common-python-tasks 0.11.0__tar.gz → 0.12.0__tar.gz

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: common-python-tasks
-Version: 0.11.0
+Version: 0.12.0
 Summary: Opinionated Poe the Poet tasks for Python package development.
 Project-URL: Homepage, http://github.com/ci-sourcerer/common-python-tasks
 Project-URL: Source, http://github.com/ci-sourcerer/common-python-tasks.git
@@ -42,7 +42,7 @@ Read the [complete documentation](https://ci-sourcerer.github.io/common-python-t
 Add the package as a development dependency.
 
 ```shell
-uv add --dev common-python-tasks==0.11.0
+uv add --dev common-python-tasks==0.12.0
 ```
 
 Expose the default task set in `pyproject.toml`.

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/README.md

@@ -9,7 +9,7 @@ Read the [complete documentation](https://ci-sourcerer.github.io/common-python-t
 Add the package as a development dependency.
 
 ```shell
-uv add --dev common-python-tasks==0.11.0
+uv add --dev common-python-tasks==0.12.0
 ```
 
 Expose the default task set in `pyproject.toml`.

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/docs/configuration.md

@@ -44,7 +44,8 @@ Container variables are read by the host-side tasks unless their description exp
 | `CONTAINER_APT_PACKAGES` | Space-delimited APT packages installed in the runtime stage |
 | `CONTAINER_CUSTOM_ENTRYPOINT` | `[project.scripts]` key selected as the image entrypoint command |
 | `CONTAINER_DOCKER_BUILD_ARGS` | Shell-tokenized arguments passed directly to `docker build`; task arguments after `--` take precedence |
-| `CONTAINER_DOCKERFILE_HOOK_PATH` | Executable host script that modifies the rendered Dockerfile before the build |
+| `CONTAINER_DOCKERFILE_PATH` | Project-owned application Dockerfile used by `build-image`, `build`, and `release` instead of the bundled template |
+| `CONTAINER_DOCKERFILE_HOOK_PATH` | Executable host script that modifies the selected Dockerfile before the build |
 | `CONTAINER_PRUNE_KEEP` | Prior images kept after a build; `-1` disables pruning, `0` keeps only the latest, and `N` keeps the latest plus `N` prior images |
 
 ### Environment and extension settings

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/docs/tasks/container-images.md

@@ -1,6 +1,6 @@
 # Container images
 
-Container tasks are selected with the optional `containers` tag. They generate a multi-stage Dockerfile from the project metadata and container settings, build the application wheel, and install it in a non-root runtime image. A consuming project does not need to maintain its own application Dockerfile.
+Container tasks are selected with the optional `containers` tag. By default, they generate a multi-stage Dockerfile from the project metadata and container settings, build the application wheel, and install it in a non-root runtime image. A project can instead select a complete application Dockerfile that it owns.
 
 ```toml
 [tool.poe]
@@ -77,7 +77,7 @@ COPY . /tmp/build/
 # Export debug requirements when the project defines a debug dependency group
 RUN --mount=type=cache,target=/root/.cache/uv,id=uv-cache{{ CACHE_ID_SUFFIX }}{% for mount in UV_INDEX_SECRET_MOUNTS %} \
     --mount={{ mount }}{% endfor %} \
-    uv export --group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
+    uv export --frozen --only-group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
 {% endif %}
 
 # Build the wheel, caching the uv cache directory to speed up subsequent builds.
@@ -172,10 +172,11 @@ LABEL git.commit=${GIT_COMMIT}
 # current package does not provide a console script, the entrypoint will default to `python`
 RUN echo "#!/bin/sh
 
-{{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
+exec {{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
     && chmod +x /pkg/entrypoint.sh
 
-USER py
+ARG RUNTIME_USER=py
+USER ${RUNTIME_USER}
 
 {% if EXTENSION_CONTENT %}
 {{ EXTENSION_CONTENT }}
@@ -193,13 +194,13 @@ COPY --from=builder /tmp/build /tmp/build
 
 RUN --mount=type=cache,target=/root/.cache/pip,id=pip-cache{{ CACHE_ID_SUFFIX }} pip install --root-user-action=ignore -r /tmp/build/requirements-debug.txt
 
-USER py
+USER ${RUNTIME_USER}
 {% endif %}
 
 # Final (default) image: explicitly use runtime as the final target so debug is not used unless requested
 FROM runtime AS final
 
-USER py
+USER ${RUNTIME_USER}
 ```
 
 ### Dependency image template
@@ -277,7 +278,28 @@ Do not use these declarations for secrets because their values persist in the im
 
 The `--env` and `--envfile` options on `run-container` and `container-shell` have ordinary `docker run` semantics. They affect only that container invocation and can override environment values embedded during the build.
 
-## Extending the runtime image
+## Using a project-owned Dockerfile
+
+Set `CONTAINER_DOCKERFILE_PATH` when a project owns its complete application Dockerfile. `build-image` and every aggregate task that invokes it, including `build` and `release`, use the same file instead of rendering the bundled template.
+
+```toml
+[tool.poe.env]
+CONTAINER_DOCKERFILE_PATH = "docker/Dockerfile"
+```
+
+The `--dockerfile-path` option overrides the environment setting for one invocation. The option is available on both the individual and aggregate tasks.
+
+```shell
+poe build-image --dockerfile-path docker/Dockerfile.ci
+poe build --dockerfile-path docker/Dockerfile.ci
+poe release --dockerfile-path docker/Dockerfile.release
+```
+
+The project root remains the Docker build context. Standard image naming, version and commit tags, metadata build arguments, `CONTAINER_DOCKER_BUILD_ARGS`, Dockerfile hooks, image pruning, and release-time image pushing continue to work. A normal custom build does not select a target stage, so the Dockerfile does not need the bundled `runtime` stage. A custom debug build selects a stage named `debug`.
+
+Settings that render content into the bundled template do not alter a project-owned Dockerfile. This includes `CONTAINER_APT_PACKAGES`, `CONTAINER_CUSTOM_ENTRYPOINT`, `CONTAINER_ENV`, extensions, and dependency-image mappings. Declare equivalent instructions in the project-owned Dockerfile when they are needed. BuildKit secrets derived from `UV_INDEX_*` credentials remain available as Docker build secrets, but the custom Dockerfile must mount them explicitly.
+
+## Extending the generated runtime image
 
 Use `CONTAINER_EXTENSION_FILES` to append project-owned Dockerfile fragments without replacing the generic Dockerfile. Its value is a colon-delimited list of paths, such as `Dockerfile.system:docker/Dockerfile.browser`.
 
