Prebuilt SageMaker AI image support policy

All pre-built SageMaker AI images, including framework-specific containers, built-in algorithm containers, algorithms and model packages listed in AWS Marketplace, and AWS Deep Learning Containers are regularly scanned for common vulnerabilities listed by the Common Vulnerabilities and Exposures (CVE) Program and the National Vulnerability Database (NVD). For more information about CVEs, see CVE Frequently Asked Questions (FAQs). Supported pre-built container images receive an updated minor version release following any security patches.

All supported container images are routinely updated to address any critical CVEs. For high severity scenarios, we recommend customers build and host a patched version of the container in their own Amazon Elastic Container Registry (Amazon ECR).

If you are running a container image version that is no longer supported, you may not have the most updated drivers, libraries, and relevant packages. For a more up-to-date version, we recommend that you upgrade to one of the supported frameworks available using the latest image of your choice.

SageMaker AI doesn't release out-of-patch images for containers in new AWS Regions.

AWS Deep Learning Containers (DLC) support policy

AWS Deep Learning Containers are a set of Docker images for training and serving deep learning models. To view available images, see Available Deep Learning Containers Images in the Deep Learning Containers GitHub repository.

DLCs hit their end of patch date 365 days after their GitHub release date. Patch updates for DLCs are not “in-place” updates. You must delete the existing image on your instance and pull the latest container image without terminating your instance. For more information, see Framework Support Policy in the AWS Deep Learning Containers Developer Guide.

Reference the AWS Deep Learning Containers Framework Support Policy table to check which frameworks and versions are actively supported for AWS DLCs. You can reference the framework associated with a DLC in the support policy table for any images that are not explicitly listed. For example, you can reference PyTorch in the support policy table for DLC images such as huggingface-pytorch-inference and stabilityai-pytorch-inference.

SageMaker AI ML Framework Container support policy

The SageMaker AI ML Framework Containers are a set of Docker images for training and serving machine learning workloads with environments optimized for common frameworks such as XGBoost and Scikit Learn. To view available SageMaker AI ML Framework Containers, see Docker Registry Paths and Example Code. Navigate to the AWS Region of your choice, and browse images with the (algorithm) tag. SageMaker AI ML Framework Containers also adhere to the AWS Deep Learning Containers framework support policy.

To retrieve the latest image version for XGBoost 1.7-1 in framework mode, use the following SageMaker Python SDK commands:

from sagemaker import image_uris
image_uris.retrieve(framework='xgboost',region='us-east-1',version='1.7-1')

SageMaker AI Built-in Algorithm Container support policy

The SageMaker AI Built-in Algorithm Containers are a set of Docker images for training and serving SageMaker AI’s built-in machine learning algorithms. To view available SageMaker AI Built-in Algorithm Containers, see Docker Registry Paths and Example Code. Navigate to the AWS Region of your choice, and browse images with the (algorithm) tag.

Patch updates for built-in container images are “in-place” updates. To stay up-to-date with the latest security patches, we recommend checking out the latest built-in algorithm image version using the latest image tag.

LLM Hosting Container support policy

LLM hosting containers such as the HuggingFace Text Generation Inference (TGI) containers hit their end of patch date 30 days after their GitHub release date.

Unsupported containers and deprecation

When a container reaches end of patch or is deprecated, it no longer receives security patching. Containers are deprecated when entire frameworks or algorithms are no longer supported.

The following containers no longer receive support: