From b309e204d3ee2c66c0398ea623ff514d8afac6b8 Mon Sep 17 00:00:00 2001
From: Erik <erscor@microsoft.com>
Date: Tue, 21 Jul 2026 10:37:13 -0400
Subject: [PATCH 1/5] Index url for docker images

---
 .../stages/nuget-linux-cuda-packaging-stage.yml              | 3 ++-
 .../github/azure-pipelines/templates/c-api-linux-cpu.yml     | 4 ++--
 tools/ci_build/github/azure-pipelines/templates/py-linux.yml | 2 +-
 .../templates/py-packaging-linux-test-cpu.yml                | 2 +-
 .../linux/docker/inference/aarch64/python/cpu/Dockerfile     | 4 +++-
 .../linux/docker/inference/x86_64/default/cpu/Dockerfile     | 5 ++++-
 6 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml b/tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml
index bd5290e8f792c..5a4756bca1c07 100644
--- a/tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml
+++ b/tools/ci_build/github/azure-pipelines/stages/nuget-linux-cuda-packaging-stage.yml
@@ -95,6 +95,7 @@ stages:
         DockerBuildArgs: "
           --build-arg TRT_VERSION=${{ variables.linux_trt_version }}
           --build-arg BUILD_UID=$( id -u )
+          --secret id=PIP_INDEX_URL
           "
         Repository: onnxruntimecuda${{ variables.CUDA_VERSION_MAJOR }}xtrt86build
     - template: ../templates/set-version-number-variables-step.yml
@@ -160,7 +161,7 @@ stages:
         ScriptName: $(Build.SourcesDirectory)/onnxruntime/tools/ci_build/get_docker_image.py
         Dockerfile: $(Build.SourcesDirectory)/onnxruntime/tools/ci_build/github/linux/docker/inference/x86_64/default/cuda${{ variables.CUDA_VERSION_MAJOR }}/Dockerfile
         Context: $(Build.SourcesDirectory)/onnxruntime/tools/ci_build/github/linux/docker/inference/x86_64/default/cuda${{ variables.CUDA_VERSION_MAJOR }}
-        DockerBuildArgs: "--build-arg TRT_VERSION=${{ variables.linux_trt_version }} --build-arg BUILD_UID=$( id -u )"
+        DockerBuildArgs: "--build-arg TRT_VERSION=${{ variables.linux_trt_version }} --build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
         Repository: onnxruntimecuda${{ variables.CUDA_VERSION_MAJOR }}xtrt86build
 
     - template: ../templates/set-version-number-variables-step.yml
diff --git a/tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml b/tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml
index a19a92e40aa72..97fac845977b1 100644
--- a/tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/c-api-linux-cpu.yml
@@ -57,7 +57,7 @@ jobs:
       parameters:
         Dockerfile: tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
         Context: tools/ci_build/github/linux/docker/inference/x86_64/default/cpu
-        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
         Repository: onnxruntimecpubuildcentos8${{parameters.OnnxruntimeArch}}_packaging
 
   - ${{ if eq(parameters.OnnxruntimeArch, 'aarch64') }}:
@@ -65,7 +65,7 @@ jobs:
       parameters:
         Dockerfile: tools/ci_build/github/linux/docker/inference/aarch64/default/cpu/Dockerfile
         Context: tools/ci_build/github/linux/docker/inference/aarch64/default/cpu
-        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+        DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
         Repository: onnxruntimecpubuildcentos8${{parameters.OnnxruntimeArch}}_packaging
 
   - task: CmdLine@2
diff --git a/tools/ci_build/github/azure-pipelines/templates/py-linux.yml b/tools/ci_build/github/azure-pipelines/templates/py-linux.yml
index 1226be6ca9083..46b414d508c6a 100644
--- a/tools/ci_build/github/azure-pipelines/templates/py-linux.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/py-linux.yml
@@ -84,7 +84,7 @@ jobs:
     parameters:
       Dockerfile: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu/Dockerfile
       Context: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu
-      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
       Repository: onnxruntimecpubuildpython${{ parameters.arch }}
 
   - task: Bash@3
diff --git a/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml b/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
index a3d2eba50be99..969388e9a6aa4 100644
--- a/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
@@ -64,7 +64,7 @@ jobs:
     parameters:
       Dockerfile: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu/Dockerfile
       Context: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu
-      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u )"
+      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
       Repository: onnxruntimecpubuildpython${{ parameters.arch }}
 
   - task: Bash@3
diff --git a/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile b/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
index d39e39a5a429d..1435552351d24 100644
--- a/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
+++ b/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
@@ -2,7 +2,9 @@ ARG BASEIMAGE=onnxruntimebuildcache.azurecr.io/internal/azureml/onnxruntime/buil
 FROM $BASEIMAGE
 