@@ -289,23 +311,56 @@ RUN apt-get update \
 USER py
 ```
 
-Extension files are concatenated in their configured order and inserted near the end of `runtime`, after the entrypoint is created and after `USER py`. An extension that needs elevated permissions must switch to `USER root`; it should normally restore `USER py` for the instructions that follow. `COPY` paths remain relative to the project-root build context.
+Extension files are concatenated in their configured order and inserted near the end of `runtime`, after the entrypoint is created and after `USER ${RUNTIME_USER}` (which defaults to `py`). An extension that needs elevated permissions must switch to `USER root`; it should normally restore `USER ${RUNTIME_USER}` for the instructions that follow. Extensions that need to start as another user can redeclare `ARG RUNTIME_USER=root`; both the final and debug stages honor this argument. `COPY` paths remain relative to the project-root build context.
 
 Extension content is treated as raw Dockerfile syntax, not as a Jinja template. This keeps project extensions independent of private template variables used by `common-python-tasks`.
 
 `CONTAINER_EXTENSIONS` selects extension bundles shipped in the installed package's `data/dockerfile_extensions/` directory. Bundle names are colon-delimited and are applied after local extension files. A bundle may accept one value with `bundle=value`; that value is passed to the first `ARG` declared by the bundle that has not already been assigned to another extension. Arguments are ignored with a warning when the bundle declares no `ARG`.
 
-Use an extension for additive runtime instructions. Use `CONTAINER_DOCKERFILE_HOOK_PATH` only when a change must rewrite another part of the generated Dockerfile. The hook must be an executable host-side script; it receives the generated Dockerfile path as its first argument and must edit that file in place. The hook also receives the following context variables.
+A bundled extension can keep scripts and other supporting files beside its `Dockerfile`. The image builder exposes that directory as a BuildKit named context called `cpt-extension-<bundle-name>`, with unsupported characters normalized to hyphens. The bundle can copy an asset with `COPY --from=cpt-extension-example script.sh /usr/local/bin/script` without embedding it in a heredoc. These managed contexts are added only to the application image build.
+
+Use an extension for additive runtime instructions. Use `CONTAINER_DOCKERFILE_HOOK_PATH` only when a change must rewrite another part of the selected Dockerfile. The hook must be an executable host-side script; it receives a temporary copy of the selected Dockerfile as its first argument and must edit that file in place. The hook also receives the following context variables.
 
 | Variable | Meaning |
 | - | - |
-| `COMMON_PYTHON_TASKS_DOCKERFILE_PATH` | Generated Dockerfile path, matching the first script argument |
+| `COMMON_PYTHON_TASKS_DOCKERFILE_PATH` | Temporary selected Dockerfile path, matching the first script argument |
 | `COMMON_PYTHON_TASKS_DOCKER_CONTEXT` | Docker build context path |
 | `COMMON_PYTHON_TASKS_DOCKER_DEBUG` | `1` for a debug build, otherwise `0` |
 | `COMMON_PYTHON_TASKS_DOCKER_NO_CACHE` | `1` when `--no-cache` is active, otherwise `0` |
 | `COMMON_PYTHON_TASKS_DOCKER_PLAIN` | `1` when plain progress output is active, otherwise `0` |
 | `COMMON_PYTHON_TASKS_DOCKER_SINGLE_ARCH` | `1` for a single-architecture build, otherwise `0` |
 
+### Docker-in-Docker
+
+The bundled `docker-in-docker` extension installs Docker CE, containerd, Buildx, and Compose from Docker's signed APT repository. Its installation and supervisor scripts are separate packaged files copied through the extension's named build context; image builds do not download scripts from the devcontainer feature repository.
+
+Initial support is limited to Debian Bookworm variants (`slim-bookworm` and `bookworm`) on `amd64` and `arm64`. The extension checks the actual distribution and architecture during the build and rejects everything else, including Alpine and Trixie. Select extensions independently for each image build; other images do not need to enable Docker-in-Docker.
+
+```sh
+CONTAINER_PYTHON_VARIANT=slim-bookworm \
+    CONTAINER_EXTENSIONS=docker-in-docker poe build-image
+poe run-container --privileged
+```
+
+The image starts as root through Tini and the DinD supervisor. The supervisor prepares nested cgroups, starts a dedicated Docker daemon, and waits for `docker info` to succeed before launching the existing `/pkg/entrypoint.sh` as `py`. Application arguments and exit status are preserved. Signals reach the application, and shutdown stops the application before stopping Docker. Startup failure or loss of the daemon terminates the container with a nonzero status. `DIND_STARTUP_TIMEOUT` controls the readiness deadline in seconds (default `60`, accepted range `1`–`9999`). Each process group gets up to five seconds to stop before being killed; allow more than ten seconds for the outer container's stop timeout.
+
+Docker listens only on `unix:///var/run/docker.sock`. The image sets `DOCKER_HOST` accordingly, and startup clears Docker context and TLS environment overrides so the application uses its own daemon. Do not mount the host Docker socket. The `py` user belongs to the Docker group and can control the nested daemon; this is a privileged container, not a sandbox for untrusted workloads.
+
+The image declares volumes for `/var/lib/docker` and `/var/lib/containerd`. Docker creates anonymous volumes automatically. Use dedicated named volumes when state should survive container replacement, and never share them between concurrently running daemons. For example, when launching the built image directly, replace `your-image:tag` with its tag.
+
+```sh
+docker run --rm --privileged --stop-timeout 20 \
+    --mount source=my-app-docker,target=/var/lib/docker \
+    --mount source=my-app-containerd,target=/var/lib/containerd \
+    your-image:tag
+```
+
+For Compose, set `privileged: true`, `stop_grace_period: 20s`, and the equivalent volume mounts on the application service. Keep the image's entrypoint and startup user. `container-shell` and an explicit `--entrypoint` override bypass DinD startup; to inspect a running DinD container, use `docker exec -it --user py <container> sh`.
+
+By default, the build installs the current stable packages available in Docker's repository. An optional bundle value pins the exact Docker Engine and CLI APT version. Include literal quotes around the version inside `CONTAINER_EXTENSIONS` so its epoch colon is not parsed as an extension separator. For example, `CONTAINER_EXTENSIONS='docker-in-docker="5:29.8.1-1~debian.12~bookworm"'` selects that version if available. This pins only Engine and CLI; containerd and CLI plugins still use the repository's current versions.
+
+Maintainers can run the opt-in integration tests with `CPT_DIND_INTEGRATION=1 poe test tests/test_docker_in_docker.py`. These tests require a running Docker daemon, privileged Linux containers, and network access for image and package downloads. They build the actual generated application Dockerfile and remove their test images, containers, and anonymous volumes afterward.
+
 ## Supplying external dependencies
 
 Dependency images support artifacts that should be built separately from the application wheel, such as compiled tools or browser binaries. The dependency image must place its exported content under `/tmp/deps`; the generated application Dockerfile copies that directory into its `runtime` stage.
@@ -344,7 +399,7 @@ See [Container settings](../configuration.md#container-settings) for the complet
 
 | Task | Description |
 | - | - |
-| [`build-image`](reference/build-image.md) | Build the container image for this project using the Dockerfile template. |
+| [`build-image`](reference/build-image.md) | Build the container image using a project-owned or bundled Dockerfile. |
 | [`build-deps-image`](reference/build-deps-image.md) | Build only the container dependency collector image for this project. |
 | [`run-container`](reference/run-container.md) | Run the Docker image as a container for this project. |
 | [`push-image`](reference/push-image.md) | Push the Docker image for this project to the container registry. |

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/docs/tasks/reference/build-image.md

@@ -1,6 +1,6 @@
 # `poe build-image`
 
-Build the container image for this project using the Dockerfile template.
+Build the container image using a project-owned or bundled Dockerfile.
 
 **Category:** [`container-images`](../container-images.md)
 
@@ -9,7 +9,7 @@ Build the container image for this project using the Dockerfile template.
 ## Usage
 
