common-python-tasks 0.11.0__py3-none-any.whl → 0.12.0__py3-none-any.whl

common_python_tasks/data/dockerfile_extensions/docker-in-docker/Dockerfile

@@ -0,0 +1,27 @@
+# Docker-in-Docker currently supports Debian Bookworm on amd64 and arm64.
+USER root
+
+# Optional exact APT version, including the epoch and distribution suffix.
+ARG DIND_DOCKER_VERSION
+
+COPY --from=cpt-extension-docker-in-docker --chmod=0755 install.sh \
+    /usr/local/share/cpt-dind-install.sh
+RUN /usr/local/share/cpt-dind-install.sh \
+    && rm /usr/local/share/cpt-dind-install.sh
+
+COPY --from=cpt-extension-docker-in-docker --chmod=0755 supervisor.sh \
+    /usr/local/bin/cpt-dind-supervisor
+
+RUN mv /pkg/entrypoint.sh /pkg/application-entrypoint.sh \
+    && printf '%s\n' '#!/bin/sh' \
+        'exec /usr/bin/tini -- /usr/local/bin/cpt-dind-supervisor "$@"' \
+        >/pkg/entrypoint.sh \
+    && chmod 0755 /pkg/entrypoint.sh
+
+ENV DOCKER_HOST=unix:///var/run/docker.sock
+VOLUME ["/var/lib/docker", "/var/lib/containerd"]
+
+# The generic final and debug stages inherit this startup-user selection.
+# The wrapper drops to py only for the application, after Docker is ready.
+ARG RUNTIME_USER=root
+USER ${RUNTIME_USER}

common_python_tasks/data/dockerfile_extensions/docker-in-docker/install.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+set -eu
+
+# shellcheck source=/dev/null
+. /etc/os-release
+if [ "$ID" != debian ] || [ "${VERSION_CODENAME:-}" != bookworm ]; then
+    echo >&2 'docker-in-docker requires Debian Bookworm; use slim-bookworm.'
+    exit 1
+fi
+case "$(dpkg --print-architecture)" in
+    amd64 | arm64) ;;
+    *)
+        echo >&2 'docker-in-docker supports amd64 and arm64 only.'
+        exit 1
+        ;;
+esac
+
+apt-get update
+apt-get install -y --no-install-recommends \
+    bash ca-certificates curl iptables tini util-linux
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg \
+    -o /etc/apt/keyrings/docker.asc
+chmod 0644 /etc/apt/keyrings/docker.asc
+cat >/etc/apt/sources.list.d/docker.sources <<SOURCES
+Types: deb
+URIs: https://download.docker.com/linux/debian
+Suites: bookworm
+Components: stable
+Architectures: $(dpkg --print-architecture)
+Signed-By: /etc/apt/keyrings/docker.asc
+SOURCES
+apt-get update
+apt-get install -y --no-install-recommends \
+    "docker-ce${DIND_DOCKER_VERSION:+=$DIND_DOCKER_VERSION}" \
+    "docker-ce-cli${DIND_DOCKER_VERSION:+=$DIND_DOCKER_VERSION}" \
+    containerd.io docker-buildx-plugin docker-compose-plugin
+usermod -aG docker py
+rm -rf /var/lib/apt/lists/*