 ADD scripts /tmp/scripts
-RUN cd /tmp/scripts && /tmp/scripts/install_centos.sh && /tmp/scripts/install_deps.sh && rm -rf /tmp/scripts
+RUN --mount=type=secret,id=PIP_INDEX_URL,required=false \
+    if [ -f /run/secrets/PIP_INDEX_URL ]; then export PIP_INDEX_URL=$(cat /run/secrets/PIP_INDEX_URL); fi && \
+    cd /tmp/scripts && /tmp/scripts/manylinux/install_centos.sh && /tmp/scripts/manylinux/install_deps.sh && rm -rf /tmp/scripts
 
 ARG BUILD_UID=1001
 ARG BUILD_USER=onnxruntimedev
diff --git a/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile b/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
index d2d5ae684e10e..62c4aa11f5ac7 100644
--- a/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
+++ b/tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
@@ -8,7 +8,10 @@ FROM $BASEIMAGE
 ENV LANG=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 
-RUN python3 -m pip install flatbuffers
+ADD scripts /tmp/scripts
+RUN --mount=type=secret,id=PIP_INDEX_URL,required=false \
+    if [ -f /run/secrets/PIP_INDEX_URL ]; then export PIP_INDEX_URL=$(cat /run/secrets/PIP_INDEX_URL); fi && \
+    python3 -m pip install flatbuffers
 
 ARG BUILD_UID=1001
 ARG BUILD_USER=onnxruntimedev

From f98159dfe5ada1c5486dcafaae38a95daa26f746 Mon Sep 17 00:00:00 2001
From: Erik <erscor@microsoft.com>
Date: Tue, 21 Jul 2026 11:14:38 -0400
Subject: [PATCH 2/5] Fix

---
 .../github/linux/docker/inference/aarch64/python/cpu/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile b/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
index 1435552351d24..742703020e347 100644
--- a/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
+++ b/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
@@ -4,7 +4,7 @@ FROM $BASEIMAGE
 ADD scripts /tmp/scripts
 RUN --mount=type=secret,id=PIP_INDEX_URL,required=false \
     if [ -f /run/secrets/PIP_INDEX_URL ]; then export PIP_INDEX_URL=$(cat /run/secrets/PIP_INDEX_URL); fi && \
-    cd /tmp/scripts && /tmp/scripts/manylinux/install_centos.sh && /tmp/scripts/manylinux/install_deps.sh && rm -rf /tmp/scripts
+    cd /tmp/scripts && /tmp/scripts/install_centos.sh && /tmp/scripts/install_deps.sh && rm -rf /tmp/scripts
 
 ARG BUILD_UID=1001
 ARG BUILD_USER=onnxruntimedev

From 7cbd45984d907365a331d4caa16ef78c8e9d0226 Mon Sep 17 00:00:00 2001
From: Erik <erscor@microsoft.com>
Date: Tue, 21 Jul 2026 14:43:03 -0400
Subject: [PATCH 3/5] Propagate cargo configuration to docker build

---
 tools/ci_build/github/azure-pipelines/templates/py-linux.yml | 4 +++-
 .../templates/py-packaging-linux-test-cpu.yml                | 5 ++++-
 .../linux/docker/inference/aarch64/python/cpu/Dockerfile     | 4 ++++
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/tools/ci_build/github/azure-pipelines/templates/py-linux.yml b/tools/ci_build/github/azure-pipelines/templates/py-linux.yml
index 46b414d508c6a..e74dea27c38fb 100644
--- a/tools/ci_build/github/azure-pipelines/templates/py-linux.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/py-linux.yml
@@ -59,6 +59,8 @@ jobs:
       artifactName: drop-linux-cpu-${{ parameters.arch }}-${{ parameters.ep }}
 
   variables:
+  - name: SYSTEM_ACCESSTOKEN
+    value: $(System.AccessToken)
   - name: extra_build_args
     ${{ if ne(parameters.extra_build_arg, '') }}:
       value: '-x "${{ parameters.extra_build_arg }}"'
@@ -84,7 +86,7 @@ jobs:
     parameters:
       Dockerfile: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu/Dockerfile
       Context: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu
-      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
+      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL --secret id=CARGO_CONFIG,src=$HOME/.cargo/config.toml --secret id=SYSTEM_ACCESSTOKEN"
       Repository: onnxruntimecpubuildpython${{ parameters.arch }}
 
   - task: Bash@3
diff --git a/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml b/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
index 969388e9a6aa4..4dab264395ea1 100644
--- a/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
@@ -37,6 +37,7 @@ jobs:
   timeoutInMinutes: ${{ parameters.timeout }}
   variables:
     skipComponentGovernanceDetection: true
+    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
   workspace:
     clean: all
   pool: ${{ parameters.machine_pool }}
@@ -60,11 +61,13 @@ jobs:
       mv "$(Pipeline.Workspace)/build/drop-linux-cpu-${{ parameters.arch }}-${{parameters.ep}}" $(Build.BinariesDirectory)/${{parameters.cmake_build_type}}
       mv "$(Pipeline.Workspace)/build/onnxruntime-${{ parameters.arch }}-${{ parameters.ep }}" "$(Build.BinariesDirectory)/whl"
 
