| # What a rented box runs first. Give it to vast.ai as the instance's `onstart` | |
| # script, with `runtype: "ssh"` and a vastai/base-image, then let it fetch the | |
| # code and hand over to vast_bootstrap.sh. | |
| # | |
| # Two things this file exists to stop repeating. | |
| # | |
| # **`runtype: "args"` with an onstart script does not work.** vast hands the | |
| # script text to the container as its command, runc tries to exec it, and the | |
| # instance dies with "unable to start container process: exec: | |
| # #!/bin/bash\nexec > ...". A plain nvidia/cuda image has no vast entrypoint to | |
| # run an onstart script at all. Use a vastai/base-image and runtype "ssh"; the | |
| # box then runs this file for you. | |
| # | |
| # **Never let the shell trace expand HF_TOKEN.** `set -x` prints every expanded | |
| # word, so a bare `[ -z "$HF_TOKEN" ]` writes the token into the instance log in | |
| # clear text -- which is then readable through vast's log API and copied into | |
| # every archive made from it. That happened on 2026-09-16 and cost a token | |
| # rotation. Tracing goes off around anything that touches a secret. | |
| exec > >(tee -a /workspace/onstart.log) 2>&1 | |
| set -x | |
| # vast writes API-supplied env vars here; onstart does not always inherit them. | |
| source /etc/environment 2>/dev/null || true | |
| set +x # <-- nothing between here and `set -x` may reach the log | |
| if [ -z "${HF_TOKEN:-}" ]; then | |
| echo "ABORT: HF_TOKEN not in environment" | |
| exit 1 | |
| fi | |
| set -x | |
| export DEBIAN_FRONTEND=noninteractive | |
| apt-get update -qq | |
| apt-get install -y -qq python3-pip python3-venv python3-dev build-essential curl git | |
| pip3 install --break-system-packages -q huggingface_hub | |
| # The repo is private, so a rented box cannot clone it. Code ships through the | |
| # model's own Hub repo instead, reusing the token the checkpoints already need. | |
| python3 - <<'PY' | |
| import os | |
| from huggingface_hub import snapshot_download | |
| print(snapshot_download(os.environ.get("CODE_REPO", "briscoooe/tiny-cube-value-iter"), | |
| allow_patterns=["code/*"], token=os.environ["HF_TOKEN"], | |
| local_dir="/workspace/hub")) | |
| PY | |
| # snapshot_download does not raise when the box cannot reach Hugging Face -- it | |
| # returns an empty local dir, so the run would exit 0 having done nothing. Check | |
| # for a file from the download, loudly. | |
| if [ ! -f /workspace/hub/code/vast_bootstrap.sh ]; then | |
| echo "ABORT: vast_bootstrap.sh missing after download; this box cannot reach Hugging Face" | |
| exit 1 | |
| fi | |
| cp -r /workspace/hub/code /workspace/code | |
| cd /workspace/code | |
| echo "=== starting bootstrap ===" | |
| bash vast_bootstrap.sh | |
| echo "=== BOOTSTRAP EXITED $? ===" | |