common_python_tasks/data/dockerfile_extensions/docker-in-docker/supervisor.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+set -euo pipefail
+
+_prepare_host() {
+    if [[ $(id -u) != 0 ]]; then
+        echo >&2 'docker-in-docker must start as root with --privileged.'
+        return 1
+    fi
+    if [[ ! -w /sys/fs/cgroup ]]; then
+        echo >&2 'docker-in-docker needs writable cgroups; use --privileged.'
+        return 1
+    fi
+    if [[ -d /sys/kernel/security ]] &&
+        ! mountpoint -q /sys/kernel/security; then
+        mount -t securityfs none /sys/kernel/security
+    fi
+    _prepare_cgroups
+    if ! iptables -nL >/dev/null 2>&1 &&
+        iptables-legacy -nL >/dev/null 2>&1; then
+        update-alternatives --set iptables /usr/sbin/iptables-legacy
+        update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+    fi
+    # Only remove our daemon's PID file, never unrelated processes' files.
+    rm -f /var/run/docker.pid
+}
+
+_prepare_cgroups() {
+    [[ -f /sys/fs/cgroup/cgroup.controllers ]] || return 0
+    mkdir -p /sys/fs/cgroup/cpt-init
+    local attempt pid controllers
+    for ((attempt = 0; attempt < 5; attempt++)); do
+        while read -r pid; do
+            # Processes can disappear or become immovable while we move them.
+            printf '%s\n' "$pid" | tee \
+                /sys/fs/cgroup/cpt-init/cgroup.procs >/dev/null 2>&1 || true
+        done </sys/fs/cgroup/cgroup.procs
+        controllers=$(sed 's/[^ ]\+/+&/g' \
+            /sys/fs/cgroup/cgroup.controllers)
+        if printf '%s\n' "$controllers" | tee \
+            /sys/fs/cgroup/cgroup.subtree_control >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.1
+    done
+    echo >&2 'docker-in-docker could not enable nested cgroups.'
+    return 1
+}
+
+_stop_group() {
+    local pid=$1
+    [[ -n "$pid" ]] || return 0
+    kill -TERM -- "-$pid" 2>/dev/null || true
+    local attempt
+    for ((attempt = 0; attempt < 50; attempt++)); do
+        kill -0 -- "-$pid" 2>/dev/null || break
+        sleep 0.1
+    done
+    kill -KILL -- "-$pid" 2>/dev/null || true
+    wait "$pid" 2>/dev/null || true
+}
+
+_shutdown() {
+    trap '' TERM INT
+    _stop_group "$app_pid"
+    _stop_group "$daemon_pid"
+}
+
+_wait_for_docker() {
+    local deadline=$((SECONDS + DIND_STARTUP_TIMEOUT))
+    while ((SECONDS < deadline)); do
+        if ! kill -0 "$daemon_pid" 2>/dev/null; then
+            echo >&2 'docker-in-docker daemon exited during startup.'
+            return 1
+        fi
+        if timeout 1 docker --host "$DOCKER_HOST" info >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.2
+    done
+    echo >&2 'docker-in-docker timed out waiting for the daemon.'
+    return 1
+}
+
+_main() {
+    if [[ ! ${DIND_STARTUP_TIMEOUT:-60} =~ ^[1-9][0-9]{0,3}$ ]]; then
+        echo >&2 'DIND_STARTUP_TIMEOUT must be an integer from 1 to 9999.'
+        return 1
+    fi
+    export DIND_STARTUP_TIMEOUT=${DIND_STARTUP_TIMEOUT:-60}
+    export DOCKER_HOST=unix:///var/run/docker.sock
+    export container=docker
+    unset DOCKER_CONTEXT DOCKER_TLS_VERIFY DOCKER_CERT_PATH
+    _prepare_host
+    daemon_pid=''
+    app_pid=''
+    trap _shutdown EXIT
+    trap 'exit 143' TERM
+    trap 'exit 130' INT
+    # Keep daemon logs on stderr and expose only the local Unix socket.
+    setsid dockerd --host "$DOCKER_HOST" --group docker >&2 &
+    daemon_pid=$!
+    _wait_for_docker
+    setsid setpriv --reuid py --regid py --init-groups \
+        env HOME="$(getent passwd py | cut -d: -f6)" USER=py LOGNAME=py \
+        /pkg/application-entrypoint.sh "$@" &
+    app_pid=$!
+    local finished status=0
+    wait -n -p finished "$daemon_pid" "$app_pid" || status=$?
+    if [[ "$finished" == "$daemon_pid" ]]; then
+        echo >&2 'docker-in-docker daemon exited while the app was running.'
+        return 1
+    fi
+    return "$status"
+}
+
+_main "$@"

common_python_tasks/data/generic/Dockerfile.j2

@@ -40,7 +40,7 @@ COPY . /tmp/build/
 # Export debug requirements when the project defines a debug dependency group
 RUN --mount=type=cache,target=/root/.cache/uv,id=uv-cache{{ CACHE_ID_SUFFIX }}{% for mount in UV_INDEX_SECRET_MOUNTS %} \
     --mount={{ mount }}{% endfor %} \
-    uv export --group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
+    uv export --frozen --only-group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
 {% endif %}
 
 # Build the wheel, caching the uv cache directory to speed up subsequent builds.
@@ -133,10 +133,11 @@ LABEL git.commit=${GIT_COMMIT}
 # This entrypoint is deliberately not configurable via environment variables in order to
 # ensure that the container always uses the entrypoint selected at build time. If the
 # current package does not provide a console script, the entrypoint will default to `python`
-RUN echo "#!/bin/sh\n\n{{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
+RUN echo "#!/bin/sh\n\nexec {{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
     && chmod +x /pkg/entrypoint.sh
 
-USER py
+ARG RUNTIME_USER=py
+USER ${RUNTIME_USER}
 
 {% if EXTENSION_CONTENT %}
 {{ EXTENSION_CONTENT }}
@@ -154,10 +155,10 @@ COPY --from=builder /tmp/build /tmp/build
 
 RUN --mount=type=cache,target=/root/.cache/pip,id=pip-cache{{ CACHE_ID_SUFFIX }} pip install --root-user-action=ignore -r /tmp/build/requirements-debug.txt
 
-USER py
+USER ${RUNTIME_USER}
 {% endif %}
 
 # Final (default) image: explicitly use runtime as the final target so debug is not used unless requested
 FROM runtime AS final
 
-USER py
+USER ${RUNTIME_USER}

common_python_tasks/env.py

@@ -3,6 +3,7 @@ import os
 import re
 import secrets
 import shlex
+from collections.abc import Iterator
 from pathlib import Path
 
 from . import utils
@@ -53,51 +54,47 @@ def collect_uv_index_credentials() -> list[dict[str, str | None]]:
     ]
 
 
+def _iter_uv_index_secrets(
+    credentials: list[dict[str, str | None]],
+) -> Iterator[tuple[str, str]]:
+    for credential in credentials:
+        index_name = credential["index_name"].lower()
+        for credential_type in ("username", "password"):
+            environment_name = credential[f"{credential_type}_env"]
+            if environment_name:
+                yield f"uv_index_{index_name}_{credential_type}", environment_name
+
+
 def uv_index_secret_mounts(credentials: list[dict[str, str | None]]) -> list[str]:
-    """Return Dockerfile ``--mount`` strings for UV index credentials.
+    """Return Dockerfile `--mount` strings for UV index credentials.
 
     Args:
         credentials: Output of `collect_uv_index_credentials`.
 
     Returns:
-        A list of ``type=secret,...`` strings for Dockerfile ``RUN --mount=``
+        A list of `type=secret,...` strings for Dockerfile `RUN --mount=`
         directives.
     """
-    mounts = []
-    for cred in credentials:
-        name = cred["index_name"].lower()
-        if cred["username_env"]:
-            mounts.append(
-                f"type=secret,id=uv_index_{name}_username,env={cred['username_env']}"
-            )
-        if cred["password_env"]:
-            mounts.append(
-                f"type=secret,id=uv_index_{name}_password,env={cred['password_env']}"
-            )
-    return mounts
+    return [
+        f"type=secret,id={secret_id},env={environment_name}"
+        for secret_id, environment_name in _iter_uv_index_secrets(credentials)
+    ]
 
 
 def uv_index_secret_build_args(credentials: list[dict[str, str | None]]) -> list[str]:
-    """Return ``docker build --secret`` arg pairs for UV index credentials.
+    """Return `docker build --secret` arg pairs for UV index credentials.
 
     Args:
         credentials: Output of `collect_uv_index_credentials`.
 
     Returns:
-        A flat list of ``--secret`` flag-value pairs for the docker build command.
+        A flat list of `--secret` flag-value pairs for the docker build command.
     """
-    args = []
-    for cred in credentials:
-        name = cred["index_name"].lower()
-        if cred["username_env"]:
-            args.extend(
-                ["--secret", f"id=uv_index_{name}_username,env={cred['username_env']}"]
-            )
-        if cred["password_env"]:
-            args.extend(
-                ["--secret", f"id=uv_index_{name}_password,env={cred['password_env']}"]
-            )
-    return args
+    return [
+        item
+        for secret_id, environment_name in _iter_uv_index_secrets(credentials)
+        for item in ("--secret", f"id={secret_id},env={environment_name}")
+    ]
 
 
 def env_truthy(env_var: str) -> bool:
@@ -230,6 +227,40 @@ def resolve_extension_content(descriptor: dict[str, str | None]) -> str:
     utils.fatal(f"Unknown extension descriptor source: {descriptor['source']}")
 
