facett-ops/src/containerfiles/pip-toolchain.Containerfile
# nordisk PIP TOOLCHAIN — the ONE image the facett wheels are built in.
#
# THE RULE THIS IMAGE EXISTS FOR (Rickard, 2026-09-05): "make build environment so
# it can build pip packages, ready for release, USE A CONTAINER for the horrible
# python language". No python runs on the host. Not to build the wheel, not to
# check it, not to publish it. The host contributes a container engine socket and
# two bind mounts; everything with the word `python` in it happens in here.
#
# WHAT IT REPLACES, and why that is not a style preference:
# `pkg-facet-wrapped/make_wheel.py` ran `python -m build` ON THE HOST. On
# 2026-07-31 12:53 its predecessor `build.py` shadowed the `build` package on
# sys.path, re-entered itself, and forked ~10 000 processes until oden died of
# OOM. The file that replaced it carries TWO guards against that one recursion
# (a rename, and `-P`/PYTHONSAFEPATH) — which is the tell: the host was never
# the right place to run it. A container has its own pid namespace, its own
# sys.path and a memory limit, so the failure mode is a dead container, not a
# dead workstation. Both guards become unnecessary in here.
#
# Built through `xtask::pip::build_toolchain_image` (draupnir's
# `build_image_reproducible` → the podman libpod /build route), which sets the
# `timestamp` + `outputformat` parameters so the image ID is a function of this
# recipe and not of the minute it was built. Same door the cargo and kernel
# toolchain images already use — this file is a third instance of that
# discipline, not a new one (LAW 5).
#
# ── THE BASE IS PINNED BY DIGEST, not by tag ────────────────────────────────
# `debian:trixie` is a moving target; this digest is not. Measured on oden
# 2026-09-05: `podman image inspect debian:trixie` → this digest.
FROM debian@sha256:6788062a1b42ac281f053ac876170b79a3eaed5d61383b8ed7eaca6c6965f3b1
ENV DEBIAN_FRONTEND=noninteractive
# ── THE HONEST GAP, stated rather than papered over ─────────────────────────
# The apt archive below is deb.debian.org, NOT snapshot.debian.org. That is the
# same reproducibility level as `cargo-toolchain.Containerfile` and
# `kernel-toolchain.Containerfile` — the base layer is pinned to the byte, the
# packages installed on top of it are pinned only to whatever trixie serves the
# day the image is minted. Moving all three to a snapshot URL is one line each
# and is a deliberate, measured change to make together; doing it for this file
# alone would make facett's wheel "more reproducible" than the binaries it ships
# beside, which is a claim, not a property. Until then, the image ID recorded by
# the caller is the pin that actually holds.
#
# Every package names the STEP that needs it. An unexplained package in a build
# image is an unmeasured dependency.
RUN apt-get update && apt-get install -y --no-install-recommends \
`# step: BUILD — the interpreter itself. Everything below is a module for it.` \
python3 \
`# step: BUILD — PEP 517 front end. This is the "python -m build" that runs;` \
`# taken from the distro archive rather than pip so no wheel is fetched from` \
`# PyPI at build time and the step works with the network off.` \
python3-build \
`# step: BUILD — the backend pkg-facet-wrapped/pyproject.toml DECLARES` \
`# (build-backend = "setuptools.build_meta"). Present in the image because` \
`# the build runs --no-isolation: with isolation, python -m build would` \
`# create a venv and DOWNLOAD setuptools+wheel from PyPI, which is a network` \
`# reach in the middle of a hermetic build and a different setuptools every` \
`# run. Pinning them into the image is what makes --no-isolation honest.` \
python3-setuptools python3-wheel \
`# step: VERIFY — the sdist half of the build tars and gzips through these.` \
`# python3-setuptools shells no tar, but build's sdist path needs a working` \
`# gzip for the .tar.gz; naming it here so a missing one fails by name.` \
gzip \
&& rm -rf /var/lib/apt/lists/*
# ── THE IMAGE ASSERTS ITS OWN CONTENTS ──────────────────────────────────────
#
# The lesson `cargo-toolchain.Containerfile` paid for: `rustc --print target-list`
# printed a target it had no std for and exited 0. A check that cannot fail is
# indistinguishable from a law being obeyed. So this image does not merely
# `import build` — it BUILDS A WHEEL, from a two-file throwaway project, with the
# exact flags the real build uses (`--wheel --no-isolation`), and asserts the
# output exists, is non-empty, and is a PK zip. A missing setuptools then fails
# HERE, by name, in the image build — not forty minutes later in facett's.
RUN set -eu; \
mkdir -p /tmp/probe/src/nordisk_probe; \
printf '__version__ = "0"\n' > /tmp/probe/src/nordisk_probe/__init__.py; \
printf '[build-system]\nrequires = ["setuptools"]\nbuild-backend = "setuptools.build_meta"\n\n[project]\nname = "nordisk-probe"\nversion = "0.0.0"\n\n[tool.setuptools]\npackage-dir = { "" = "src" }\npackages = ["nordisk_probe"]\n' > /tmp/probe/pyproject.toml; \
cd /tmp/probe && python3 -m build --wheel --no-isolation --outdir /tmp/probe/dist; \
whl="$(ls /tmp/probe/dist/*.whl 2>/dev/null | head -1)"; \
test -n "$whl" || { echo "FATAL: this image cannot build a wheel — python -m build produced nothing"; exit 1; }; \
test -s "$whl" || { echo "FATAL: this image built an EMPTY wheel ($whl)"; exit 1; }; \
head -c 2 "$whl" | grep -q 'PK' || { echo "FATAL: $whl is not a zip — the build backend wrote something else"; exit 1; }; \
echo "wheel OK: $whl ($(stat -c %s "$whl") bytes)"; \
rm -rf /tmp/probe
# The build script runs as `sh -eu -c`. `/pkg` is the python package source
# (bind-mounted read-write so `python -m build` can write its dist/), `/wasm` is
# the wasm bundle `cargo xtask wrap-wasm` produced (bind-mounted READ-ONLY: the
# container copies bytes out of it and must never be able to write back into a
# build artifact the host owns).
WORKDIR /pkg