feat(cuda): example to install using melange

.github/workflows/build.yml

@@ -263,6 +263,11 @@ jobs:
             melange_config: envoy/melange.yaml
             arch: aarch64
             runner: ubuntu-24.04-arm
+          # CUDA Python builds (x86_64 only - NVIDIA redist tarballs are x86_64)
+          - name: cuda-python
+            melange_config: cuda-python/melange.yaml
+            arch: x86_64
+            runner: ubuntu-latest
 
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 90
@@ -648,6 +653,10 @@ jobs:
             apko_config: envoy/apko/envoy.yaml
             melange_config: envoy/melange.yaml
             arches: x86_64,aarch64
+          - name: cuda-python
+            apko_config: cuda-python/apko/cuda-python.yaml
+            melange_config: cuda-python/melange.yaml
+            arches: x86_64
 
     steps:
       - name: Checkout repository

Makefile

@@ -48,18 +48,22 @@ VICTORIA_METRICS_VERSION ?= $(call melange_version,victoria-metrics/melange.yaml
 QDRANT_VERSION ?= $(call melange_version,qdrant/melange.yaml)
 OPENSEARCH_VERSION ?= 3.6.0
 
+# --- AI/ML ---
+CUDA_VERSION ?= 12.9.0
+
 .PHONY: all build scan clean help
 .PHONY: python jenkins jenkins-melange go node-slim nginx httpd redis-slim redis-slim-melange mysql mysql-melange mysql-local memcached memcached-melange caddy caddy-melange haproxy haproxy-melange postgres-slim bun sqlite dotnet java php php-melange rails rails-melange kafka kafka-melange keygen opensearch
 .PHONY: valkey valkey-melange nats nats-melange traefik traefik-melange envoy envoy-melange rabbitmq rabbitmq-melange minio minio-melange
 .PHONY: prometheus prometheus-melange mariadb mariadb-melange
 .PHONY: etcd etcd-melange victoria-metrics victoria-metrics-melange jaeger jaeger-melange otelcol otelcol-melange qdrant qdrant-melange deno
-.PHONY: scan-python scan-jenkins scan-go scan-node-slim scan-nginx scan-httpd scan-redis-slim scan-mysql scan-memcached scan-caddy scan-haproxy scan-postgres-slim scan-bun scan-sqlite scan-dotnet scan-java scan-php scan-rails scan-kafka scan-valkey scan-nats scan-traefik scan-rabbitmq scan-minio scan-opensearch scan-prometheus scan-mariadb scan-etcd scan-victoria-metrics scan-jaeger scan-otelcol scan-qdrant scan-deno
-.PHONY: test-python test-jenkins test-go test-node-slim test-nginx test-httpd test-redis-slim test-mysql test-memcached test-caddy test-haproxy test-postgres-slim test-bun test-sqlite test-dotnet test-java test-php test-rails test-kafka test-valkey test-nats test-traefik test-envoy test-rabbitmq test-minio test-opensearch test-prometheus test-mariadb test-etcd test-victoria-metrics test-jaeger test-otelcol test-qdrant test-deno
+.PHONY: cuda-python cuda-python-melange
+.PHONY: scan-python scan-jenkins scan-go scan-node-slim scan-nginx scan-httpd scan-redis-slim scan-mysql scan-memcached scan-caddy scan-haproxy scan-postgres-slim scan-bun scan-sqlite scan-dotnet scan-java scan-php scan-rails scan-kafka scan-valkey scan-nats scan-traefik scan-rabbitmq scan-minio scan-opensearch scan-prometheus scan-mariadb scan-etcd scan-victoria-metrics scan-jaeger scan-otelcol scan-qdrant scan-deno scan-cuda-python
+.PHONY: test-python test-jenkins test-go test-node-slim test-nginx test-httpd test-redis-slim test-mysql test-memcached test-caddy test-haproxy test-postgres-slim test-bun test-sqlite test-dotnet test-java test-php test-rails test-kafka test-valkey test-nats test-traefik test-envoy test-rabbitmq test-minio test-opensearch test-prometheus test-mariadb test-etcd test-victoria-metrics test-jaeger test-otelcol test-qdrant test-deno test-cuda-python
 
 all: build scan
 
 # Build all images
-build: python jenkins go node-slim nginx httpd redis-slim mysql memcached caddy haproxy postgres-slim bun sqlite dotnet java php rails kafka valkey nats traefik envoy rabbitmq minio opensearch prometheus mariadb etcd victoria-metrics jaeger otelcol qdrant deno
+build: python jenkins go node-slim nginx httpd redis-slim mysql memcached caddy haproxy postgres-slim bun sqlite dotnet java php rails kafka valkey nats traefik envoy rabbitmq minio opensearch prometheus mariadb etcd victoria-metrics jaeger otelcol qdrant deno cuda-python
 
