common-python-tasks 0.11.1__py3-none-any.whl → 0.12.0__py3-none-any.whl

common_python_tasks/data/dockerfile_extensions/docker-in-docker/Dockerfile

@@ -0,0 +1,27 @@
+# Docker-in-Docker currently supports Debian Bookworm on amd64 and arm64.
+USER root
+
+# Optional exact APT version, including the epoch and distribution suffix.
+ARG DIND_DOCKER_VERSION
+
+COPY --from=cpt-extension-docker-in-docker --chmod=0755 install.sh \
+    /usr/local/share/cpt-dind-install.sh
+RUN /usr/local/share/cpt-dind-install.sh \
+    && rm /usr/local/share/cpt-dind-install.sh
+
+COPY --from=cpt-extension-docker-in-docker --chmod=0755 supervisor.sh \
+    /usr/local/bin/cpt-dind-supervisor
+
+RUN mv /pkg/entrypoint.sh /pkg/application-entrypoint.sh \
+    && printf '%s\n' '#!/bin/sh' \
+        'exec /usr/bin/tini -- /usr/local/bin/cpt-dind-supervisor "$@"' \
+        >/pkg/entrypoint.sh \
+    && chmod 0755 /pkg/entrypoint.sh
+
+ENV DOCKER_HOST=unix:///var/run/docker.sock
+VOLUME ["/var/lib/docker", "/var/lib/containerd"]
+
+# The generic final and debug stages inherit this startup-user selection.
+# The wrapper drops to py only for the application, after Docker is ready.
+ARG RUNTIME_USER=root
+USER ${RUNTIME_USER}

common_python_tasks/data/dockerfile_extensions/docker-in-docker/install.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+set -eu
+
+# shellcheck source=/dev/null
+. /etc/os-release
+if [ "$ID" != debian ] || [ "${VERSION_CODENAME:-}" != bookworm ]; then
+    echo >&2 'docker-in-docker requires Debian Bookworm; use slim-bookworm.'
+    exit 1
+fi
+case "$(dpkg --print-architecture)" in
+    amd64 | arm64) ;;
+    *)
+        echo >&2 'docker-in-docker supports amd64 and arm64 only.'
+        exit 1
+        ;;
+esac
+
+apt-get update
+apt-get install -y --no-install-recommends \
+    bash ca-certificates curl iptables tini util-linux
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg \
+    -o /etc/apt/keyrings/docker.asc
+chmod 0644 /etc/apt/keyrings/docker.asc
+cat >/etc/apt/sources.list.d/docker.sources <<SOURCES
+Types: deb
+URIs: https://download.docker.com/linux/debian
+Suites: bookworm
+Components: stable
+Architectures: $(dpkg --print-architecture)
+Signed-By: /etc/apt/keyrings/docker.asc
+SOURCES
+apt-get update
+apt-get install -y --no-install-recommends \
+    "docker-ce${DIND_DOCKER_VERSION:+=$DIND_DOCKER_VERSION}" \
+    "docker-ce-cli${DIND_DOCKER_VERSION:+=$DIND_DOCKER_VERSION}" \
+    containerd.io docker-buildx-plugin docker-compose-plugin
+usermod -aG docker py
+rm -rf /var/lib/apt/lists/*