 
+def resolve_extension_build_context(
+    descriptor: dict[str, str | None],
+) -> tuple[str, Path] | None:
+    """Return the named build context for a bundled extension's asset directory.
+
+    Args:
+        descriptor: Extension descriptor dictionary containing `source` and
+            `bundle_name` values.
+
+    Returns:
+        A Docker build-context name and its directory, or `None` when the
+        extension has no packaged assets.
+    """
+    if descriptor["source"] != "bundle":
+        return None
+    bundle_name = descriptor["bundle_name"]
+    out = utils.load_data_file(
+        f"{bundle_name}/Dockerfile",
+        type_identifier="dockerfile_extensions",
+        fatal_on_missing=False,
+    )
+    if out is None:
+        utils.fatal(f"Extension bundle not found: {bundle_name}")
+    bundle_directory = out[0].parent
+    if not bundle_directory.is_dir() or not any(
+        path.name != "Dockerfile" for path in bundle_directory.iterdir()
+    ):
+        return None
+    return (
+        f"cpt-extension-{re.sub(r'[^a-z0-9]+', '-', bundle_name.lower()).strip('-')}",
+        bundle_directory,
+    )
+
+
 def get_cache_id_suffix(no_cache: bool) -> str:
     """Return a cache-break suffix for Docker cache mount IDs.
     Args:
@@ -330,6 +361,28 @@ def resolve_container_docker_build_args(
         utils.fatal(f"Invalid CONTAINER_DOCKER_BUILD_ARGS: {error}")
 
 
+def _resolve_optional_file_path(
+    cli_path: str | None,
+    environment_path: str | None,
+    description: str,
+) -> Path | None:
+    resolved_path = next(
+        (
+            Path(value.strip())
+            for value in (cli_path, environment_path)
+            if value and value.strip()
+        ),
+        None,
+    )
+    if resolved_path is None:
+        return None
+    if not resolved_path.exists():
+        utils.fatal(f"{description} not found: {resolved_path}")
+    if not resolved_path.is_file():
+        utils.fatal(f"{description} is not a file: {resolved_path}")
+    return resolved_path
+
+
 def resolve_container_dockerfile_hook_path(
     cli_hook_path: str | None, env_hook_path: str | None
 ) -> Path | None:
@@ -342,17 +395,13 @@ def resolve_container_dockerfile_hook_path(
     Returns:
         The validated hook path, or `None` when unset.
     """
-    raw_value = (
-        cli_hook_path if cli_hook_path and cli_hook_path.strip() else env_hook_path
+    hook_path = _resolve_optional_file_path(
+        cli_hook_path,
+        env_hook_path,
+        "Dockerfile hook script",
     )
-    if raw_value is None or not raw_value.strip():
+    if hook_path is None:
         return None
-
-    hook_path = Path(raw_value.strip())
-    if not hook_path.exists():
-        utils.fatal(f"Dockerfile hook script not found: {hook_path}")
-    if not hook_path.is_file():
-        utils.fatal(f"Dockerfile hook path is not a file: {hook_path}")
     if not os.access(hook_path, os.X_OK):
         utils.fatal(f"Dockerfile hook script must be executable: {hook_path}")
 
@@ -594,6 +643,28 @@ def get_container_deps_move_script() -> str | None:
     return inline_script if inline_script else None
 
 
+def resolve_container_dockerfile_path(
+    dockerfile_path: str | None,
+    environment_dockerfile_path: str | None,
+) -> Path | None:
+    """Resolve and validate a project-owned application Dockerfile.
+
+    Args:
+        dockerfile_path: Dockerfile path supplied directly to a task.
+        environment_dockerfile_path: Dockerfile path supplied through the
+            environment.
+
+    Returns:
+        The configured Dockerfile path, or `None` when the bundled template
+        should be used.
+    """
+    return _resolve_optional_file_path(
+        dockerfile_path,
+        environment_dockerfile_path,
+        "Container Dockerfile",
+    )
+
+
 def get_prune_keep() -> int:
     """Return the integer value of CONTAINER_PRUNE_KEEP.
 