+  - template: set-cargo-registry-token-step.yml
+
   - template: get-docker-image-steps.yml
     parameters:
       Dockerfile: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu/Dockerfile
       Context: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu
-      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL"
+      DockerBuildArgs: "--build-arg BUILD_UID=$( id -u ) --secret id=PIP_INDEX_URL --secret id=CARGO_CONFIG,src=$HOME/.cargo/config.toml --secret id=SYSTEM_ACCESSTOKEN"
       Repository: onnxruntimecpubuildpython${{ parameters.arch }}
 
   - task: Bash@3
diff --git a/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile b/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
index 742703020e347..491bb814cdd00 100644
--- a/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
+++ b/tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
@@ -3,7 +3,11 @@ FROM $BASEIMAGE
 
 ADD scripts /tmp/scripts
 RUN --mount=type=secret,id=PIP_INDEX_URL,required=false \
+    --mount=type=secret,id=CARGO_CONFIG,required=false \
+    --mount=type=secret,id=SYSTEM_ACCESSTOKEN,required=false \
     if [ -f /run/secrets/PIP_INDEX_URL ]; then export PIP_INDEX_URL=$(cat /run/secrets/PIP_INDEX_URL); fi && \
+    if [ -f /run/secrets/CARGO_CONFIG ]; then mkdir -p /.cargo && cp /run/secrets/CARGO_CONFIG /.cargo/config.toml; fi && \
+    if [ -f /run/secrets/SYSTEM_ACCESSTOKEN ]; then export CARGO_REGISTRIES_ONNXRUNTIME_TOKEN="Basic $(printf ':%s' "$(cat /run/secrets/SYSTEM_ACCESSTOKEN)" | base64 -w0)"; fi && \
     cd /tmp/scripts && /tmp/scripts/install_centos.sh && /tmp/scripts/install_deps.sh && rm -rf /tmp/scripts
 
 ARG BUILD_UID=1001

From 74a7e30e7772c2db7115aa4420f93acf051f232e Mon Sep 17 00:00:00 2001
From: Erik <erscor@microsoft.com>
Date: Tue, 21 Jul 2026 15:08:00 -0400
Subject: [PATCH 4/5] Propagate system token

---
 .../azure-pipelines/templates/get-docker-image-steps.yml     | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/ci_build/github/azure-pipelines/templates/get-docker-image-steps.yml b/tools/ci_build/github/azure-pipelines/templates/get-docker-image-steps.yml
index e41f51bb8ec08..da4892786c32b 100644
--- a/tools/ci_build/github/azure-pipelines/templates/get-docker-image-steps.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/get-docker-image-steps.yml
@@ -65,6 +65,8 @@ steps:
             --container-registry onnxruntimebuildcache \
             --repository "${{ parameters.Repository }}"
         displayName: "Get ${{ parameters.Repository }} image for ${{ parameters.Dockerfile }}"
+        env:
+          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       ContainerRegistry: onnxruntimebuildcache
 - ${{ if eq(parameters.UseImageCacheContainerRegistry, false) }}:
   # the difference is no --container-registry
@@ -78,6 +80,8 @@ steps:
             --docker-build-args "${{ parameters.DockerBuildArgs }}" \
             --repository "${{ parameters.Repository }}"
         displayName: "Get ${{ parameters.Repository }} image for ${{ parameters.Dockerfile }}"
+        env:
+          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       ContainerRegistry: onnxruntimebuildcache
 
 - script: |
@@ -86,4 +90,3 @@ steps:
     docker system df
     df -h
   displayName: Check Docker Images
-

From db6ac145b1d388649d34d86fa92cb276fcdfb0e4 Mon Sep 17 00:00:00 2001
From: Erik <erscor@microsoft.com>
Date: Tue, 21 Jul 2026 17:46:25 -0400
Subject: [PATCH 5/5] Update

---
 .../azure-pipelines/templates/py-packaging-linux-test-cpu.yml   | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml b/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
index 4dab264395ea1..ca83d4da8f8fa 100644
--- a/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
+++ b/tools/ci_build/github/azure-pipelines/templates/py-packaging-linux-test-cpu.yml
@@ -61,8 +61,6 @@ jobs:
       mv "$(Pipeline.Workspace)/build/drop-linux-cpu-${{ parameters.arch }}-${{parameters.ep}}" $(Build.BinariesDirectory)/${{parameters.cmake_build_type}}
       mv "$(Pipeline.Workspace)/build/onnxruntime-${{ parameters.arch }}-${{ parameters.ep }}" "$(Build.BinariesDirectory)/whl"
 
-  - template: set-cargo-registry-token-step.yml
-
   - template: get-docker-image-steps.yml
     parameters:
       Dockerfile: tools/ci_build/github/linux/docker/inference/${{ parameters.arch }}/python/cpu/Dockerfile