This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch hardened-python-base-images in repository https://gitbox.apache.org/repos/asf/airflow.git
commit 5450349d3b22d3dfa92dd2d7e463c558c56bd534 Author: Jarek Potiuk <[email protected]> AuthorDate: Sat Oct 10 16:30:04 2026 +0100 Install the Python build dependencies for the legacy image flavor Dropping the packages that only existed to compile Python left the legacy flavor compiling a Python without sqlite3, lzma or readline - CPython builds those modules only when their headers are present, and the image could not even run airflow. The build now also fails when one of them is missing. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014np1fVAxHmGaBFt3qebJ8x --- Dockerfile | 17 +++++++++++++++++ Dockerfile.ci | 17 +++++++++++++++++ scripts/docker/install_os_dependencies.sh | 17 +++++++++++++++++ 3 files changed, 51 insertions(+) diff --git a/Dockerfile b/Dockerfile index f3d576580da..5bc94168066 100644 --- a/Dockerfile +++ b/Dockerfile @@ -200,6 +200,20 @@ wget \ xz-utils \ zlib1g-dev \ " + if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "legacy" ]]; then + # Needed only to compile Python from sources - without them it builds, but silently + # lacks modules such as sqlite3, lzma or readline. + local debian_version + # shellcheck disable=SC1091 + debian_version=$(. /etc/os-release; printf '%s\n' "$VERSION_CODENAME") + if [[ "${debian_version}" == "bookworm" ]]; then + DEV_APT_DEPS+="lcov libbluetooth-dev libbz2-dev libdb-dev libgdbm-compat-dev libgdbm-dev \ +liblzma-dev libncurses5-dev libreadline6-dev libsqlite3-dev libzstd-dev lzma lzma-dev tk-dev uuid-dev" + else + DEV_APT_DEPS+="lcov libbluetooth-dev libbz2-dev libdb-dev libgdbm-compat-dev libgdbm-dev \ +liblzma-dev libncurses-dev libreadline-dev libsqlite3-dev libzstd-dev tk-dev uuid-dev" + fi + fi export DEV_APT_DEPS fi } @@ -558,6 +572,9 @@ function install_python() { exit 1 fi rm -f "${build_log}" + # CPython builds without the optional modules whose -dev packages are missing, so check them here + # rather than finding out from a broken image. + /usr/python/bin/python3 -c "import bz2, ctypes, dbm.gnu, lzma, readline, sqlite3, ssl, uuid, zlib" cd / rm -rf /usr/src/python find /usr/python -depth \ diff --git a/Dockerfile.ci b/Dockerfile.ci index 8681188656c..e0ea624a9ff 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -136,6 +136,20 @@ wget \ xz-utils \ zlib1g-dev \ " + if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "legacy" ]]; then + # Needed only to compile Python from sources - without them it builds, but silently + # lacks modules such as sqlite3, lzma or readline. + local debian_version + # shellcheck disable=SC1091 + debian_version=$(. /etc/os-release; printf '%s\n' "$VERSION_CODENAME") + if [[ "${debian_version}" == "bookworm" ]]; then + DEV_APT_DEPS+="lcov libbluetooth-dev libbz2-dev libdb-dev libgdbm-compat-dev libgdbm-dev \ +liblzma-dev libncurses5-dev libreadline6-dev libsqlite3-dev libzstd-dev lzma lzma-dev tk-dev uuid-dev" + else + DEV_APT_DEPS+="lcov libbluetooth-dev libbz2-dev libdb-dev libgdbm-compat-dev libgdbm-dev \ +liblzma-dev libncurses-dev libreadline-dev libsqlite3-dev libzstd-dev tk-dev uuid-dev" + fi + fi export DEV_APT_DEPS fi } @@ -494,6 +508,9 @@ function install_python() { exit 1 fi rm -f "${build_log}" + # CPython builds without the optional modules whose -dev packages are missing, so check them here + # rather than finding out from a broken image. + /usr/python/bin/python3 -c "import bz2, ctypes, dbm.gnu, lzma, readline, sqlite3, ssl, uuid, zlib" cd / rm -rf /usr/src/python find /usr/python -depth \ diff --git a/scripts/docker/install_os_dependencies.sh b/scripts/docker/install_os_dependencies.sh index 99c1c07b396..e8126c43f2c 100644 --- a/scripts/docker/install_os_dependencies.sh +++ b/scripts/docker/install_os_dependencies.sh @@ -111,6 +111,20 @@ wget \ xz-utils \ zlib1g-dev \ " + if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "legacy" ]]; then + # Needed only to compile Python from sources - without them it builds, but silently + # lacks modules such as sqlite3, lzma or readline. + local debian_version + # shellcheck disable=SC1091 + debian_version=$(. /etc/os-release; printf '%s\n' "$VERSION_CODENAME") + if [[ "${debian_version}" == "bookworm" ]]; then + DEV_APT_DEPS+="lcov libbluetooth-dev libbz2-dev libdb-dev libgdbm-compat-dev libgdbm-dev \ +liblzma-dev libncurses5-dev libreadline6-dev libsqlite3-dev libzstd-dev lzma lzma-dev tk-dev uuid-dev" + else + DEV_APT_DEPS+="lcov libbluetooth-dev libbz2-dev libdb-dev libgdbm-compat-dev libgdbm-dev \ +liblzma-dev libncurses-dev libreadline-dev libsqlite3-dev libzstd-dev tk-dev uuid-dev" + fi + fi export DEV_APT_DEPS fi } @@ -469,6 +483,9 @@ function install_python() { exit 1 fi rm -f "${build_log}" + # CPython builds without the optional modules whose -dev packages are missing, so check them here + # rather than finding out from a broken image. + /usr/python/bin/python3 -c "import bz2, ctypes, dbm.gnu, lzma, readline, sqlite3, ssl, uuid, zlib" cd / rm -rf /usr/src/python find /usr/python -depth \
