fix: pillow updates and others for images

[mckornfield]

Summary by CodeRabbit

• Bug Fixes
  • Standardized the Pillow image-processing library version across runtime and training containers.
  • Removed outdated Pillow artifacts to prevent conflicts and ensure the intended version is used.
  • Updated inherited system packages to address fixable security vulnerabilities in base images.
• Chores
  • Cleaned unused package metadata and caches to reduce container image bloat.

[coderabbitai]

📝 Walkthrough

Walkthrough

Docker images now constrain Pillow to version 12.x, remove inherited Pillow artifacts, reinstall it where required, and upgrade selected Ubuntu packages in the NeMo-RL base image.

Changes

Container dependency and image hardening

Layer / File(s)	Summary
Pin and clean Pillow docker/Dockerfile.nmp-customizer-tasks, docker/Dockerfile.nmp-rl-training, docker/Dockerfile.nmp-unsloth-training, docker/automodel/Dockerfile.nmp-automodel-base	Pillow is constrained to >=12.3.0,<13; stale system, virtual-environment, and uv-cache Pillow artifacts are removed, with training images reinstalling the pinned package.
Remediate inherited Ubuntu packages docker/Dockerfile.nmp-rl-base	libssl3t64, openssl, and rsync are upgraded or installed, followed by apt cache cleanup.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#670: Updates related Pillow constraints and Docker image cleanup.
• NVIDIA-NeMo/nemo-platform#684: Introduces the customizer tasks Dockerfile modified here.

Suggested reviewers: shanaiabuggy, crookedstorm, ironcommit

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: Pillow pinning and image-container cleanup/hardening across Dockerfiles.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cve-0721/mck

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

docker/Dockerfile.nmp-rl-base (1)

31-34: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add --no-install-recommends.

This avoids pulling unnecessary packages into the hardened base image and reduces image size and vulnerability surface.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.nmp-rl-base` around lines 31 - 34, Add the
--no-install-recommends option to the apt-get install command in
Dockerfile.nmp-rl-base, while preserving the existing package upgrades and
cleanup behavior.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docker/Dockerfile.nmp-rl-base`:
- Around line 31-34: Add the --no-install-recommends option to the apt-get
install command in Dockerfile.nmp-rl-base, while preserving the existing package
upgrades and cleanup behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e91959ae-71ec-4ba8-98e5-9279ca0a2ca3

📥 Commits

Reviewing files that changed from the base of the PR and between 300f082 and 27d057f.

📒 Files selected for processing (5)

• docker/Dockerfile.nmp-customizer-tasks
• docker/Dockerfile.nmp-rl-base
• docker/Dockerfile.nmp-rl-training
• docker/Dockerfile.nmp-unsloth-training
• docker/automodel/Dockerfile.nmp-automodel-base

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	26384/34035	77.5%	61.8%
Integration Tests	15177/32660	46.5%	18.7%