 ```shell
-poe build-image [DOCKER_BUILD_ARGS...] [--debug] [--no-cache] [--plain] [--single-arch] [--dockerfile-hook-path DOCKERFILE_HOOK_PATH] [--container-env CONTAINER_ENV...] [--container-envfile CONTAINER_ENVFILE...]
+poe build-image [DOCKER_BUILD_ARGS...] [--debug] [--no-cache] [--plain] [--single-arch] [--dockerfile-path DOCKERFILE_PATH] [--dockerfile-hook-path DOCKERFILE_HOOK_PATH] [--container-env CONTAINER_ENV...] [--container-envfile CONTAINER_ENVFILE...]
 ```
 
 ## Arguments
@@ -21,6 +21,7 @@ poe build-image [DOCKER_BUILD_ARGS...] [--debug] [--no-cache] [--plain] [--singl
 | `--no-cache` | `boolean` | Do not use cache when building the image. | `false` |
 | `--plain` | `boolean` | Do not pretty-print output. | `false` |
 | `--single-arch` | `boolean` | Build images for a single architecture. | `false` |
-| `--dockerfile-hook-path` | `string` | Optional executable script path that can mutate the generated Dockerfile before build. Overrides CONTAINER_DOCKERFILE_HOOK_PATH if provided. | — |
+| `--dockerfile-path` | `string` | Optional project-owned Dockerfile. Overrides CONTAINER_DOCKERFILE_PATH if provided. | — |
+| `--dockerfile-hook-path` | `string` | Optional executable script path that can mutate the selected Dockerfile before build. Overrides CONTAINER_DOCKERFILE_HOOK_PATH if provided. | — |
 | `--container-env` | `string, repeatable` | Builder and runtime environment declarations as repeated KEY=VALUE values. | — |
 | `--container-envfile` | `string, repeatable` | Optional repeated list of files containing builder and runtime environment declarations. | — |

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/docs/tasks/reference/build.md

@@ -9,7 +9,7 @@ Build the project and its containers.
 ## Usage
 
 ```shell
-poe build [--debug] [--no-cache] [--plain] [--single-arch] [--container-env CONTAINER_ENV...] [--container-envfile CONTAINER_ENVFILE...]
+poe build [--debug] [--no-cache] [--plain] [--single-arch] [--dockerfile-path DOCKERFILE_PATH] [--container-env CONTAINER_ENV...] [--container-envfile CONTAINER_ENVFILE...]
 ```
 
 ## Arguments
@@ -20,5 +20,6 @@ poe build [--debug] [--no-cache] [--plain] [--single-arch] [--container-env CONT
 | `--no-cache` | `boolean` | Do not use cache when building the image. | `false` |
 | `--plain` | `boolean` | Do not pretty-print output. | `false` |
 | `--single-arch` | `boolean` | Build images for a single architecture. | `false` |
+| `--dockerfile-path` | `string` | Optional project-owned Dockerfile used for the image build. Overrides CONTAINER_DOCKERFILE_PATH if provided. | — |
 | `--container-env` | `string, repeatable` | Inline container environment variables as repeated KEY=VALUE values. | — |
 | `--container-envfile` | `string, repeatable` | Repeated list of container environment files. | — |

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/docs/tasks/reference/release.md

@@ -9,7 +9,7 @@ Run a full release flow for package and containers.
 ## Usage
 
