common-ci-configuration/Dockerfile.python_runtime at main · openhive-network/common-ci-configuration · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
ARG PYTHON_VERSION=3.12-24.04_stable

FROM ubuntu:24.04 AS python_dev

# renovate: datasource=pypi depName=poetry versioning=semver
ARG POETRY_VERSION=2.1.3
ENV POETRY_VERSION=${POETRY_VERSION}
ENV APT_CACHE_DIR=/var/cache/buildkit/apt

RUN --mount=type=cache,mode=0777,sharing=locked,target=${APT_CACHE_DIR} \
    apt-get update && \
    apt-get install -y wget git bash sudo python3.12 python3.12-venv python3-pip && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* && \
    python3 -m venv --system-site-packages /python_venv && \
    mkdir -vp /packages_to_install && cd /packages_to_install && \
    cp -v /usr/bin/dpkg* \
          /usr/bin/tar \
          /usr/bin/rm \
          /usr/bin/diff \
          /usr/bin/grep \
          /usr/sbin/ldconfig \
          /usr/sbin/start-stop-daemon \
          \
          /lib/x86_64-linux-gnu/libzstd.so.1 \
          /lib/x86_64-linux-gnu/liblzma.so.5 \
          /lib/x86_64-linux-gnu/libbz2.so.1.0 \
          /lib/x86_64-linux-gnu/libselinux.so.1 \
          /lib/x86_64-linux-gnu/libacl.so.1 \
          . \
    && \
    wget \
      http://launchpadlibrarian.net/742374370/dpkg_1.22.11ubuntu1_amd64.deb \
      https://launchpad.net/ubuntu/+source/perl/5.38.2-5/+build/28504793/+files/perl-base_5.38.2-5_amd64.deb \
      https://launchpad.net/ubuntu/+source/debconf/1.5.86ubuntu1/+build/28052301/+files/debconf_1.5.86ubuntu1_all.deb \
      https://launchpad.net/ubuntu/+source/sudo/1.9.15p5-3ubuntu5/+build/28035899/+files/sudo_1.9.15p5-3ubuntu5_amd64.deb \
      http://launchpadlibrarian.net/743048427/coreutils_9.4-3.1ubuntu1_amd64.deb \
      https://launchpad.net/ubuntu/+source/apparmor/4.1.0~beta1-0ubuntu3/+build/29135383/+files/libapparmor1_4.1.0~beta1-0ubuntu3_amd64.deb \
      https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/30939880/+files/libpam0g_1.5.3-5ubuntu5.4_amd64.deb \
      https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/30939880/+files/libpam-modules_1.5.3-5ubuntu5.4_amd64.deb \
      https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/30939880/+files/libpam-modules-bin_1.5.3-5ubuntu5.4_amd64.deb \
      https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/30939880/+files/libpam-runtime_1.5.3-5ubuntu5.4_all.deb \
      https://launchpad.net/ubuntu/+source/apparmor/4.1.0~beta1-0ubuntu3/+build/29135383/+files/libpam-apparmor_4.1.0~beta1-0ubuntu3_amd64.deb

SHELL ["/bin/bash", "-c"]

RUN set -ex; python3 -m venv --system-site-packages /poetry_venv && \
    source /poetry_venv/bin/activate && \
    pip install --no-cache-dir poetry==$POETRY_VERSION

FROM ubuntu/python:${PYTHON_VERSION} AS python_u24_runtime

USER 0:0

# Copy initial set of tools just to be able to add regular root user and group

COPY --from=python_dev /bin/bash \
  /bin/ls \
  /bin/ln \
  /bin/chown \
  /bin/chmod \
  /bin/whoami \
  /bin/

SHELL ["/bin/bash", "-c"]

COPY --from=python_dev \
  /usr/sbin/useradd \
  /usr/sbin/usermod \
  /usr/sbin/groupadd \
  \
  /usr/sbin/

COPY --from=python_dev \
  /usr/bin/mkdir \
  /usr/bin/dirname \
  /usr/bin/basename \
  /usr/bin/id \
  \
  /usr/bin/

COPY --from=python_dev \
  /lib/x86_64-linux-gnu/libmd.so.0 \
  /lib/x86_64-linux-gnu/libselinux.so.1 \
  /lib/x86_64-linux-gnu/libpcre2-8.so.0 \
  /lib/x86_64-linux-gnu/libcap-ng.so.0 \
  /lib/x86_64-linux-gnu/libsemanage.so.2 \
  /lib/x86_64-linux-gnu/libsepol.so.2 \
  /lib/x86_64-linux-gnu/libaudit.so.1 \
  /lib/x86_64-linux-gnu/


ENV PYTHON_VENV_PATH="/python_venv"
ENV PATH="${PYTHON_VENV_PATH}/bin:/packages_to_install/:$PATH" VIRTUAL_ENV=${PYTHON_VENV_PATH}

COPY --from=python_dev \
  /python_venv \
  "${PYTHON_VENV_PATH}"

COPY --from=python_dev /packages_to_install /packages_to_install

RUN ln -sf /bin/bash /bin/sh && \
  groupadd users && \
  useradd -r -U -o -d /root -ms /bin/bash -u 0 -c "root account" "root" && \
  mkdir -vp /root && chown -R root:root /root && \
  \
  export LD_LIBRARY_PATH="/packages_to_install/:$LD_LIBRARY_PATH" && \
  export DEBIAN_FRONTEND=noninteractive && \
  pushd /packages_to_install && \
  dpkg --force-depends  -i \
    dpkg_1.22.11ubuntu1_amd64.deb \
    perl-base_5.38.2-5_amd64.deb \
    debconf_1.5.86ubuntu1_all.deb \
    libpam0g_1.5.3-5ubuntu5.4_amd64.deb \
    libpam-modules-bin_1.5.3-5ubuntu5.4_amd64.deb \
    libpam-modules_1.5.3-5ubuntu5.4_amd64.deb \
    libpam-runtime_1.5.3-5ubuntu5.4_all.deb \
    libapparmor1_4.1.0~beta1-0ubuntu3_amd64.deb \
    libpam-apparmor_4.1.0~beta1-0ubuntu3_amd64.deb \
    coreutils_9.4-3.1ubuntu1_amd64.deb \
    sudo_1.9.15p5-3ubuntu5_amd64.deb \
    && \
    dpkg --force-remove-essential --purge \
       perl-base \
       dpkg && \
  rm -rf /var/lib/dpkg/ \
         /packages_to_install && \
  popd

# Compile so __pycache__ will be already created for standard Python modules
# Will work similar as e.g. `python -m compileall /urs/lib/python3.12` but is more flexible
RUN python3 -c "import sysconfig, compileall; compileall.compile_dir(sysconfig.get_path('stdlib'))"