common_python_tasks/tasks.py

@@ -70,6 +70,28 @@ class _ContainerBuild(NamedTuple):
     commit_tag: str
 
 
+def _prune_container_images(version_tag: str, commit_tag: str) -> None:
+    from .docker import prune_images_keep
+    from .env import get_prune_keep
+    from .utils import get_full_image_name, get_package_name
+
+    keep = get_prune_keep()
+    if keep < 0:
+        return
+
+    LOGGER.debug(
+        "Pruning old images; keeping %d and protecting tags: %s",
+        keep,
+        [version_tag, commit_tag],
+    )
+    prune_images_keep(
+        get_full_image_name(),
+        get_package_name(),
+        keep,
+        protect_tags=[version_tag, commit_tag],
+    )
+
+
 def _make_var_positional_task_args_optional(
     func: callable, resolved_task_name: str
 ) -> None:
@@ -367,11 +389,19 @@ def clean(dist_only: bool = False) -> None:
         return
     else:
         to_clean = [
-            *[Path(p) for p in [".pytest_cache", "dist", ".mypy_cache"]],
+            *[
+                Path(p)
+                for p in [
+                    ".pytest_cache",
+                    "dist",
+                    ".mypy_cache",
+                    ".coverage",
+                    "coverage.xml",
+                    ".ruff_cache",
+                ]
+            ],
             *Path(".").rglob("__pycache__"),
             *Path(".").rglob("*.pyc"),
-            Path(".coverage"),
-            Path("coverage.xml"),
         ]
 
     for item in to_clean:
@@ -465,11 +495,12 @@ def build_image(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     dockerfile_hook_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
 ) -> _ContainerBuild:
-    """Build the container image for this project using the Dockerfile template.
+    """Build the container image using a project-owned or bundled Dockerfile.
 
     Args:
         *docker_build_args: Additional arguments passed directly to `docker build`.
@@ -479,8 +510,10 @@ def build_image(
         no_cache: Do not use cache when building the image.
         plain: Do not pretty-print output.
         single_arch: Build images for a single architecture.
+        dockerfile_path: Optional project-owned Dockerfile. Overrides
+            CONTAINER_DOCKERFILE_PATH if provided.
         dockerfile_hook_path: Optional executable script path that can mutate
-            the generated Dockerfile before build. Overrides
+            the selected Dockerfile before build. Overrides
             CONTAINER_DOCKERFILE_HOOK_PATH if provided.
         container_env: Builder and runtime environment declarations as repeated
             KEY=VALUE values.
@@ -494,14 +527,10 @@ def build_image(
         The generated Dockerfile text and image tags.
     """
     from .docker import build_image as _build_image
-    from .docker import (
-        prune_images_keep,
-    )
     from .env import (
         collect_uv_index_credentials,
         get_cache_id_suffix,
         get_container_deps_move_script,
-        get_prune_keep,
         get_python_variant,
         inject_auto_build_args_from_env,
         load_container_env_tokens,
@@ -511,6 +540,8 @@ def build_image(
         render_container_deps_move_script,
         resolve_container_docker_build_args,
         resolve_container_dockerfile_hook_path,
+        resolve_container_dockerfile_path,
+        resolve_extension_build_context,
         resolve_extension_content,
         uv_index_secret_build_args,
         uv_index_secret_mounts,
@@ -521,14 +552,17 @@ def build_image(
     )
     from .utils import (
         fatal,
-        get_full_image_name,
-        get_package_name,
         load_data_file,
         render_template_text,
     )
 
+    resolved_dockerfile_path = resolve_container_dockerfile_path(
+        dockerfile_path,
+        os.getenv("CONTAINER_DOCKERFILE_PATH"),
+    )
+
     # Determine extensions up-front so we can log a single, accurate message
-    extensions = parse_container_extensions()
+    extensions = [] if resolved_dockerfile_path else parse_container_extensions()
     extension_ids = [desc.get("id") for desc in extensions if desc.get("id")]
     if extension_ids:
         LOGGER.info("Building image (with extensions: %s)", ", ".join(extension_ids))
@@ -538,6 +572,11 @@ def build_image(
     # Resolve all extension fragments up-front so we fail fast on missing
     # bundles or files and avoid calling resolution logic multiple times.
     resolved_fragments = [resolve_extension_content(desc) for desc in extensions]
+    extension_build_contexts = [
+        context
+        for desc in extensions
+        if (context := resolve_extension_build_context(desc)) is not None
+    ]
 
