Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MLCube container image hash checking & Disable network #472

Merged
merged 79 commits into from
Aug 3, 2023

Conversation

aristizabal95
Copy link
Contributor

@aristizabal95 aristizabal95 commented Jul 27, 2023

This PR makes use of recently added features on MLCube for ensuring reproducibility and reducing vulnerabilities on external code execution. This is done with the following 2 features:

  • Container hash checking: Using mlcube inspect, we can now get the hash of the container image (original image if converted) and compare against a ground truth on our server. This ensures users won't be able to change the image contents after submitting an MLCube.
  • Disabling network access: MLCube recently enabled passing the --network flag during execution time. We're using this to disable network access, ensuring MLCubes won't be able to retrieve or send information to another location during execution.

Closes #469.

TODO:

  • Implement tests for hash checking (No tests are implement for any hash checking we're doing on MLCubes)
  • Import latest MLCube version (inspect is on a pre-release, which is not yet installable through requirements.txt)

@aristizabal95 aristizabal95 temporarily deployed to testing-external-code July 28, 2023 22:11 — with GitHub Actions Inactive
@aristizabal95 aristizabal95 temporarily deployed to testing-external-code July 28, 2023 22:13 — with GitHub Actions Inactive
@aristizabal95 aristizabal95 temporarily deployed to testing-external-code July 28, 2023 22:13 — with GitHub Actions Inactive
@aristizabal95 aristizabal95 temporarily deployed to testing-external-code July 31, 2023 21:23 — with GitHub Actions Inactive
@aristizabal95 aristizabal95 temporarily deployed to testing-external-code July 31, 2023 23:02 — with GitHub Actions Inactive
@hasan7n hasan7n had a problem deploying to testing-external-code August 2, 2023 04:25 — with GitHub Actions Failure
@hasan7n hasan7n temporarily deployed to testing-external-code August 2, 2023 05:12 — with GitHub Actions Inactive
@hasan7n hasan7n temporarily deployed to testing-external-code August 2, 2023 16:03 — with GitHub Actions Inactive
@hasan7n hasan7n had a problem deploying to testing-external-code August 3, 2023 18:43 — with GitHub Actions Failure
@hasan7n hasan7n merged commit 79650db into mlcommons:main Aug 3, 2023
6 of 7 checks passed
@github-actions github-actions bot locked and limited conversation to collaborators Aug 3, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
component: client issues regarding the CLI High Priority Urgent tasks type: enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add MLCube hash storing and checking
2 participants