 #------------------------------------------------------------------------------
 # SIGNING KEY (required for melange packages)
@@ -691,6 +695,32 @@ deno:
 	@rm -f deno.tar sbom-*.spdx.json
 	@echo "✓ minimal-deno built (Wolfi package, shell-less)"
 
+#------------------------------------------------------------------------------
+# CUDA PYTHON IMAGE (melange NVIDIA redist tarballs + Wolfi Python, x86_64 only)
+#------------------------------------------------------------------------------
+cuda-python-melange: keygen
+	@echo "Building CUDA $(CUDA_VERSION) runtime packages via melange..."
+	melange build cuda-python/melange.yaml \
+		--arch x86_64 \
+		--signing-key melange.rsa
+	@echo "✓ CUDA runtime packages built"
+
+cuda-python: cuda-python-melange
+	@echo "Assembling minimal-cuda-python image with apko..."
+	apko build cuda-python/apko/cuda-python.yaml \
+		$(REGISTRY)/$(OWNER)/minimal-cuda-python:$(VERSION) \
+		cuda-python.tar \
+		--arch x86_64 \
+		--repository-append ./packages \
+		--keyring-append melange.rsa.pub
+	docker load < cuda-python.tar
+	docker tag $(REGISTRY)/$(OWNER)/minimal-cuda-python:$(VERSION)-amd64 \
+		$(REGISTRY)/$(OWNER)/minimal-cuda-python:$(VERSION)
+	docker tag $(REGISTRY)/$(OWNER)/minimal-cuda-python:$(VERSION)-amd64 \
+		$(REGISTRY)/$(OWNER)/minimal-cuda-python:latest
+	@rm -f cuda-python.tar sbom-*.spdx.json
+	@echo "✓ minimal-cuda-python built (NVIDIA CUDA + Python, x86_64 only)"
+
 #------------------------------------------------------------------------------
 # POSTGRES SLIM IMAGE (Wolfi pre-built package)
 #------------------------------------------------------------------------------
@@ -876,7 +906,7 @@ kafka: kafka-melange
 #------------------------------------------------------------------------------
 # CVE SCANNING
 #------------------------------------------------------------------------------
-scan: scan-python scan-jenkins scan-go scan-node-slim scan-nginx scan-httpd scan-redis-slim scan-mysql scan-memcached scan-caddy scan-haproxy scan-postgres-slim scan-bun scan-sqlite scan-dotnet scan-java scan-php scan-rails scan-kafka scan-valkey scan-nats scan-traefik scan-envoy scan-rabbitmq scan-minio scan-opensearch scan-prometheus scan-mariadb
+scan: scan-python scan-jenkins scan-go scan-node-slim scan-nginx scan-httpd scan-redis-slim scan-mysql scan-memcached scan-caddy scan-haproxy scan-postgres-slim scan-bun scan-sqlite scan-dotnet scan-java scan-php scan-rails scan-kafka scan-valkey scan-nats scan-traefik scan-envoy scan-rabbitmq scan-minio scan-opensearch scan-prometheus scan-mariadb scan-cuda-python
 
 scan-python:
 	@echo "Scanning minimal-python..."
@@ -1083,6 +1113,12 @@ scan-deno:
 		$(REGISTRY)/$(OWNER)/minimal-deno:latest
 	@echo "✓ minimal-deno: scan passed"
 