     resolved_docker_build_args = resolve_container_docker_build_args(
         docker_build_args,
@@ -556,6 +595,29 @@ def build_image(
         dockerfile_hook_path,
         os.getenv("CONTAINER_DOCKERFILE_HOOK_PATH"),
     )
+    top_level_build_args = inject_auto_build_args_from_env(
+        {"PYTHON_VARIANT": get_python_variant()}
+    )
+
+    if resolved_dockerfile_path:
+        version_tag, commit_tag = _build_image(
+            dockerfile_path=resolved_dockerfile_path,
+            context_path=Path("."),
+            debug=debug,
+            no_cache=no_cache,
+            plain=plain,
+            single_arch=single_arch,
+            omit_target=not debug,
+            extra_build_args=top_level_build_args or None,
+            docker_build_args=resolved_docker_build_args,
+            dockerfile_hook_path=resolved_dockerfile_hook_path,
+        )
+        _prune_container_images(version_tag, commit_tag)
+        return _ContainerBuild(
+            dockerfile_text=resolved_dockerfile_path.read_text(encoding="utf-8"),
+            version_tag=version_tag,
+            commit_tag=commit_tag,
+        )
 
     has_debug_deps = has_debug_dependency_group()
     if debug and not has_debug_deps:
@@ -579,9 +641,6 @@ def build_image(
             "Injecting builder and runtime env vars: %s",
             ", ".join(container_env_vars),
         )
-    top_level_build_args = inject_auto_build_args_from_env(
-        {"PYTHON_VARIANT": get_python_variant()}
-    )
     external_deps_image = _get_container_build_setting("CONTAINER_DEPS_IMAGE")
     if external_deps_image:
         top_level_build_args["CONTAINER_DEPS_IMAGE"] = external_deps_image
@@ -687,20 +746,18 @@ def build_image(
         plain=plain,
         single_arch=single_arch,
         extra_build_args=merged_build_args or None,
-        docker_build_args=resolved_docker_build_args,
+        docker_build_args=[
+            *resolved_docker_build_args,
+            *(
+                item
+                for name, path in extension_build_contexts
+                for item in ("--build-context", f"{name}={path}")
+            ),
+        ],
         dockerfile_hook_path=resolved_dockerfile_hook_path,
     )
 
-    keep = get_prune_keep()
-    if keep >= 0:
-        # Protect the tags created by this build
-        protect = [t for t in (version_tag, commit_tag) if t is not None]
-        LOGGER.debug(
-            "Pruning old images; keeping %d and protecting tags: %s", keep, protect
-        )
-        prune_images_keep(
-            get_full_image_name(), get_package_name(), keep, protect_tags=protect
-        )
+    _prune_container_images(version_tag, commit_tag)
 