common_python_tasks/data/dockerfile_extensions/docker-in-docker/supervisor.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+set -euo pipefail
+
+_prepare_host() {
+    if [[ $(id -u) != 0 ]]; then
+        echo >&2 'docker-in-docker must start as root with --privileged.'
+        return 1
+    fi
+    if [[ ! -w /sys/fs/cgroup ]]; then
+        echo >&2 'docker-in-docker needs writable cgroups; use --privileged.'
+        return 1
+    fi
+    if [[ -d /sys/kernel/security ]] &&
+        ! mountpoint -q /sys/kernel/security; then
+        mount -t securityfs none /sys/kernel/security
+    fi
+    _prepare_cgroups
+    if ! iptables -nL >/dev/null 2>&1 &&
+        iptables-legacy -nL >/dev/null 2>&1; then
+        update-alternatives --set iptables /usr/sbin/iptables-legacy
+        update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+    fi
+    # Only remove our daemon's PID file, never unrelated processes' files.
+    rm -f /var/run/docker.pid
+}
+
+_prepare_cgroups() {
+    [[ -f /sys/fs/cgroup/cgroup.controllers ]] || return 0
+    mkdir -p /sys/fs/cgroup/cpt-init
+    local attempt pid controllers
+    for ((attempt = 0; attempt < 5; attempt++)); do
+        while read -r pid; do
+            # Processes can disappear or become immovable while we move them.
+            printf '%s\n' "$pid" | tee \
+                /sys/fs/cgroup/cpt-init/cgroup.procs >/dev/null 2>&1 || true
+        done </sys/fs/cgroup/cgroup.procs
+        controllers=$(sed 's/[^ ]\+/+&/g' \
+            /sys/fs/cgroup/cgroup.controllers)
+        if printf '%s\n' "$controllers" | tee \
+            /sys/fs/cgroup/cgroup.subtree_control >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.1
+    done
+    echo >&2 'docker-in-docker could not enable nested cgroups.'
+    return 1
+}
+
+_stop_group() {
+    local pid=$1
+    [[ -n "$pid" ]] || return 0
+    kill -TERM -- "-$pid" 2>/dev/null || true
+    local attempt
+    for ((attempt = 0; attempt < 50; attempt++)); do
+        kill -0 -- "-$pid" 2>/dev/null || break
+        sleep 0.1
+    done
+    kill -KILL -- "-$pid" 2>/dev/null || true
+    wait "$pid" 2>/dev/null || true
+}
+
+_shutdown() {
+    trap '' TERM INT
+    _stop_group "$app_pid"
+    _stop_group "$daemon_pid"
+}
+
+_wait_for_docker() {
+    local deadline=$((SECONDS + DIND_STARTUP_TIMEOUT))
+    while ((SECONDS < deadline)); do
+        if ! kill -0 "$daemon_pid" 2>/dev/null; then
+            echo >&2 'docker-in-docker daemon exited during startup.'
+            return 1
+        fi
+        if timeout 1 docker --host "$DOCKER_HOST" info >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.2
+    done
+    echo >&2 'docker-in-docker timed out waiting for the daemon.'
+    return 1
+}
+
+_main() {
+    if [[ ! ${DIND_STARTUP_TIMEOUT:-60} =~ ^[1-9][0-9]{0,3}$ ]]; then
+        echo >&2 'DIND_STARTUP_TIMEOUT must be an integer from 1 to 9999.'
+        return 1
+    fi
+    export DIND_STARTUP_TIMEOUT=${DIND_STARTUP_TIMEOUT:-60}
+    export DOCKER_HOST=unix:///var/run/docker.sock
+    export container=docker
+    unset DOCKER_CONTEXT DOCKER_TLS_VERIFY DOCKER_CERT_PATH
+    _prepare_host
+    daemon_pid=''
+    app_pid=''
+    trap _shutdown EXIT
+    trap 'exit 143' TERM
+    trap 'exit 130' INT
+    # Keep daemon logs on stderr and expose only the local Unix socket.
+    setsid dockerd --host "$DOCKER_HOST" --group docker >&2 &
+    daemon_pid=$!
+    _wait_for_docker
+    setsid setpriv --reuid py --regid py --init-groups \
+        env HOME="$(getent passwd py | cut -d: -f6)" USER=py LOGNAME=py \
+        /pkg/application-entrypoint.sh "$@" &
+    app_pid=$!
+    local finished status=0
+    wait -n -p finished "$daemon_pid" "$app_pid" || status=$?
+    if [[ "$finished" == "$daemon_pid" ]]; then
+        echo >&2 'docker-in-docker daemon exited while the app was running.'
+        return 1
+    fi
+    return "$status"
+}
+
+_main "$@"