+scan-cuda-python:
+	@echo "Scanning minimal-cuda-python..."
+	trivy image --exit-code 1 --severity CRITICAL,HIGH \
+		$(REGISTRY)/$(OWNER)/minimal-cuda-python:latest
+	@echo "✓ minimal-cuda-python: scan passed"
+
 # Full scan with all severities
 scan-all:
 	@echo "Full vulnerability scan..."
@@ -1132,7 +1168,7 @@ size:
 #------------------------------------------------------------------------------
 # TESTING
 #------------------------------------------------------------------------------
-test: test-python test-jenkins test-go test-node-slim test-nginx test-httpd test-redis-slim test-mysql test-memcached test-caddy test-haproxy test-postgres-slim test-bun test-sqlite test-dotnet test-java test-php test-rails test-kafka test-valkey test-nats test-traefik test-envoy test-rabbitmq test-minio test-opensearch test-prometheus test-mariadb
+test: test-python test-jenkins test-go test-node-slim test-nginx test-httpd test-redis-slim test-mysql test-memcached test-caddy test-haproxy test-postgres-slim test-bun test-sqlite test-dotnet test-java test-php test-rails test-kafka test-valkey test-nats test-traefik test-envoy test-rabbitmq test-minio test-opensearch test-prometheus test-mariadb test-cuda-python
 
 test-python:
 	@echo "Testing Python image..."
@@ -1456,6 +1492,12 @@ test-deno:
 		deno/test.sh
 	@echo "✓ Deno tests passed"
 
+test-cuda-python:
+	@echo "Testing CUDA Python image..."
+	export IMAGE="$(REGISTRY)/$(OWNER)/minimal-cuda-python:latest" && \
+		cuda-python/test.sh
+	@echo "✓ CUDA Python tests passed"
+
 #------------------------------------------------------------------------------
 # PUSH TO REGISTRY
 #------------------------------------------------------------------------------
@@ -1510,6 +1552,8 @@ push:
 	docker push $(REGISTRY)/$(OWNER)/minimal-minio:latest
 	docker push $(REGISTRY)/$(OWNER)/minimal-opensearch:$(VERSION)
 	docker push $(REGISTRY)/$(OWNER)/minimal-opensearch:latest
+	docker push $(REGISTRY)/$(OWNER)/minimal-cuda-python:$(VERSION)
+	docker push $(REGISTRY)/$(OWNER)/minimal-cuda-python:latest
 
 #------------------------------------------------------------------------------
 # CLEANUP
@@ -1591,6 +1635,9 @@ clean:
 	docker rmi $(REGISTRY)/$(OWNER)/minimal-opensearch:$(VERSION) 2>/dev/null || true
 	docker rmi $(REGISTRY)/$(OWNER)/minimal-opensearch:$(VERSION)-amd64 2>/dev/null || true
 	docker rmi $(REGISTRY)/$(OWNER)/minimal-opensearch:latest 2>/dev/null || true
+	docker rmi $(REGISTRY)/$(OWNER)/minimal-cuda-python:$(VERSION) 2>/dev/null || true
+	docker rmi $(REGISTRY)/$(OWNER)/minimal-cuda-python:$(VERSION)-amd64 2>/dev/null || true
+	docker rmi $(REGISTRY)/$(OWNER)/minimal-cuda-python:latest 2>/dev/null || true
 	rm -f *.tar sbom-*.spdx.json
 	rm -rf packages/
 	@echo "✓ Cleanup complete"
@@ -1633,6 +1680,7 @@ help:
 	@echo "  make rabbitmq        Build RabbitMQ $(RABBITMQ_VERSION) (official binary + Wolfi Erlang)"
 	@echo "  make minio           Build MinIO $(MINIO_VERSION) (source build)"
 	@echo "  make opensearch      Build OpenSearch $(OPENSEARCH_VERSION) (Wolfi package)"
+	@echo "  make cuda-python     Build CUDA Python $(CUDA_VERSION) (NVIDIA redist + Python, x86_64)"
 	@echo "  make build           Build all images"
 	@echo ""
 	@echo "Scanning:"
@@ -1663,5 +1711,6 @@ help:
 	@echo "  TRAEFIK_VERSION=$(TRAEFIK_VERSION)"
 	@echo "  RABBITMQ_VERSION=$(RABBITMQ_VERSION)"
 	@echo "  OPENSEARCH_VERSION=$(OPENSEARCH_VERSION)"
+	@echo "  CUDA_VERSION=$(CUDA_VERSION)"
 	@echo "  REGISTRY=$(REGISTRY)"
 	@echo "  OWNER=$(OWNER)"

