[Bug] Avoid including sensitive info in Dockerfile ENV

[zhangjyr]

Pull Request Description

This PR move sensitive info from Dockerfile ENV to config.json. In addition, Python 3.10 slim base image missing zScaler root CA, which causes Tokenizer to fail to download llama2 tokenizer. zScaler root CA is added manually to make it work.

Related Issues

Resolves: #483

Important: Before submitting, please complete the description above and review the checklist below.

---

Contribution Guidelines (Expand for Details)

We appreciate your contribution to aibrix! To ensure a smooth review process and maintain high code quality, please adhere to the following guidelines:

Pull Request Title Format

Your PR title should start with one of these prefixes to indicate the nature of the change:

• [Bug]: Corrections to existing functionality
• [CI]: Changes to build process or CI pipeline
• [Docs]: Updates or additions to documentation
• [API]: Modifications to aibrix's API or interface
• [CLI]: Changes or additions to the Command Line Interface
• [Misc]: For changes not covered above (use sparingly)

Note: For changes spanning multiple categories, use multiple prefixes in order of importance.

Submission Checklist

• PR title includes appropriate prefix(es)
• Changes are clearly explained in the PR description
• New and existing tests pass successfully
• Code adheres to project style and best practices
• Documentation updated to reflect changes (if applicable)
• Thorough testing completed, no regressions introduced

By submitting this PR, you confirm that you've read these guidelines and your changes align with the project's contribution standards.

[nwangfw]

Looks good to me.

[Jeffwan]

I thought we would still use a public available tokenizer instead. Now it leaks the hugging face token. I suggest to use different one instead. Does an open source model like https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct make sense ?

[zhangjyr]

I thought we would still use a public available tokenizer instead. Now it leaks the hugging face token. I suggest to use different one instead. Does an open source model like https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct make sense ?

Sorry, The hugging face token is not supposed to be there. I'll remove it. We can use other models later. But for now, Vidur only supports limited models; it needs to be re-profiled to adapt to non-gated models. Currently, only Qwen/Qwen-72B is on the support list, but it might be too large for local development.

[Jeffwan]

That makes sense. Let's stick to current plan and revisit the supported models later.