common_python_tasks/data/generic/Dockerfile.j2

@@ -40,7 +40,7 @@ COPY . /tmp/build/
 # Export debug requirements when the project defines a debug dependency group
 RUN --mount=type=cache,target=/root/.cache/uv,id=uv-cache{{ CACHE_ID_SUFFIX }}{% for mount in UV_INDEX_SECRET_MOUNTS %} \
     --mount={{ mount }}{% endfor %} \
-    uv export --group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
+    uv export --frozen --only-group debug --no-hashes --format requirements-txt --output-file requirements-debug.txt
 {% endif %}
 
 # Build the wheel, caching the uv cache directory to speed up subsequent builds.
@@ -133,10 +133,11 @@ LABEL git.commit=${GIT_COMMIT}
 # This entrypoint is deliberately not configurable via environment variables in order to
 # ensure that the container always uses the entrypoint selected at build time. If the
 # current package does not provide a console script, the entrypoint will default to `python`
-RUN echo "#!/bin/sh\n\n{{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
+RUN echo "#!/bin/sh\n\nexec {{ ENTRYPOINT_COMMAND|default('python') }} \"\$@\"" >/pkg/entrypoint.sh \
     && chmod +x /pkg/entrypoint.sh
 
-USER py
+ARG RUNTIME_USER=py
+USER ${RUNTIME_USER}
 
 {% if EXTENSION_CONTENT %}
 {{ EXTENSION_CONTENT }}
@@ -154,10 +155,10 @@ COPY --from=builder /tmp/build /tmp/build
 
 RUN --mount=type=cache,target=/root/.cache/pip,id=pip-cache{{ CACHE_ID_SUFFIX }} pip install --root-user-action=ignore -r /tmp/build/requirements-debug.txt
 
-USER py
+USER ${RUNTIME_USER}
 {% endif %}
 
 # Final (default) image: explicitly use runtime as the final target so debug is not used unless requested
 FROM runtime AS final
 
-USER py
+USER ${RUNTIME_USER}

common_python_tasks/env.py

@@ -227,6 +227,40 @@ def resolve_extension_content(descriptor: dict[str, str | None]) -> str:
     utils.fatal(f"Unknown extension descriptor source: {descriptor['source']}")
 
 
+def resolve_extension_build_context(
+    descriptor: dict[str, str | None],
+) -> tuple[str, Path] | None:
+    """Return the named build context for a bundled extension's asset directory.
+
+    Args:
+        descriptor: Extension descriptor dictionary containing `source` and
+            `bundle_name` values.
+
+    Returns:
+        A Docker build-context name and its directory, or `None` when the
+        extension has no packaged assets.
+    """
+    if descriptor["source"] != "bundle":
+        return None
+    bundle_name = descriptor["bundle_name"]
+    out = utils.load_data_file(
+        f"{bundle_name}/Dockerfile",
+        type_identifier="dockerfile_extensions",
+        fatal_on_missing=False,
+    )
+    if out is None:
+        utils.fatal(f"Extension bundle not found: {bundle_name}")
+    bundle_directory = out[0].parent
+    if not bundle_directory.is_dir() or not any(
+        path.name != "Dockerfile" for path in bundle_directory.iterdir()
+    ):
+        return None
+    return (
+        f"cpt-extension-{re.sub(r'[^a-z0-9]+', '-', bundle_name.lower()).strip('-')}",
+        bundle_directory,
+    )
+
+
 def get_cache_id_suffix(no_cache: bool) -> str:
     """Return a cache-break suffix for Docker cache mount IDs.
     Args:

common_python_tasks/tasks.py

@@ -541,6 +541,7 @@ def build_image(
         resolve_container_docker_build_args,
         resolve_container_dockerfile_hook_path,
         resolve_container_dockerfile_path,
+        resolve_extension_build_context,
         resolve_extension_content,
         uv_index_secret_build_args,
         uv_index_secret_mounts,
@@ -571,6 +572,11 @@ def build_image(
     # Resolve all extension fragments up-front so we fail fast on missing
     # bundles or files and avoid calling resolution logic multiple times.
     resolved_fragments = [resolve_extension_content(desc) for desc in extensions]
+    extension_build_contexts = [
+        context
+        for desc in extensions
+        if (context := resolve_extension_build_context(desc)) is not None
+    ]
 
     resolved_docker_build_args = resolve_container_docker_build_args(
         docker_build_args,
@@ -740,7 +746,14 @@ def build_image(
         plain=plain,
         single_arch=single_arch,
         extra_build_args=merged_build_args or None,
-        docker_build_args=resolved_docker_build_args,
+        docker_build_args=[
+            *resolved_docker_build_args,
+            *(
+                item
+                for name, path in extension_build_contexts
+                for item in ("--build-context", f"{name}={path}")
+            ),
+        ],
         dockerfile_hook_path=resolved_dockerfile_hook_path,
     )
 

{common_python_tasks-0.11.1.dist-info → common_python_tasks-0.12.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: common-python-tasks
-Version: 0.11.1
+Version: 0.12.0
 Summary: Opinionated Poe the Poet tasks for Python package development.
 Project-URL: Homepage, http://github.com/ci-sourcerer/common-python-tasks
 Project-URL: Source, http://github.com/ci-sourcerer/common-python-tasks.git
@@ -42,7 +42,7 @@ Read the [complete documentation](https://ci-sourcerer.github.io/common-python-t
 Add the package as a development dependency.
 
 ```shell
-uv add --dev common-python-tasks==0.11.1
+uv add --dev common-python-tasks==0.12.0
 ```
 
 Expose the default task set in `pyproject.toml`.

{common_python_tasks-0.11.1.dist-info → common_python_tasks-0.12.0.dist-info}/RECORD