 ```shell
-poe release [--component COMPONENT] [--stage STAGE] [--dry-run] [--debug] [--no-cache] [--plain] [--single-arch] [--container-env CONTAINER_ENV...] [--container-envfile CONTAINER_ENVFILE...] [--assets ASSETS...] [--repository REPOSITORY] [--repository-url REPOSITORY_URL] [--pre-script PRE_SCRIPT] [--post-script POST_SCRIPT]
+poe release [--component COMPONENT] [--stage STAGE] [--dry-run] [--debug] [--no-cache] [--plain] [--single-arch] [--dockerfile-path DOCKERFILE_PATH] [--container-env CONTAINER_ENV...] [--container-envfile CONTAINER_ENVFILE...] [--assets ASSETS...] [--repository REPOSITORY] [--repository-url REPOSITORY_URL] [--pre-script PRE_SCRIPT] [--post-script POST_SCRIPT]
 ```
 
 ## Arguments
@@ -23,6 +23,7 @@ poe release [--component COMPONENT] [--stage STAGE] [--dry-run] [--debug] [--no-
 | `--no-cache` | `boolean` | Do not use cache when building container images. | `false` |
 | `--plain` | `boolean` | Do not pretty-print container build output. | `false` |
 | `--single-arch` | `boolean` | Build container image for a single architecture. | `false` |
+| `--dockerfile-path` | `string` | Optional project-owned Dockerfile used for the image build. Overrides CONTAINER_DOCKERFILE_PATH if provided. | — |
 | `--container-env` | `string, repeatable` | Inline container environment variables as repeated KEY=VALUE values. | — |
 | `--container-envfile` | `string, repeatable` | Repeated list of container environment files. | — |
 | `--assets` | `string, repeatable` | Optional repeated list of release asset patterns or paths. | — |

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/scripts/docs_tasks_reference.py

@@ -111,46 +111,6 @@ def _escape_table_text(value: str) -> str:
     return value.replace("|", "\\|")
 
 
-def _render_task_full(task_name: str) -> list[str]:
-    task_config = _get_task_config(task_name)
-    arguments = task_config.get("args", [])
-    lines = [
-        f"## `{task_name}`",
-        "",
-        task_config.get("help", "No description is available."),
-        "",
-        f"**Tags:** {', '.join(f'`{tag}`' for tag in get_task_tags(task_name) or [])}",
-        "",
-        "```shell",
-        " ".join(
-            [f"poe {task_name}", *[_format_usage_argument(arg) for arg in arguments]]
-        ),
-        "```",
-    ]
-    if not arguments:
-        return lines
-
-    docstring_help = _get_docstring_argument_help(task_config)
-    lines.extend(
-        [
-            "",
-            "### Arguments",
-            "",
-            "| Argument | Type | Description | Default |",
-            "| - | - | - | - |",
-        ]
-    )
-    lines.extend(
-        "| "
-        f"{_format_argument_name(argument)} | "
-        f"{_format_argument_type(argument)} | "
-        f"{_escape_table_text(argument.get('help') or docstring_help.get(argument['name'], 'Additional value passed to the task.'))} | "
-        f"{_format_default(argument)} |"
-        for argument in arguments
-    )
-    return lines
-
-
 def build_task_reference(category: str) -> str:
     """Build the generated Markdown reference for a task category (link table).
 

common_python_tasks-0.12.0/src/common_python_tasks/data/dockerfile_extensions/docker-in-docker/Dockerfile

@@ -0,0 +1,27 @@
+# Docker-in-Docker currently supports Debian Bookworm on amd64 and arm64.
+USER root
+
+# Optional exact APT version, including the epoch and distribution suffix.
+ARG DIND_DOCKER_VERSION
+
+COPY --from=cpt-extension-docker-in-docker --chmod=0755 install.sh \
+    /usr/local/share/cpt-dind-install.sh
+RUN /usr/local/share/cpt-dind-install.sh \
+    && rm /usr/local/share/cpt-dind-install.sh
+
+COPY --from=cpt-extension-docker-in-docker --chmod=0755 supervisor.sh \
+    /usr/local/bin/cpt-dind-supervisor
+
+RUN mv /pkg/entrypoint.sh /pkg/application-entrypoint.sh \
+    && printf '%s\n' '#!/bin/sh' \
+        'exec /usr/bin/tini -- /usr/local/bin/cpt-dind-supervisor "$@"' \
+        >/pkg/entrypoint.sh \
+    && chmod 0755 /pkg/entrypoint.sh
+
+ENV DOCKER_HOST=unix:///var/run/docker.sock
+VOLUME ["/var/lib/docker", "/var/lib/containerd"]
+
+# The generic final and debug stages inherit this startup-user selection.
+# The wrapper drops to py only for the application, after Docker is ready.
+ARG RUNTIME_USER=root
+USER ${RUNTIME_USER}

common_python_tasks-0.12.0/src/common_python_tasks/data/dockerfile_extensions/docker-in-docker/install.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+set -eu
+
+# shellcheck source=/dev/null
+. /etc/os-release
+if [ "$ID" != debian ] || [ "${VERSION_CODENAME:-}" != bookworm ]; then
+    echo >&2 'docker-in-docker requires Debian Bookworm; use slim-bookworm.'
+    exit 1
+fi
+case "$(dpkg --print-architecture)" in
+    amd64 | arm64) ;;
+    *)
+        echo >&2 'docker-in-docker supports amd64 and arm64 only.'
+        exit 1
+        ;;
+esac
+
+apt-get update
+apt-get install -y --no-install-recommends \
+    bash ca-certificates curl iptables tini util-linux
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg \
+    -o /etc/apt/keyrings/docker.asc
+chmod 0644 /etc/apt/keyrings/docker.asc
+cat >/etc/apt/sources.list.d/docker.sources <<SOURCES
+Types: deb
+URIs: https://download.docker.com/linux/debian
+Suites: bookworm
+Components: stable
+Architectures: $(dpkg --print-architecture)
+Signed-By: /etc/apt/keyrings/docker.asc
+SOURCES
+apt-get update
+apt-get install -y --no-install-recommends \
+    "docker-ce${DIND_DOCKER_VERSION:+=$DIND_DOCKER_VERSION}" \
+    "docker-ce-cli${DIND_DOCKER_VERSION:+=$DIND_DOCKER_VERSION}" \
+    containerd.io docker-buildx-plugin docker-compose-plugin
+usermod -aG docker py
+rm -rf /var/lib/apt/lists/*

common_python_tasks-0.12.0/src/common_python_tasks/data/dockerfile_extensions/docker-in-docker/supervisor.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+set -euo pipefail
+
+_prepare_host() {
