nordisk/facett

facett-ops/src/containerfiles/pip-consumer.Containerfile

# nordisk PIP CONSUMER — a clean box that has never seen this repo.
#
# This image exists to answer ONE question the build image cannot: does the
# published wheel INSTALL and WORK for somebody who only has a pip and an index
# URL? The build image is disqualified from asking it — it carries the build
# backend, and it has the source tree bind-mounted. A check run in there can pass
# on a wheel that is broken for everyone else.
#
# So: no setuptools, no build, no source, no network mounts. `python3`, `pip`, and
# `venv`. If `pip install --index-url …` works in here, it works.
#
# Base pinned by digest, same instant as the build image, same reasoning
# (`pip-toolchain.Containerfile` states it once).
FROM debian@sha256:6788062a1b42ac281f053ac876170b79a3eaed5d61383b8ed7eaca6c6965f3b1

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    `# step: INSTALL — the interpreter the wheel is installed for and imported by.` \
    python3 \
    `# step: INSTALL — the client under test. This is the whole point: a real pip` \
    `# resolving a real PEP 503 index, not a file copy wearing the name.` \
    python3-pip \
    `# step: INSTALL — Debian marks the system python EXTERNALLY-MANAGED (PEP 668),` \
    `# so a system-wide pip install refuses by design. The install runs in a venv,` \
    `# which is also what a consumer would actually do, so the check and the real` \
    `# world agree. The alternative (--break-system-packages) would test a path` \
    `# nobody uses.` \
    python3-venv \
    && rm -rf /var/lib/apt/lists/*

# ── THE IMAGE ASSERTS ITS OWN CONTENTS ──────────────────────────────────────
#
# Same lesson as the build image: a check that cannot fail is indistinguishable
# from a law being obeyed. This does not merely `import venv` — it CREATES a venv
# and asserts the pip inside it runs, because "python3-venv is installed" and "a
# venv can be made" are different facts (a venv needs ensurepip, which Debian
# splits out and has shipped broken before).
RUN set -eu; \
    python3 -m venv /tmp/probe-venv; \
    /tmp/probe-venv/bin/pip --version || { echo "FATAL: this image can make a venv with no working pip in it"; exit 1; }; \
    rm -rf /tmp/probe-venv

# Deliberately EMPTY. Nothing from the repo is mounted into this image — the wheel
# must arrive over the index, the way a consumer's would.
WORKDIR /