@@ -2,13 +2,16 @@ common_python_tasks/__init__.py,sha256=tqRLgOwmMQHDb1A84XbML9sWfzMymkSPhJjoF6aCH
 common_python_tasks/__main__.py,sha256=GpgSd_toMbEaWA_cZvgsZE7jo4XpzuI-awBVm2uhVyw,3512
 common_python_tasks/docker.py,sha256=_YW-hyHWlUK-kMCvI6QTgxSfmXQQKhYLOKRBPfUmtHA,24176
 common_python_tasks/docker_compose.py,sha256=NGgMei3oCYS0RbNaQXE-2veXFylO3XtZ7lU-PTtocik,21338
-common_python_tasks/env.py,sha256=KxXyvQcSe_zMy4drTWPX3-R_q7u4jlwVNMDkRaTta-M,20666
+common_python_tasks/env.py,sha256=hSjWe8L1RXguLqIMh1IsgbkHa_64b1U8lBHqDIS3zko,21779
 common_python_tasks/git.py,sha256=0X472w_vHdtbrHHxCmJ85NoQjjogEEDs_0SRXfxbWi0,11719
 common_python_tasks/github.py,sha256=_LVanl-z4PsdLM94L8y7tkX-AZO2n3Qy39FRY7reDhA,21589
 common_python_tasks/project.py,sha256=PQ_GQicTrSQgVDB9cJ9E6pU0UhLPom2xou1sGFscr3E,17377
-common_python_tasks/tasks.py,sha256=U6CGlLVW_E-9Hofja21bUwiiISU05GdJbTTzI7Vwv2I,63796
+common_python_tasks/tasks.py,sha256=vMCFXZKo-0Dj1TLmZ3lo6oFCAhJSEp637qZWhaWOmpA,64199
 common_python_tasks/utils.py,sha256=hR7w0Cb7uQ7ILyIegTQ4znWHVoWANlCgxrOnO-Rh5oE,20798
 common_python_tasks/data/dockerfile_extensions/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+common_python_tasks/data/dockerfile_extensions/docker-in-docker/Dockerfile,sha256=m7jeQyFe6mAv8AVGpM89NHljzG21ctcSyllbvoEL0Do,1021
+common_python_tasks/data/dockerfile_extensions/docker-in-docker/install.sh,sha256=F87oojGFYT5F1mdcMchRNlUeI_viAO4ip04UHBC_8bQ,1224
+common_python_tasks/data/dockerfile_extensions/docker-in-docker/supervisor.sh,sha256=cqslPv9QPU4vtClvNSl2wyhEL0HubxO5YqAhwNfTEXA,3726
 common_python_tasks/data/fastapi/alembic.ini.j2,sha256=dOiAmZngzX6eyVXeM6BhzgQmes2zwUEdKwOgm8mxjMs,985
 common_python_tasks/data/fastapi/compose-base.yml.j2,sha256=vDLPAdRJ66lsWZdsKbYqEvY_liXaHZ0ly4ljzqmJsyY,910
 common_python_tasks/data/fastapi/compose-db-debug.yml.j2,sha256=iREdSy4F8tJ5m9rlB6CROBkj9OtDFVuGphqIuDvHhww,1193
@@ -17,11 +20,11 @@ common_python_tasks/data/fastapi/compose-debug.yml.j2,sha256=sIH9IFvmRAszN6wSejp
 common_python_tasks/data/generic/.coveragerc,sha256=8zXwDq18wIKQV4NtW2NJYpo3nxCO4LsAChyluYTUoJc,85
 common_python_tasks/data/generic/.dockerignore,sha256=8kHwNa6Ct-6y3EvRjNuhOKfquuGEywq3P2BHIbG4uXo,53
 common_python_tasks/data/generic/Dockerfile.deps.j2,sha256=fBmcytyUd4LsC26y0IgZ09QPxrFp0gx0d3OlKNqZ-KM,663
-common_python_tasks/data/generic/Dockerfile.j2,sha256=hgLrIRU5xvS2xqw9Xm4kfkcBGHH-mghFPlWv3KSNaz4,6223
+common_python_tasks/data/generic/Dockerfile.j2,sha256=UrR9T794V2ESNIkSVE7K5vEbx43NQiddfsWKG_bY6b4,6301
 common_python_tasks/data/generic/cliff.toml,sha256=po1MnEGEEgrpyBz3XLWr0h7emXb6ASX63lrU2r6o240,77
 common_python_tasks/data/generic/pytest.ini,sha256=RHak5QrLzKHvUBjFmaaiOYFrd_8YBRQubXEOT0NJfco,134
 common_python_tasks/data/generic/ruff.toml,sha256=njvd-5inSGmgY865SWCT4SR9IrKlzS7JQFZmAG2UT_E,53
-common_python_tasks-0.11.1.dist-info/METADATA,sha256=v1Gf_iMcyv-ZWpREpc9ji35TtQ9T8oyEmdKPga5yyak,3307
-common_python_tasks-0.11.1.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-common_python_tasks-0.11.1.dist-info/licenses/LICENSE,sha256=RsSweM-DyzxFPx38fQOJqHrKyeT9Fiz8rO7yox-fOsw,1070
-common_python_tasks-0.11.1.dist-info/RECORD,,
+common_python_tasks-0.12.0.dist-info/METADATA,sha256=iAVWGja53RQz1tWWMtn5szBCGveET5EDvwI_ltczz2A,3307
+common_python_tasks-0.12.0.dist-info/WHEEL,sha256=THafob7ofN-NsuMN7Mg4qZyHaQI7KkD-QlcQatYhXPo,87
+common_python_tasks-0.12.0.dist-info/licenses/LICENSE,sha256=RsSweM-DyzxFPx38fQOJqHrKyeT9Fiz8rO7yox-fOsw,1070
+common_python_tasks-0.12.0.dist-info/RECORD,,

{common_python_tasks-0.11.1.dist-info → common_python_tasks-0.12.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.0
+Generator: hatchling 1.32.3
 Root-Is-Purelib: true
 Tag: py3-none-any