+    if [[ $(id -u) != 0 ]]; then
+        echo >&2 'docker-in-docker must start as root with --privileged.'
+        return 1
+    fi
+    if [[ ! -w /sys/fs/cgroup ]]; then
+        echo >&2 'docker-in-docker needs writable cgroups; use --privileged.'
+        return 1
+    fi
+    if [[ -d /sys/kernel/security ]] &&
+        ! mountpoint -q /sys/kernel/security; then
+        mount -t securityfs none /sys/kernel/security
+    fi
+    _prepare_cgroups
+    if ! iptables -nL >/dev/null 2>&1 &&
+        iptables-legacy -nL >/dev/null 2>&1; then
+        update-alternatives --set iptables /usr/sbin/iptables-legacy
+        update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+    fi
+    # Only remove our daemon's PID file, never unrelated processes' files.
+    rm -f /var/run/docker.pid
+}
+
+_prepare_cgroups() {
+    [[ -f /sys/fs/cgroup/cgroup.controllers ]] || return 0
+    mkdir -p /sys/fs/cgroup/cpt-init
+    local attempt pid controllers
+    for ((attempt = 0; attempt < 5; attempt++)); do
+        while read -r pid; do
+            # Processes can disappear or become immovable while we move them.
+            printf '%s\n' "$pid" | tee \
+                /sys/fs/cgroup/cpt-init/cgroup.procs >/dev/null 2>&1 || true
+        done </sys/fs/cgroup/cgroup.procs
+        controllers=$(sed 's/[^ ]\+/+&/g' \
+            /sys/fs/cgroup/cgroup.controllers)
+        if printf '%s\n' "$controllers" | tee \
+            /sys/fs/cgroup/cgroup.subtree_control >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.1
+    done
+    echo >&2 'docker-in-docker could not enable nested cgroups.'
+    return 1
+}
+
+_stop_group() {
+    local pid=$1
+    [[ -n "$pid" ]] || return 0
+    kill -TERM -- "-$pid" 2>/dev/null || true
+    local attempt
+    for ((attempt = 0; attempt < 50; attempt++)); do
+        kill -0 -- "-$pid" 2>/dev/null || break
+        sleep 0.1
+    done
+    kill -KILL -- "-$pid" 2>/dev/null || true
+    wait "$pid" 2>/dev/null || true
+}
+
+_shutdown() {
+    trap '' TERM INT
+    _stop_group "$app_pid"
+    _stop_group "$daemon_pid"
+}
+
+_wait_for_docker() {
+    local deadline=$((SECONDS + DIND_STARTUP_TIMEOUT))
+    while ((SECONDS < deadline)); do
+        if ! kill -0 "$daemon_pid" 2>/dev/null; then
+            echo >&2 'docker-in-docker daemon exited during startup.'
+            return 1
+        fi
+        if timeout 1 docker --host "$DOCKER_HOST" info >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.2
+    done
+    echo >&2 'docker-in-docker timed out waiting for the daemon.'
+    return 1
+}
+
+_main() {
+    if [[ ! ${DIND_STARTUP_TIMEOUT:-60} =~ ^[1-9][0-9]{0,3}$ ]]; then
+        echo >&2 'DIND_STARTUP_TIMEOUT must be an integer from 1 to 9999.'
+        return 1
+    fi
+    export DIND_STARTUP_TIMEOUT=${DIND_STARTUP_TIMEOUT:-60}
+    export DOCKER_HOST=unix:///var/run/docker.sock
+    export container=docker
+    unset DOCKER_CONTEXT DOCKER_TLS_VERIFY DOCKER_CERT_PATH
+    _prepare_host
+    daemon_pid=''
+    app_pid=''
+    trap _shutdown EXIT
+    trap 'exit 143' TERM
+    trap 'exit 130' INT
+    # Keep daemon logs on stderr and expose only the local Unix socket.
+    setsid dockerd --host "$DOCKER_HOST" --group docker >&2 &
+    daemon_pid=$!
+    _wait_for_docker
+    setsid setpriv --reuid py --regid py --init-groups \
+        env HOME="$(getent passwd py | cut -d: -f6)" USER=py LOGNAME=py \
+        /pkg/application-entrypoint.sh "$@" &
+    app_pid=$!
+    local finished status=0
+    wait -n -p finished "$daemon_pid" "$app_pid" || status=$?
+    if [[ "$finished" == "$daemon_pid" ]]; then
+        echo >&2 'docker-in-docker daemon exited while the app was running.'
+        return 1
+    fi
+    return "$status"
+}
+
+_main "$@"

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/src/common_python_tasks/data/generic/Dockerfile.j2

@@ -40,7 +40,7 @@ COPY . /tmp/build/
 # Export debug requirements when the project defines a debug dependency group
 RUN --mount=type=cache,target=/root/.cache/uv,id=uv-cache{{ CACHE_ID_SUFFIX }}{% for mount in UV_INDEX_SECRET_MOUNTS %} \
     --mount={{ mount }}{% endfor %} \
-    uv export --group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
+    uv export --frozen --only-group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
 {% endif %}
 
 # Build the wheel, caching the uv cache directory to speed up subsequent builds.
@@ -133,10 +133,11 @@ LABEL git.commit=${GIT_COMMIT}
 # This entrypoint is deliberately not configurable via environment variables in order to
 # ensure that the container always uses the entrypoint selected at build time. If the
 # current package does not provide a console script, the entrypoint will default to `python`
-RUN echo "#!/bin/sh\n\n{{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
+RUN echo "#!/bin/sh\n\nexec {{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
     && chmod +x /pkg/entrypoint.sh
 
-USER py
+ARG RUNTIME_USER=py
+USER ${RUNTIME_USER}
 
 {% if EXTENSION_CONTENT %}
 {{ EXTENSION_CONTENT }}
@@ -154,10 +155,10 @@ COPY --from=builder /tmp/build /tmp/build
 
 RUN --mount=type=cache,target=/root/.cache/pip,id=pip-cache{{ CACHE_ID_SUFFIX }} pip install --root-user-action=ignore -r /tmp/build/requirements-debug.txt
 
-USER py
+USER ${RUNTIME_USER}
 {% endif %}
 
 # Final (default) image: explicitly use runtime as the final target so debug is not used unless requested
 FROM runtime AS final
 
-USER py
+USER ${RUNTIME_USER}

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/src/common_python_tasks/env.py

@@ -3,6 +3,7 @@ import os
 import re
 import secrets
 import shlex
+from collections.abc import Iterator
 from pathlib import Path
 
 from . import utils
@@ -53,51 +54,47 @@ def collect_uv_index_credentials() -> list[dict[str, str | None]]:
     ]
 
 
+def _iter_uv_index_secrets(
+    credentials: list[dict[str, str | None]],
+) -> Iterator[tuple[str, str]]:
+    for credential in credentials:
+        index_name = credential["index_name"].lower()
+        for credential_type in ("username", "password"):
+            environment_name = credential[f"{credential_type}_env"]
+            if environment_name:
+                yield f"uv_index_{index_name}_{credential_type}", environment_name
+
+
 def uv_index_secret_mounts(credentials: list[dict[str, str | None]]) -> list[str]:
-    """Return Dockerfile ``--mount`` strings for UV index credentials.
+    """Return Dockerfile `--mount` strings for UV index credentials.
 
     Args:
         credentials: Output of `collect_uv_index_credentials`.
 
     Returns:
-        A list of ``type=secret,...`` strings for Dockerfile ``RUN --mount=``
+        A list of `type=secret,...` strings for Dockerfile `RUN --mount=`
         directives.
     """
-    mounts = []
-    for cred in credentials:
-        name = cred["index_name"].lower()
-        if cred["username_env"]:
-            mounts.append(
-                f"type=secret,id=uv_index_{name}_username,env={cred['username_env']}"
-            )
-        if cred["password_env"]:
-            mounts.append(
-                f"type=secret,id=uv_index_{name}_password,env={cred['password_env']}"
-            )
-    return mounts
+    return [
+        f"type=secret,id={secret_id},env={environment_name}"
+        for secret_id, environment_name in _iter_uv_index_secrets(credentials)
+    ]
 
 
 def uv_index_secret_build_args(credentials: list[dict[str, str | None]]) -> list[str]:
-    """Return ``docker build --secret`` arg pairs for UV index credentials.
+    """Return `docker build --secret` arg pairs for UV index credentials.
 
     Args:
         credentials: Output of `collect_uv_index_credentials`.
 
     Returns:
-        A flat list of ``--secret`` flag-value pairs for the docker build command.
+        A flat list of `--secret` flag-value pairs for the docker build command.
     """
-    args = []
-    for cred in credentials:
-        name = cred["index_name"].lower()
-        if cred["username_env"]:
-            args.extend(
-                ["--secret", f"id=uv_index_{name}_username,env={cred['username_env']}"]
-            )
-        if cred["password_env"]:
-            args.extend(
-                ["--secret", f"id=uv_index_{name}_password,env={cred['password_env']}"]
-            )
-    return args
+    return [
+        item
+        for secret_id, environment_name in _iter_uv_index_secrets(credentials)
+        for item in ("--secret", f"id={secret_id},env={environment_name}")
+    ]
 
 
 def env_truthy(env_var: str) -> bool:
@@ -230,6 +227,40 @@ def resolve_extension_content(descriptor: dict[str, str | None]) -> str:
     utils.fatal(f"Unknown extension descriptor source: {descriptor['source']}")
 
 
+def resolve_extension_build_context(
+    descriptor: dict[str, str | None],
+) -> tuple[str, Path] | None:
+    """Return the named build context for a bundled extension's asset directory.
+
+    Args:
+        descriptor: Extension descriptor dictionary containing `source` and
+            `bundle_name` values.
+
+    Returns:
+        A Docker build-context name and its directory, or `None` when the
+        extension has no packaged assets.
+    """
+    if descriptor["source"] != "bundle":
+        return None
+    bundle_name = descriptor["bundle_name"]
+    out = utils.load_data_file(
+        f"{bundle_name}/Dockerfile",
+        type_identifier="dockerfile_extensions",
+        fatal_on_missing=False,
+    )
+    if out is None:
+        utils.fatal(f"Extension bundle not found: {bundle_name}")
+    bundle_directory = out[0].parent
+    if not bundle_directory.is_dir() or not any(
+        path.name != "Dockerfile" for path in bundle_directory.iterdir()
+    ):
+        return None
+    return (
+        f"cpt-extension-{re.sub(r'[^a-z0-9]+', '-', bundle_name.lower()).strip('-')}",
+        bundle_directory,
+    )
+
+
 def get_cache_id_suffix(no_cache: bool) -> str:
     """Return a cache-break suffix for Docker cache mount IDs.
     Args:
@@ -330,6 +361,28 @@ def resolve_container_docker_build_args(
         utils.fatal(f"Invalid CONTAINER_DOCKER_BUILD_ARGS: {error}")
 
 
+def _resolve_optional_file_path(
+    cli_path: str | None,
+    environment_path: str | None,
+    description: str,
+) -> Path | None:
+    resolved_path = next(
+        (
+            Path(value.strip())
+            for value in (cli_path, environment_path)
+            if value and value.strip()
+        ),
+        None,
+    )
+    if resolved_path is None:
+        return None
+    if not resolved_path.exists():
+        utils.fatal(f"{description} not found: {resolved_path}")
+    if not resolved_path.is_file():
+        utils.fatal(f"{description} is not a file: {resolved_path}")
+    return resolved_path
+
+
 def resolve_container_dockerfile_hook_path(
     cli_hook_path: str | None, env_hook_path: str | None
 ) -> Path | None:
@@ -342,17 +395,13 @@ def resolve_container_dockerfile_hook_path(
     Returns:
         The validated hook path, or `None` when unset.
     """
-    raw_value = (
-        cli_hook_path if cli_hook_path and cli_hook_path.strip() else env_hook_path
+    hook_path = _resolve_optional_file_path(
+        cli_hook_path,
+        env_hook_path,
+        "Dockerfile hook script",
     )
-    if raw_value is None or not raw_value.strip():
+    if hook_path is None:
         return None
-
-    hook_path = Path(raw_value.strip())
-    if not hook_path.exists():
-        utils.fatal(f"Dockerfile hook script not found: {hook_path}")
-    if not hook_path.is_file():
-        utils.fatal(f"Dockerfile hook path is not a file: {hook_path}")
     if not os.access(hook_path, os.X_OK):
         utils.fatal(f"Dockerfile hook script must be executable: {hook_path}")
 
@@ -594,6 +643,28 @@ def get_container_deps_move_script() -> str | None:
     return inline_script if inline_script else None
 
 
+def resolve_container_dockerfile_path(
+    dockerfile_path: str | None,
+    environment_dockerfile_path: str | None,
+) -> Path | None:
+    """Resolve and validate a project-owned application Dockerfile.
+
+    Args:
+        dockerfile_path: Dockerfile path supplied directly to a task.
+        environment_dockerfile_path: Dockerfile path supplied through the
+            environment.
+
+    Returns:
+        The configured Dockerfile path, or `None` when the bundled template
+        should be used.
+    """
+    return _resolve_optional_file_path(
+        dockerfile_path,
+        environment_dockerfile_path,
+        "Container Dockerfile",
+    )
+
+
 def get_prune_keep() -> int:
     """Return the integer value of CONTAINER_PRUNE_KEEP.
 

{common_python_tasks-0.11.0 → common_python_tasks-0.12.0}/src/common_python_tasks/tasks.py

@@ -70,6 +70,28 @@ class _ContainerBuild(NamedTuple):
     commit_tag: str
 
 
+def _prune_container_images(version_tag: str, commit_tag: str) -> None:
+    from .docker import prune_images_keep
+    from .env import get_prune_keep
+    from .utils import get_full_image_name, get_package_name
+
+    keep = get_prune_keep()
+    if keep < 0:
+        return
+
+    LOGGER.debug(
+        "Pruning old images; keeping %d and protecting tags: %s",
+        keep,
+        [version_tag, commit_tag],
+    )
+    prune_images_keep(
+        get_full_image_name(),
+        get_package_name(),
+        keep,
+        protect_tags=[version_tag, commit_tag],
+    )
+
+
 def _make_var_positional_task_args_optional(
     func: callable, resolved_task_name: str
 ) -> None:
@@ -367,11 +389,19 @@ def clean(dist_only: bool = False) -> None:
         return
     else:
         to_clean = [
-            *[Path(p) for p in [".pytest_cache", "dist", ".mypy_cache"]],
+            *[
+                Path(p)
+                for p in [
+                    ".pytest_cache",
+                    "dist",
+                    ".mypy_cache",
+                    ".coverage",
+                    "coverage.xml",
+                    ".ruff_cache",
+                ]
+            ],
             *Path(".").rglob("__pycache__"),
             *Path(".").rglob("*.pyc"),
-            Path(".coverage"),
-            Path("coverage.xml"),
         ]
 
     for item in to_clean:
@@ -465,11 +495,12 @@ def build_image(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     dockerfile_hook_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
 ) -> _ContainerBuild:
-    """Build the container image for this project using the Dockerfile template.
+    """Build the container image using a project-owned or bundled Dockerfile.
 
     Args:
         *docker_build_args: Additional arguments passed directly to `docker build`.
@@ -479,8 +510,10 @@ def build_image(
         no_cache: Do not use cache when building the image.
         plain: Do not pretty-print output.
         single_arch: Build images for a single architecture.
+        dockerfile_path: Optional project-owned Dockerfile. Overrides
+            CONTAINER_DOCKERFILE_PATH if provided.
         dockerfile_hook_path: Optional executable script path that can mutate
-            the generated Dockerfile before build. Overrides
+            the selected Dockerfile before build. Overrides
             CONTAINER_DOCKERFILE_HOOK_PATH if provided.
         container_env: Builder and runtime environment declarations as repeated
             KEY=VALUE values.
@@ -494,14 +527,10 @@ def build_image(
         The generated Dockerfile text and image tags.
     """
     from .docker import build_image as _build_image
-    from .docker import (
-        prune_images_keep,
-    )
     from .env import (
         collect_uv_index_credentials,
         get_cache_id_suffix,
         get_container_deps_move_script,
-        get_prune_keep,
         get_python_variant,
         inject_auto_build_args_from_env,
         load_container_env_tokens,
@@ -511,6 +540,8 @@ def build_image(
         render_container_deps_move_script,
         resolve_container_docker_build_args,
         resolve_container_dockerfile_hook_path,
+        resolve_container_dockerfile_path,
+        resolve_extension_build_context,
         resolve_extension_content,
         uv_index_secret_build_args,
         uv_index_secret_mounts,
@@ -521,14 +552,17 @@ def build_image(
     )
     from .utils import (
         fatal,
-        get_full_image_name,
-        get_package_name,
         load_data_file,
         render_template_text,
     )
 
+    resolved_dockerfile_path = resolve_container_dockerfile_path(
+        dockerfile_path,
+        os.getenv("CONTAINER_DOCKERFILE_PATH"),
+    )
+
     # Determine extensions up-front so we can log a single, accurate message
-    extensions = parse_container_extensions()
+    extensions = [] if resolved_dockerfile_path else parse_container_extensions()
     extension_ids = [desc.get("id") for desc in extensions if desc.get("id")]
     if extension_ids:
         LOGGER.info("Building image (with extensions: %s)", ", ".join(extension_ids))
@@ -538,6 +572,11 @@ def build_image(
     # Resolve all extension fragments up-front so we fail fast on missing
     # bundles or files and avoid calling resolution logic multiple times.
     resolved_fragments = [resolve_extension_content(desc) for desc in extensions]
+    extension_build_contexts = [
+        context
+        for desc in extensions
+        if (context := resolve_extension_build_context(desc)) is not None
+    ]
 
     resolved_docker_build_args = resolve_container_docker_build_args(
         docker_build_args,
@@ -556,6 +595,29 @@ def build_image(
         dockerfile_hook_path,
         os.getenv("CONTAINER_DOCKERFILE_HOOK_PATH"),
     )
+    top_level_build_args = inject_auto_build_args_from_env(
