Fix Grafana Modal image setup and runtime environment
9864974 parent: 1126d97 modified
modal_grafana.py +19 -15 | @@ -25,22 +25,15 @@ grafana_secret = modal.Secret.from_name( | ||
| 25 | 25 | ], |
| 26 | 26 | ) |
| 27 | 27 | image = ( |
| 28 | - modal.Image.from_registry("grafana/grafana:11.6.0", add_python="3.12") | |
| 29 | - .run_commands("grafana cli plugins install grafana-clickhouse-datasource") | |
| 30 | - .add_local_dir("grafana/provisioning", "/etc/grafana/provisioning", copy=True) | |
| 31 | - .env( | |
| 32 | - { | |
| 33 | - "GF_AUTH_DISABLE_LOGIN_FORM": "true", | |
| 34 | - "GF_AUTH_GENERIC_OAUTH_ENABLED": "true", | |
| 35 | - "GF_AUTH_GENERIC_OAUTH_NAME": "Pocket ID", | |
| 36 | - "GF_AUTH_GENERIC_OAUTH_SCOPES": "openid profile email offline_access", | |
| 37 | - "GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP": "true", | |
| 38 | - "GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN": "true", | |
| 39 | - "GF_AUTH_GENERIC_OAUTH_USE_PKCE": "true", | |
| 40 | - "GF_AUTH_GENERIC_OAUTH_USE_REFRESH_TOKEN": "true", | |
| 41 | - "GF_AUTH_GENERIC_OAUTH_VALIDATE_ID_TOKEN": "true", | |
| 42 | - } | |
| 28 | + modal.Image.from_registry( | |
| 29 | + "grafana/grafana:11.6.0", | |
| 30 | + add_python="3.12", | |
| 31 | + # Grafana's registry image runs as a non-root user. Modal injects and | |
| 32 | + # probes its Python runtime while preparing the Function image. | |
| 33 | + setup_dockerfile_commands=["USER root"], | |
| 43 | 34 | ) |
| 35 | + .run_commands("grafana cli plugins install grafana-clickhouse-datasource") | |
| 36 | + .add_local_dir("grafana/provisioning", "/etc/grafana/provisioning") | |
| 44 | 37 | ) |
| 45 | 38 | |
| 46 | 39 | |
| @@ -51,6 +44,17 @@ image = ( | ||
| 51 | 44 | max_containers=1, |
| 52 | 45 | scaledown_window=IDLE_SECONDS, |
| 53 | 46 | timeout=15 * 60, |
| 47 | + env={ | |
| 48 | + "GF_AUTH_DISABLE_LOGIN_FORM": "true", | |
| 49 | + "GF_AUTH_GENERIC_OAUTH_ENABLED": "true", | |
| 50 | + "GF_AUTH_GENERIC_OAUTH_NAME": "Pocket ID", | |
| 51 | + "GF_AUTH_GENERIC_OAUTH_SCOPES": "openid profile email offline_access", | |
| 52 | + "GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP": "true", | |
| 53 | + "GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN": "true", | |
| 54 | + "GF_AUTH_GENERIC_OAUTH_USE_PKCE": "true", | |
| 55 | + "GF_AUTH_GENERIC_OAUTH_USE_REFRESH_TOKEN": "true", | |
| 56 | + "GF_AUTH_GENERIC_OAUTH_VALIDATE_ID_TOKEN": "true", | |
| 57 | + }, | |
| 54 | 58 | ) |
| 55 | 59 | @modal.web_server(3000, startup_timeout=120) |
| 56 | 60 | def grafana() -> None: |
| @@ -25,22 +25,15 @@ grafana_secret = modal.Secret.from_name( | |||
| 25 | ], | 25 | ], |
| 26 | ) | 26 | ) |
| 27 | image = ( | 27 | image = ( |
| 28 | - modal.Image.from_registry("grafana/grafana:11.6.0", add_python="3.12") | 28 | + modal.Image.from_registry( |
| 29 | - .run_commands("grafana cli plugins install grafana-clickhouse-datasource") | 29 | + "grafana/grafana:11.6.0", |
| 30 | - .add_local_dir("grafana/provisioning", "/etc/grafana/provisioning", copy=True) | 30 | + add_python="3.12", |
| 31 | - .env( | 31 | + # Grafana's registry image runs as a non-root user. Modal injects and |
| 32 | - { | 32 | + # probes its Python runtime while preparing the Function image. |
| 33 | - "GF_AUTH_DISABLE_LOGIN_FORM": "true", | 33 | + setup_dockerfile_commands=["USER root"], |
| 34 | - "GF_AUTH_GENERIC_OAUTH_ENABLED": "true", | ||
| 35 | - "GF_AUTH_GENERIC_OAUTH_NAME": "Pocket ID", | ||
| 36 | - "GF_AUTH_GENERIC_OAUTH_SCOPES": "openid profile email offline_access", | ||
| 37 | - "GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP": "true", | ||
| 38 | - "GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN": "true", | ||
| 39 | - "GF_AUTH_GENERIC_OAUTH_USE_PKCE": "true", | ||
| 40 | - "GF_AUTH_GENERIC_OAUTH_USE_REFRESH_TOKEN": "true", | ||
| 41 | - "GF_AUTH_GENERIC_OAUTH_VALIDATE_ID_TOKEN": "true", | ||
| 42 | - } | ||
| 43 | ) | 34 | ) |
| 35 | + .run_commands("grafana cli plugins install grafana-clickhouse-datasource") | ||
| 36 | + .add_local_dir("grafana/provisioning", "/etc/grafana/provisioning") | ||
| 44 | ) | 37 | ) |
| 45 | 38 | ||
| 46 | 39 | ||
| @@ -51,6 +44,17 @@ image = ( | |||
| 51 | max_containers=1, | 44 | max_containers=1, |
| 52 | scaledown_window=IDLE_SECONDS, | 45 | scaledown_window=IDLE_SECONDS, |
| 53 | timeout=15 * 60, | 46 | timeout=15 * 60, |
| 47 | + env={ | ||
| 48 | + "GF_AUTH_DISABLE_LOGIN_FORM": "true", | ||
| 49 | + "GF_AUTH_GENERIC_OAUTH_ENABLED": "true", | ||
| 50 | + "GF_AUTH_GENERIC_OAUTH_NAME": "Pocket ID", | ||
| 51 | + "GF_AUTH_GENERIC_OAUTH_SCOPES": "openid profile email offline_access", | ||
| 52 | + "GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP": "true", | ||
| 53 | + "GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN": "true", | ||
| 54 | + "GF_AUTH_GENERIC_OAUTH_USE_PKCE": "true", | ||
| 55 | + "GF_AUTH_GENERIC_OAUTH_USE_REFRESH_TOKEN": "true", | ||
| 56 | + "GF_AUTH_GENERIC_OAUTH_VALIDATE_ID_TOKEN": "true", | ||
| 57 | + }, | ||
| 54 | ) | 58 | ) |
| 55 | @modal.web_server(3000, startup_timeout=120) | 59 | @modal.web_server(3000, startup_timeout=120) |
| 56 | def grafana() -> None: | 60 | def grafana() -> None: |