code/vast_onstart.sh

#!/bin/bash
# What a rented box runs first. Give it to vast.ai as the instance's `onstart`
# script, with `runtype: "ssh"` and a vastai/base-image, then let it fetch the
# code and hand over to vast_bootstrap.sh.
#
# Two things this file exists to stop repeating.
#
# **`runtype: "args"` with an onstart script does not work.** vast hands the
# script text to the container as its command, runc tries to exec it, and the
# instance dies with "unable to start container process: exec:
# #!/bin/bash\nexec > ...". A plain nvidia/cuda image has no vast entrypoint to
# run an onstart script at all. Use a vastai/base-image and runtype "ssh"; the
# box then runs this file for you.
#
# **Never let the shell trace expand HF_TOKEN.** `set -x` prints every expanded
# word, so a bare `[ -z "$HF_TOKEN" ]` writes the token into the instance log in
# clear text -- which is then readable through vast's log API and copied into
# every archive made from it. That happened on 2026-09-16 and cost a token
# rotation. Tracing goes off around anything that touches a secret.
exec > >(tee -a /workspace/onstart.log) 2>&1
set -x
# vast writes API-supplied env vars here; onstart does not always inherit them.
source /etc/environment 2>/dev/null || true

set +x          # <-- nothing between here and `set -x` may reach the log
if [ -z "${HF_TOKEN:-}" ]; then
  echo "ABORT: HF_TOKEN not in environment"
  exit 1
fi
set -x

export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq python3-pip python3-venv python3-dev build-essential curl git
pip3 install --break-system-packages -q huggingface_hub

# The repo is private, so a rented box cannot clone it. Code ships through the
# model's own Hub repo instead, reusing the token the checkpoints already need.
python3 - <<'PY'
import os
from huggingface_hub import snapshot_download
print(snapshot_download(os.environ.get("CODE_REPO", "briscoooe/tiny-cube-value-iter"),
                        allow_patterns=["code/*"], token=os.environ["HF_TOKEN"],
                        local_dir="/workspace/hub"))
PY

# snapshot_download does not raise when the box cannot reach Hugging Face -- it
# returns an empty local dir, so the run would exit 0 having done nothing. Check
# for a file from the download, loudly.
if [ ! -f /workspace/hub/code/vast_bootstrap.sh ]; then
  echo "ABORT: vast_bootstrap.sh missing after download; this box cannot reach Hugging Face"
  exit 1
fi

cp -r /workspace/hub/code /workspace/code
cd /workspace/code
echo "=== starting bootstrap ==="
bash vast_bootstrap.sh
echo "=== BOOTSTRAP EXITED $? ==="