fix: drop trust in compromised eMudhra CA (#5757)
- fix: stop trusting compromised eMudhra CA in bento images
uv < 0.13.4 bundles the compromised eMudhra/emSign intermediate CAs. Generated Dockerfiles kept any pre-installed uv regardless of version, or ran an unpinned
pip install uvthrough the base image’s pip, which may itself still trust those CAs.
- Install uv==0.13.4 with –require-hashes when uv is missing or older.
- Require certifi>=2026.10.19 so bento runtimes drop the emSign root.
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
- chore: drop comments
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
版权所有:中国计算机学会技术支持:开源发展技术委员会
京ICP备13000930号-9
京公网安备 11010802047560号
Unified Model Serving Framework
🍱 Build model inference APIs and multi-model serving systems with any open-source or custom AI models. 👉 Join our forum!
What is BentoML?
BentoML is a Python library for building online serving systems optimized for AI apps and model inference.
Getting started
Install BentoML:
Define APIs in a
service.pyfile.💻 Run locally
Install PyTorch and Transformers packages to your Python virtual environment.
Run the service code locally (serving at http://localhost:3000 by default):
You should expect to see the following output.
Now you can run inference from your browser at http://localhost:3000 or with a Python script:
🐳 Deploy using Docker
Run
bentoml buildto package necessary code, models, dependency configs into a Bento - the standardized deployable artifact in BentoML:Ensure Docker is running. Generate a Docker container image for deployment:
Run the generated image:
Examples
Check out the full list for more sample code and usage.
Advanced topics
See Documentation for more tutorials and guides.
Community
Get involved and join our Community Forum 💬, where thousands of AI/ML engineers help each other, contribute to the project, and talk about building AI products.
To report a bug or suggest a feature request, use GitHub Issues.
Contributing
There are many ways to contribute to the project:
Thanks to all of our amazing contributors!
Usage tracking and feedback
The BentoML framework collects anonymous usage data that helps our community improve the product. Only BentoML’s internal API calls are being reported. This excludes any sensitive information, such as user code, model data, model names, or stack traces. Here’s the code used for usage tracking. You can opt-out of usage tracking by the
--do-not-trackCLI option:Or by setting the environment variable:
License
Apache License 2.0