README.md

@@ -12,7 +12,7 @@
   <a href="https://github.com/rtvkiz/minimal/actions/workflows/build.yml"><img src="https://github.com/rtvkiz/minimal/actions/workflows/build.yml/badge.svg" alt="Build Hardened Images"></a>
   <a href="https://rtvkiz.github.io/minimal/"><img src="https://img.shields.io/badge/Vulnerability_Report-View-0d9488" alt="Vulnerability Report"></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
-  <img src="https://img.shields.io/badge/Images-35-0d9488" alt="Images: 35">
+  <img src="https://img.shields.io/badge/Images-36-0d9488" alt="Images: 36">
   <img src="https://img.shields.io/badge/Architectures-amd64%20%7C%20arm64-0d9488" alt="Architectures: amd64 | arm64">
 </p>
 
@@ -84,6 +84,8 @@ Container vulnerabilities are a top attack vector. Most base images ship with do
 | **HAProxy** | `docker pull ghcr.io/rtvkiz/minimal-haproxy:latest` | No | High-performance TCP/HTTP load balancer |
 | **Traefik** | `docker pull ghcr.io/rtvkiz/minimal-traefik:latest` | No | Cloud-native reverse proxy and load balancer, built from source |
 | **Envoy** | `docker pull ghcr.io/rtvkiz/minimal-envoy:latest` | No | Cloud-native service proxy and load balancer, upstream binary |
+| | | **AI/ML** | |
+| **CUDA Python** | `docker pull ghcr.io/rtvkiz/minimal-cuda-python:latest` | No | Python + CUDA 12.9 + cuDNN 9.10 for ML inference (x86_64 only) |
 | | | **CI/CD** | |
 | **Jenkins** | `docker pull ghcr.io/rtvkiz/minimal-jenkins:latest` | Yes | CI/CD automation |
 

cuda-python/apko/cuda-python.yaml

@@ -0,0 +1,90 @@
+# Minimal CUDA Python image - Wolfi Python 3.13 + CUDA 12.9 runtime + cuDNN 9.10.1
+# CUDA libraries packaged from NVIDIA redistributable tarballs via melange
+# For ML inference and runtime workloads (not for compiling CUDA code)
+
+contents:
+  repositories:
+    - https://packages.wolfi.dev/os
+    # Local melange-built packages (passed via --repository-append CLI flag)
+  keyring:
+    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+    # Local signing key passed via --keyring-append CLI flag
+  packages:
+    # Base filesystem layout
+    - wolfi-baselayout
+
+    # Python from Wolfi
+    - python-3.13
+
+    # Core runtime dependencies
+    - glibc
+    - glibc-locale-posix
+    - ld-linux
+    - libgcc
+    - libstdc++
+
+    # Python module dependencies
+    - libffi
+    - zlib
+    - libssl3
+    - libcrypto3
+    - readline
+    - ncurses
+    - ncurses-terminfo-base
+
+    # Additional stdlib dependencies
+    - libexpat1
+    - libbz2-1
+    - xz
+    - libzstd1
+    - mpdecimal
+    - sqlite-libs
+    - gdbm
+    - libuuid
+
+    # TLS/SSL certificates
+    - ca-certificates-bundle
+
+    # CUDA runtime libraries (built from NVIDIA redist tarballs via melange)
+    - cuda-runtime
+
+accounts:
+  groups:
+    - groupname: nonroot
+      gid: 65532
+  users:
+    - username: nonroot
+      uid: 65532
+      gid: 65532
+  run-as: 65532
+
+entrypoint:
+  command: /usr/bin/python3
+
+work-dir: /app
+
+environment:
+  # Python settings
+  PYTHONDONTWRITEBYTECODE: "1"
+  PYTHONUNBUFFERED: "1"
+  PYTHONHASHSEED: random
+  LANG: C.UTF-8
+  PATH: /usr/bin:/bin
+  # NVIDIA container runtime detection
+  NVIDIA_VISIBLE_DEVICES: all
+  NVIDIA_DRIVER_CAPABILITIES: compute,utility
+
+paths:
+  - path: /app
+    type: directory
+    uid: 65532
+    gid: 65532
+    permissions: 0o755
+  - path: /tmp
+    type: directory
+    uid: 0
+    gid: 0
+    permissions: 0o1777
+
+archs:
+  - x86_64