fix(npu): rewrite Dockerfile.npu and fix corrupt patches for verl base image

[CalvinXKY]

Summary

• Rewrite Dockerfile.npu to work with the verl base image (no git clone, no network access during build)
• Fix corrupt vllm-ascend.patch and mindspeed.patch (missing trailing context, fake index hashes)
• Replace 3 separate megatron patches with single megatron-all-changes.patch that applies cleanly on the verl base image
• Make torch_npu.patch optional (version mismatch with base image)

Problem

The original Dockerfile.npu failed to build with 6 distinct issues:

1. git clone on directories already pre-existing in the verl base image
2. No network access during docker build (proxy resolution fails)
3. torch_memory_saver requires CUDA C++ extensions (unavailable on NPU)
4. vllm-ascend.patch corrupt at line 78 (missing trailing context)
5. mindspeed.patch corrupt at line 107 (missing trailing context + fake index hash 1234567..abcdef0)
6. 3 megatron patches fail on verl base image (shallow clone lacks blobs for --3way, plus verl already modified files)

Changes

docker/Dockerfile.npu

• Remove all git clone and pip install git+ steps (base image has repos pre-installed)
• Remove torch_memory_saver install (vime handles missing import gracefully)
• Use COPY instead of git clone for vime source
• Replace 3 megatron patches with single megatron-all-changes.patch
• Add || true for git apply --3way (returns non-zero on 3way fallback) with conflict marker check
• Add git config --global --add safe.directory for vime
• Make torch_npu.patch optional with fallback

docker/patch/latest/megatron-all-changes.patch (NEW)

• Single combined patch replacing megatron.patch, megatron-npu.patch, megatron-bridge.patch
• Generated from working container's git diff HEAD in Megatron-LM
• Contains all verl + vime modifications (8727 lines)

docker/patch/latest/vllm-ascend.patch (FIXED)

• Add missing trailing context (was causing error: corrupt patch at line 78)
• Fix import line position to match actual vllm-ascend v0.17.0rc1 source

docker/patch/latest/mindspeed.patch (FIXED)

• Add missing trailing context (was causing error: corrupt patch at line 107)
• Fix fake index hashes (1234567..abcdef0 → proper hashes)
• Consolidate features_manager.py changes into single diff hunk

Testing

Built and verified vime-npu:test image (26.2GB) on 400t-server (aarch64, Ascend 910B1):

• All patches apply cleanly
• import vime succeeds
• Image runs correctly on NPU hosts

Related: #157

[gemini-code-assist]

Code Review

This pull request simplifies the NPU Dockerfile by consolidating patches, copying local files directly, and adjusting dependency installations. However, several critical issues were identified in the review: using || true or || echo when applying patches in the Dockerfile can silently ignore severe errors (such as missing files or permission issues) instead of only skipping on expected version mismatches or conflicts. Additionally, catching AttributeError in the mindspeed patch to handle missing methods can mask actual AttributeErrors raised inside those validation methods; using hasattr is recommended instead.

[gemini-code-assist]

Using || true with git apply will silently ignore severe errors (such as a missing patch file, permission issues, or a completely corrupt patch format) because grep will find no conflict markers and the build will succeed with an unpatched repository. We should only ignore the exit code if it is 1 (which indicates clean/unclean patch application with conflicts/3-way fallback), and fail on any other exit code.

    git apply --3way /tmp/megatron-all-changes.patch || [ $? -eq 1 ] && \

[gemini-code-assist]

Using || true with git apply will silently ignore severe errors (such as a missing patch file or corrupt format). We should only ignore the exit code if it is 1 (which indicates patch application with conflicts/3-way fallback), and fail on any other exit code.

    git apply --3way /tmp/mindspeed.patch || [ $? -eq 1 ] && \

[gemini-code-assist]

Using || echo ... silently ignores all severe errors from the patch command (such as patch command not found, permission denied, or missing patch file). According to POSIX standards, patch exits with 1 if hunks failed (e.g., due to version mismatch or already applied), and >1 for severe errors. We should only skip the patch if the exit code is 1, and fail on any other non-zero exit code.

    patch -p2 < /tmp/torch_npu.patch; \
    ret=$?;
    if [ $ret -eq 1 ]; then \
        echo "torch_npu patch skipped (version mismatch)"; \
    elif [ $ret -ne 0 ]; then \
        echo "Failed to apply torch_npu patch with error code $ret" && exit $ret; \
    fi

[gemini-code-assist]

Catching AttributeError silently can mask actual AttributeErrors raised inside the pre_validate_args method itself (e.g., if there is a typo or a missing attribute access inside the feature's validation logic). It is much safer to use hasattr to check if the method exists before calling it.

+            if hasattr(feature, 'pre_validate_args'):
+                feature.pre_validate_args(args)

[gemini-code-assist]

Catching AttributeError silently can mask actual AttributeErrors raised inside the post_validate_args method itself. It is much safer to use hasattr to check if the method exists before calling it.

+            if hasattr(feature, 'post_validate_args'):
+                feature.post_validate_args(args)

[gemini-code-assist]

Catching AttributeError silently can mask actual AttributeErrors raised inside the validate_args method itself. It is much safer to use hasattr to check if the method exists before calling it.

+            if hasattr(feature, 'validate_args'):
+                feature.validate_args(args)