domain through the AWS CLI : + + 1. Create a SageMaker AI image. The `AmazonSageMakerFullAccess` policy must be attached to your role as you use the following AWS CLI commands. + + aws sagemaker create-image \ + --image-name custom-image \ + --role-arn arn:aws:iam::account-id:role/service-role/execution-role + + 2. Create a SageMaker AI image version from the image. Pass the unique tag value that you chose when you pushed the image to Amazon ECR. + + aws sagemaker create-image-version \ + --image-name custom-image \ + --base-image repository-uri:tag + + 3. Create a configuration file called `app-image-config-input.json`. The application image configuration is used as configuration for running a SageMaker AI image as a Code Editor application. You may also specify your [`ContainerConfig`](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ContainerConfig.html) arguments here. + + { + "AppImageConfigName": "app-image-config", + "CodeEditorAppImageConfig": + { + "ContainerConfig": + {} + } + } + + 4. Create the `AppImageConfig` using the application image configuration file that you created. + + aws sagemaker create-app-image-config \ + --cli-input-json file://app-image-config-input.json + + 5. Create a configuration file, named `updateDomain.json`. Be sure to specify your domain ID. + + { + "DomainId": "domain-id", + "DefaultUserSettings": { + "JupyterLabAppSettings": { + "CustomImages": [ + { + "ImageName": "custom-image", + "AppImageConfigName": "app-image-config" + } + ] + } + } + } + + 6. Call the `UpdateDomain` command with the configuration file as input. + +###### Note + +You must delete all of the applications in your domain before updating the domain with the new image. Note that you only need to delete applications; you **do not** need to delete user profiles or shared spaces. For instructions on deleting applications, choose one of the following options. + + * If you use the SageMaker AI console, run through Step 1 to 5d and Step 6 to 7d of the [Delete a domain (Console)](https://docs.aws.amazon.com/sagemaker/latest/dg/gs-studio-delete-domain.html#gs-studio-delete-domain-studio) section. + + * If you use the AWS CLI, run through Step 1 to 3 of the [Delete a domain (AWS CLI)](https://docs.aws.amazon.com/sagemaker/latest/dg/gs-studio-delete-domain.html#gs-studio-delete-domain-cli) section. + + aws sagemaker update-domain --cli-input-json file://updateDomain.json + + + +