     return _ContainerBuild(
         dockerfile_text=dockerfile_text,
@@ -1320,6 +1377,7 @@ def _run_release_flow(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
     assets: list[str] | None = None,
@@ -1426,6 +1484,7 @@ def _run_release_flow(
             no_cache=no_cache,
             plain=plain,
             single_arch=single_arch,
+            dockerfile_path=dockerfile_path,
             container_env=container_env,
             container_envfile=container_envfile,
         )
@@ -1444,6 +1503,7 @@ def release(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
     assets: list[str] | None = None,
@@ -1462,6 +1522,8 @@ def release(
         no_cache: Do not use cache when building container images.
         plain: Do not pretty-print container build output.
         single_arch: Build container image for a single architecture.
+        dockerfile_path: Optional project-owned Dockerfile used for the image
+            build. Overrides CONTAINER_DOCKERFILE_PATH if provided.
         container_env: Inline container environment variables as repeated
             KEY=VALUE values.
         container_envfile: Repeated list of container environment files.
@@ -1480,6 +1542,7 @@ def release(
         no_cache=no_cache,
         plain=plain,
         single_arch=single_arch,
+        dockerfile_path=dockerfile_path,
         container_env=container_env,
         container_envfile=container_envfile,
         assets=assets,
@@ -1532,6 +1595,7 @@ def build(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
 ) -> None:
@@ -1544,6 +1608,8 @@ def build(
         no_cache: Pass `--no-cache` to the Docker build command.
         plain: Pass `--progress plain` to the Docker build command.
         single_arch: Build the container for the current host architecture only.
+        dockerfile_path: Optional project-owned Dockerfile used for the image
+            build. Overrides CONTAINER_DOCKERFILE_PATH if provided.
         container_env: Inline container environment variables as repeated
             `KEY=VALUE` values.
         container_envfile: Repeated list of container environment files.
@@ -1558,6 +1624,7 @@ def build(
             no_cache=no_cache,
             plain=plain,
             single_arch=single_arch,
+            dockerfile_path=dockerfile_path,
             container_env=container_env,
             container_envfile=container_envfile,
         )
@@ -1572,6 +1639,7 @@ def build_with_containers(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
 ) -> None:
@@ -1582,6 +1650,8 @@ def build_with_containers(
         no_cache: Do not use cache when building the image.
         plain: Do not pretty-print output.
         single_arch: Build images for a single architecture.
+        dockerfile_path: Optional project-owned Dockerfile used for the image
+            build. Overrides CONTAINER_DOCKERFILE_PATH if provided.
         container_env: Inline container environment variables as repeated KEY=VALUE
             values.
         container_envfile: Repeated list of container environment files.
@@ -1593,6 +1663,7 @@ def build_with_containers(
         no_cache=no_cache,
         plain=plain,
         single_arch=single_arch,
+        dockerfile_path=dockerfile_path,
         container_env=container_env,
         container_envfile=container_envfile,
     )

{common_python_tasks-0.11.0.dist-info → common_python_tasks-0.12.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: common-python-tasks
-Version: 0.11.0
+Version: 0.12.0
 Summary: Opinionated Poe the Poet tasks for Python package development.
 Project-URL: Homepage, http://github.com/ci-sourcerer/common-python-tasks
 Project-URL: Source, http://github.com/ci-sourcerer/common-python-tasks.git
@@ -42,7 +42,7 @@ Read the [complete documentation](https://ci-sourcerer.github.io/common-python-t
 Add the package as a development dependency.
 
 ```shell
-uv add --dev common-python-tasks==0.11.0
+uv add --dev common-python-tasks==0.12.0
 ```
 
 Expose the default task set in `pyproject.toml`.

{common_python_tasks-0.11.0.dist-info → common_python_tasks-0.12.0.dist-info}/RECORD