+        {"PYTHON_VARIANT": get_python_variant()}
+    )
+
+    if resolved_dockerfile_path:
+        version_tag, commit_tag = _build_image(
+            dockerfile_path=resolved_dockerfile_path,
+            context_path=Path("."),
+            debug=debug,
+            no_cache=no_cache,
+            plain=plain,
+            single_arch=single_arch,
+            omit_target=not debug,
+            extra_build_args=top_level_build_args or None,
+            docker_build_args=resolved_docker_build_args,
+            dockerfile_hook_path=resolved_dockerfile_hook_path,
+        )
+        _prune_container_images(version_tag, commit_tag)
+        return _ContainerBuild(
+            dockerfile_text=resolved_dockerfile_path.read_text(encoding="utf-8"),
+            version_tag=version_tag,
+            commit_tag=commit_tag,
+        )
 
     has_debug_deps = has_debug_dependency_group()
     if debug and not has_debug_deps:
@@ -579,9 +641,6 @@ def build_image(
             "Injecting builder and runtime env vars: %s",
             ", ".join(container_env_vars),
         )
-    top_level_build_args = inject_auto_build_args_from_env(
-        {"PYTHON_VARIANT": get_python_variant()}
-    )
     external_deps_image = _get_container_build_setting("CONTAINER_DEPS_IMAGE")
     if external_deps_image:
         top_level_build_args["CONTAINER_DEPS_IMAGE"] = external_deps_image
@@ -687,20 +746,18 @@ def build_image(
         plain=plain,
         single_arch=single_arch,
         extra_build_args=merged_build_args or None,
-        docker_build_args=resolved_docker_build_args,
+        docker_build_args=[
+            *resolved_docker_build_args,
+            *(
+                item
+                for name, path in extension_build_contexts
+                for item in ("--build-context", f"{name}={path}")
+            ),
+        ],
         dockerfile_hook_path=resolved_dockerfile_hook_path,
     )
 
-    keep = get_prune_keep()
-    if keep >= 0:
-        # Protect the tags created by this build
-        protect = [t for t in (version_tag, commit_tag) if t is not None]
-        LOGGER.debug(
-            "Pruning old images; keeping %d and protecting tags: %s", keep, protect
-        )
-        prune_images_keep(
-            get_full_image_name(), get_package_name(), keep, protect_tags=protect
-        )
+    _prune_container_images(version_tag, commit_tag)
 
     return _ContainerBuild(
         dockerfile_text=dockerfile_text,
@@ -1320,6 +1377,7 @@ def _run_release_flow(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
     assets: list[str] | None = None,
@@ -1426,6 +1484,7 @@ def _run_release_flow(
             no_cache=no_cache,
             plain=plain,
             single_arch=single_arch,
+            dockerfile_path=dockerfile_path,
             container_env=container_env,
             container_envfile=container_envfile,
         )
@@ -1444,6 +1503,7 @@ def release(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
     assets: list[str] | None = None,
@@ -1462,6 +1522,8 @@ def release(
         no_cache: Do not use cache when building container images.
         plain: Do not pretty-print container build output.
         single_arch: Build container image for a single architecture.
+        dockerfile_path: Optional project-owned Dockerfile used for the image
+            build. Overrides CONTAINER_DOCKERFILE_PATH if provided.
         container_env: Inline container environment variables as repeated
             KEY=VALUE values.
         container_envfile: Repeated list of container environment files.
@@ -1480,6 +1542,7 @@ def release(
         no_cache=no_cache,
         plain=plain,
         single_arch=single_arch,
+        dockerfile_path=dockerfile_path,
         container_env=container_env,
         container_envfile=container_envfile,
         assets=assets,
@@ -1532,6 +1595,7 @@ def build(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
 ) -> None:
@@ -1544,6 +1608,8 @@ def build(
         no_cache: Pass `--no-cache` to the Docker build command.
         plain: Pass `--progress plain` to the Docker build command.
         single_arch: Build the container for the current host architecture only.
+        dockerfile_path: Optional project-owned Dockerfile used for the image
+            build. Overrides CONTAINER_DOCKERFILE_PATH if provided.
         container_env: Inline container environment variables as repeated
             `KEY=VALUE` values.
         container_envfile: Repeated list of container environment files.
@@ -1558,6 +1624,7 @@ def build(
             no_cache=no_cache,
             plain=plain,
             single_arch=single_arch,
+            dockerfile_path=dockerfile_path,
             container_env=container_env,
             container_envfile=container_envfile,
         )
@@ -1572,6 +1639,7 @@ def build_with_containers(
     no_cache: bool = False,
     plain: bool = False,
     single_arch: bool = False,
+    dockerfile_path: str | None = None,
     container_env: list[str] | None = None,
     container_envfile: list[str] | None = None,
 ) -> None:
@@ -1582,6 +1650,8 @@ def build_with_containers(
         no_cache: Do not use cache when building the image.
         plain: Do not pretty-print output.
         single_arch: Build images for a single architecture.
+        dockerfile_path: Optional project-owned Dockerfile used for the image
+            build. Overrides CONTAINER_DOCKERFILE_PATH if provided.
         container_env: Inline container environment variables as repeated KEY=VALUE
             values.
         container_envfile: Repeated list of container environment files.
@@ -1593,6 +1663,7 @@ def build_with_containers(
         no_cache=no_cache,
         plain=plain,
         single_arch=single_arch,
+        dockerfile_path=dockerfile_path,
         container_env=container_env,
         container_envfile=container_envfile,
     )