From 1e3b506817009e1f603add5a1a5069ea3a8b18a3 Mon Sep 17 00:00:00 2001
From: Andrey Talman <atalman@users.noreply.github.com>
Date: Wed, 28 Oct 2026 12:56:07 -0700
Subject: [PATCH] Move the CI docker image to Ubuntu 24.04 for PyTorch 2.15

torch 2.15 requires Python >= 3.11 and publishes no cp310 wheels, so
`pip install torch==2.15` fails on the Ubuntu 22.04 image (system Python
3.10) with "No matching distribution found", as in the Docker Build run
https://github.com/pytorch/tutorials/actions/runs/40756929817.

Ubuntu 24.04 ships Python 3.12. Besides the base image, three things
change with it:

- The cmake=3.22* pin does not exist on 24.04; use the distro cmake.
- 24.04 marks the system Python as externally managed (PEP 668), so pip
  is told via /etc/pip.conf to install into it. A config file rather than
  an env var so the `sudo pip` call in .jenkins/build.sh is covered too.
  `pip install --upgrade pip` needs --ignore-installed because the
  apt-installed pip has no RECORD file to uninstall.
- numpy, scipy, numba and spacy were pinned to versions with no Python
  3.12 wheels (and numpy 1.24.4 conflicts with the current onnx on 3.12).
  Bump each to the first release with 3.12 support.

Alternative considered: keep 22.04 and install Python 3.11. That leaves
every pin untouched, but adds a source-built or third-party Python to the
image; the 24.04 route uses the distro Python.

Test Plan:

Dependency resolution only (torch 2.14.1 stands in for 2.15 because the
internal PyPI mirror did not have the 2.15 wheels yet):

```
uv pip compile .ci/docker/requirements.txt --python-version 3.12 --python-platform x86_64-manylinux_2_39
```

With the old pins this fails on numpy==1.24.4 vs onnx; with the new pins
it resolves. The image itself has not been built: run the Docker Build
workflow on this PR to verify the apt and pip steps.

This change was authored with an AI assistant (Claude Code).
---
 .ci/docker/build.sh                           | 2 +-
 .ci/docker/common/install_base.sh             | 2 +-
 .ci/docker/common/install_pip_requirements.sh | 7 ++++++-
 .ci/docker/requirements.txt                   | 8 ++++----
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/.ci/docker/build.sh b/.ci/docker/build.sh
index 774f54541b1..ffb737ff8d8 100755
--- a/.ci/docker/build.sh
+++ b/.ci/docker/build.sh
@@ -10,7 +10,7 @@ set -exu
 IMAGE_NAME="$1"
 shift
 
-export UBUNTU_VERSION="22.04"
+export UBUNTU_VERSION="24.04"
 export CUDA_VERSION="12.6.3"
 
 export BASE_IMAGE="nvidia/cuda:${CUDA_VERSION}-devel-ubuntu${UBUNTU_VERSION}"
diff --git a/.ci/docker/common/install_base.sh b/.ci/docker/common/install_base.sh
index 3100b550a89..cb0188a8718 100644
--- a/.ci/docker/common/install_base.sh
+++ b/.ci/docker/common/install_base.sh
@@ -10,7 +10,7 @@ install_ubuntu() {
   apt-get install -y --no-install-recommends \
     build-essential \
     ca-certificates \
-    cmake=3.22* \
+    cmake \
     curl \
     git \
     wget \
diff --git a/.ci/docker/common/install_pip_requirements.sh b/.ci/docker/common/install_pip_requirements.sh
index a548d200462..0c576765acc 100644
--- a/.ci/docker/common/install_pip_requirements.sh
+++ b/.ci/docker/common/install_pip_requirements.sh
@@ -2,6 +2,11 @@
 
 set -ex
 
+# Ubuntu 24.04 marks the system Python as externally managed (PEP 668). Allow
+# pip to install into it for every user, including the later `sudo pip` calls.
+printf '[global]\nbreak-system-packages = true\n' > /etc/pip.conf
+
 # Install pip packages
-pip install --upgrade pip
+# --ignore-installed: the apt-installed pip has no RECORD file to uninstall from.
+pip install --upgrade --ignore-installed pip
 pip install -r ./requirements.txt
diff --git a/.ci/docker/requirements.txt b/.ci/docker/requirements.txt
index 5c7f2565b73..157647e887e 100644
--- a/.ci/docker/requirements.txt
+++ b/.ci/docker/requirements.txt
@@ -20,7 +20,7 @@ pytorch_sphinx_theme2==0.4.9
 
 # Tutorial dependencies
 tqdm==4.66.1
-numpy==1.24.4
+numpy==1.26.4
 pydantic>=2.10
 # Pin fastapi: 0.139.2 made router route building thread-safe by adding an
 # _effective_routes_lock (threading.Lock) to APIRouter, which ray[serve]'s
@@ -39,7 +39,7 @@ bs4
 setuptools<81
 awscliv2==2.1.1
 flask
-spacy==3.7.1  # Keep this version consistent with the model version in .jenkins/build.sh
+spacy==3.7.2  # Keep this version consistent with the model version in .jenkins/build.sh
 # Pin protobuf: ray[serve]==2.55.0 uses FieldDescriptor.label, removed in protobuf>=6.
 protobuf<6
 ray[serve,train,tune]==2.55.0
@@ -77,8 +77,8 @@ pandas
 requests
 aiohttp
 scikit-image
-scipy==1.11.1
-numba==0.57.1
+scipy==1.11.4
+numba==0.59.1
 pillow==10.2.0
 wget
 gym==0.26.2