@@ -2,13 +2,16 @@ common_python_tasks/__init__.py,sha256=tqRLgOwmMQHDb1A84XbML9sWfzMymkSPhJjoF6aCH
 common_python_tasks/__main__.py,sha256=GpgSd_toMbEaWA_cZvgsZE7jo4XpzuI-awBVm2uhVyw,3512
 common_python_tasks/docker.py,sha256=_YW-hyHWlUK-kMCvI6QTgxSfmXQQKhYLOKRBPfUmtHA,24176
 common_python_tasks/docker_compose.py,sha256=NGgMei3oCYS0RbNaQXE-2veXFylO3XtZ7lU-PTtocik,21338
-common_python_tasks/env.py,sha256=1YLSxsUP9lPn51_zraM3nAiN1J7aKdUHzjzDzxXLo34,19696
+common_python_tasks/env.py,sha256=hSjWe8L1RXguLqIMh1IsgbkHa_64b1U8lBHqDIS3zko,21779
 common_python_tasks/git.py,sha256=0X472w_vHdtbrHHxCmJ85NoQjjogEEDs_0SRXfxbWi0,11719
 common_python_tasks/github.py,sha256=_LVanl-z4PsdLM94L8y7tkX-AZO2n3Qy39FRY7reDhA,21589
 common_python_tasks/project.py,sha256=PQ_GQicTrSQgVDB9cJ9E6pU0UhLPom2xou1sGFscr3E,17377
-common_python_tasks/tasks.py,sha256=Ajqw7mnfMwfiOdTuVGvGJQAp_DQxEnqDc9e8y3VFcT8,61636
+common_python_tasks/tasks.py,sha256=vMCFXZKo-0Dj1TLmZ3lo6oFCAhJSEp637qZWhaWOmpA,64199
 common_python_tasks/utils.py,sha256=hR7w0Cb7uQ7ILyIegTQ4znWHVoWANlCgxrOnO-Rh5oE,20798
 common_python_tasks/data/dockerfile_extensions/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+common_python_tasks/data/dockerfile_extensions/docker-in-docker/Dockerfile,sha256=m7jeQyFe6mAv8AVGpM89NHljzG21ctcSyllbvoEL0Do,1021
+common_python_tasks/data/dockerfile_extensions/docker-in-docker/install.sh,sha256=F87oojGFYT5F1mdcMchRNlUeI_viAO4ip04UHBC_8bQ,1224
+common_python_tasks/data/dockerfile_extensions/docker-in-docker/supervisor.sh,sha256=cqslPv9QPU4vtClvNSl2wyhEL0HubxO5YqAhwNfTEXA,3726
 common_python_tasks/data/fastapi/alembic.ini.j2,sha256=dOiAmZngzX6eyVXeM6BhzgQmes2zwUEdKwOgm8mxjMs,985
 common_python_tasks/data/fastapi/compose-base.yml.j2,sha256=vDLPAdRJ66lsWZdsKbYqEvY_liXaHZ0ly4ljzqmJsyY,910
 common_python_tasks/data/fastapi/compose-db-debug.yml.j2,sha256=iREdSy4F8tJ5m9rlB6CROBkj9OtDFVuGphqIuDvHhww,1193
@@ -17,11 +20,11 @@ common_python_tasks/data/fastapi/compose-debug.yml.j2,sha256=sIH9IFvmRAszN6wSejp
 common_python_tasks/data/generic/.coveragerc,sha256=8zXwDq18wIKQV4NtW2NJYpo3nxCO4LsAChyluYTUoJc,85
 common_python_tasks/data/generic/.dockerignore,sha256=8kHwNa6Ct-6y3EvRjNuhOKfquuGEywq3P2BHIbG4uXo,53
 common_python_tasks/data/generic/Dockerfile.deps.j2,sha256=fBmcytyUd4LsC26y0IgZ09QPxrFp0gx0d3OlKNqZ-KM,663
-common_python_tasks/data/generic/Dockerfile.j2,sha256=hgLrIRU5xvS2xqw9Xm4kfkcBGHH-mghFPlWv3KSNaz4,6223
+common_python_tasks/data/generic/Dockerfile.j2,sha256=UrR9T794V2ESNIkSVE7K5vEbx43NQiddfsWKG_bY6b4,6301
 common_python_tasks/data/generic/cliff.toml,sha256=po1MnEGEEgrpyBz3XLWr0h7emXb6ASX63lrU2r6o240,77
 common_python_tasks/data/generic/pytest.ini,sha256=RHak5QrLzKHvUBjFmaaiOYFrd_8YBRQubXEOT0NJfco,134
 common_python_tasks/data/generic/ruff.toml,sha256=njvd-5inSGmgY865SWCT4SR9IrKlzS7JQFZmAG2UT_E,53
-common_python_tasks-0.11.0.dist-info/METADATA,sha256=00ugE5R39fK6NpEH2LDIaUm87vNhxC2jVTGoa_FI4aI,3307
-common_python_tasks-0.11.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-common_python_tasks-0.11.0.dist-info/licenses/LICENSE,sha256=RsSweM-DyzxFPx38fQOJqHrKyeT9Fiz8rO7yox-fOsw,1070
-common_python_tasks-0.11.0.dist-info/RECORD,,
+common_python_tasks-0.12.0.dist-info/METADATA,sha256=iAVWGja53RQz1tWWMtn5szBCGveET5EDvwI_ltczz2A,3307
+common_python_tasks-0.12.0.dist-info/WHEEL,sha256=THafob7ofN-NsuMN7Mg4qZyHaQI7KkD-QlcQatYhXPo,87
+common_python_tasks-0.12.0.dist-info/licenses/LICENSE,sha256=RsSweM-DyzxFPx38fQOJqHrKyeT9Fiz8rO7yox-fOsw,1070
+common_python_tasks-0.12.0.dist-info/RECORD,,

{common_python_tasks-0.11.0.dist-info → common_python_tasks-0.12.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.0
+Generator: hatchling 1.32.3
 Root-Is-Purelib: true
 Tag: py3-none-any