flyte 0.0.1b3__py3-none-any.whl → 0.2.0a0__py3-none-any.whl

flyte/__init__.py

@@ -17,16 +17,15 @@ async def my_task():
 """
 
 __all__ = [
-    "ABFS",
-    "GCS",
     "GPU",
-    "S3",
     "TPU",
     "Cache",
     "CachePolicy",
     "CacheRequest",
     "Device",
+    "Environment",
     "Image",
+    "PodTemplate",
     "Resources",
     "RetryStrategy",
     "ReusePolicy",
@@ -40,17 +39,25 @@ __all__ = [
     "deploy",
     "group",
     "init",
+    "init_from_config",
+    "map",
     "run",
     "trace",
     "with_runcontext",
 ]
 
+import sys
+
 from ._cache import Cache, CachePolicy, CacheRequest
 from ._context import ctx
 from ._deploy import deploy
+from ._environment import Environment
+from ._excepthook import custom_excepthook
 from ._group import group
 from ._image import Image
-from ._initialize import ABFS, GCS, S3, init
+from ._initialize import init, init_from_config
+from ._map import map
+from ._pod import PodTemplate
 from ._resources import GPU, TPU, Device, Resources
 from ._retry import RetryStrategy
 from ._reusable_environment import ReusePolicy
@@ -60,3 +67,12 @@ from ._task_environment import TaskEnvironment
 from ._timeout import Timeout, TimeoutType
 from ._trace import trace
 from ._version import __version__
+
+sys.excepthook = custom_excepthook
+
+
+def version() -> str:
+    """
+    Returns the version of the Flyte SDK.
+    """
+    return __version__

flyte/_bin/runtime.py

@@ -8,7 +8,7 @@ Refrain from importing any modules here. If you need to import any modules, do i
 import asyncio
 import os
 import sys
-from typing import List
+from typing import Any, List
 
 import click
 
@@ -27,6 +27,9 @@ ORG_NAME = "_U_ORG_NAME"
 ENDPOINT_OVERRIDE = "_U_EP_OVERRIDE"
 RUN_OUTPUT_BASE_DIR = "_U_RUN_BASE"
 
+# TODO: Remove this after proper auth is implemented
+_UNION_EAGER_API_KEY_ENV_VAR = "_UNION_EAGER_API_KEY"
+
 
 @click.command("a0")
 @click.option("--inputs", "-i", required=True)
@@ -73,12 +76,16 @@ def main(
 ):
     sys.path.insert(0, ".")
 
+    import flyte
     import flyte._utils as utils
-    from flyte._datastructures import ActionID, Checkpoints, CodeBundle, RawDataPath
-    from flyte._initialize import S3, initialize_in_cluster
+    from flyte._initialize import init
     from flyte._internal.controllers import create_controller
     from flyte._internal.imagebuild.image_builder import ImageCache
     from flyte._internal.runtime.entrypoints import load_and_run_task
+    from flyte._logging import logger
+    from flyte.models import ActionID, Checkpoints, CodeBundle, RawDataPath
+
+    logger.info(f"Initializing flyte runtime - version {flyte.__version__}")
 
     assert org, "Org is required for now"
     assert project, "Project is required"
@@ -91,12 +98,31 @@ def main(
     if name.startswith("{{"):
         name = os.getenv("ACTION_NAME", "")
 
-    ep = os.environ.get(ENDPOINT_OVERRIDE, "host.docker.internal:8090")
+    # Figure out how to connect
+    # This detection of api key is a hack for now.
+    controller_kwargs: dict[str, Any] = {"insecure": False}
+    if api_key := os.getenv(_UNION_EAGER_API_KEY_ENV_VAR):
+        logger.info("Using api key from environment")
+        controller_kwargs["api_key"] = api_key
+    else:
+        ep = os.environ.get(ENDPOINT_OVERRIDE, "host.docker.internal:8090")
+        controller_kwargs["endpoint"] = ep
+        if "localhost" in ep or "docker" in ep:
+            controller_kwargs["insecure"] = True
+        logger.debug(f"Using controller endpoint: {ep} with kwargs: {controller_kwargs}")
 
     bundle = CodeBundle(tgz=tgz, pkl=pkl, destination=dest, computed_version=version)
-    # TODO configure storage correctly for cluster
-    initialize_in_cluster(storage=S3.auto())
-    controller = create_controller(ct="remote", endpoint=ep, insecure=True)
+    # We init regular client here so that reference tasks can work
+    # Current reference tasks will not work with remote controller, because we create 2 different
+    # channels on different threads and this is not supported by grpcio or the auth system. It ends up leading
+    # File "src/python/grpcio/grpc/_cython/_cygrpc/aio/completion_queue.pyx.pxi", line 147,
+    # in grpc._cython.cygrpc.PollerCompletionQueue._handle_events
+    # BlockingIOError: [Errno 11] Resource temporarily unavailable
+    # init(org=org, project=project, domain=domain, **controller_kwargs)
+    # TODO solution is to use a single channel for both controller and reference tasks, but this requires a refactor
+    init()
+    # Controller is created with the same kwargs as init, so that it can be used to run tasks
+    controller = create_controller(ct="remote", **controller_kwargs)
 
     ic = ImageCache.from_transport(image_cache) if image_cache else None
 

flyte/_build.py

@@ -1,10 +1,11 @@
 from __future__ import annotations
 
-from ._api_commons import syncer
+from flyte.syncify import syncify
+
 from ._image import Image
 
 
-@syncer.wrap
+@syncify
 async def build(image: Image) -> str:
     """
     Build an image. The existing async context will be used.

flyte/_cache/cache.py

@@ -14,10 +14,9 @@ from typing import (
 import rich.repr
 from typing_extensions import Literal, ParamSpec, TypeVar, get_args
 
-from flyte._datastructures import CodeBundle
-
 # if TYPE_CHECKING:
 from flyte._image import Image
+from flyte.models import CodeBundle
 
 P = ParamSpec("P")
 FuncOut = TypeVar("FuncOut")

flyte/_code_bundle/_packaging.py

@@ -91,7 +91,7 @@ def list_files_to_bundle(
     ignore = IgnoreGroup(source, *ignores)
 
     ls, ls_digest = ls_files(source, copy_style, deref_symlinks, ignore)
-    logger.debug(f"Hash digest: {ls_digest}")
+    logger.debug(f"Hash of files to be included in the code bundle: {ls_digest}")
     return ls, ls_digest
 
 

flyte/_code_bundle/_utils.py

@@ -14,7 +14,6 @@ import tempfile
 import typing
 from datetime import datetime, timezone
 from functools import lru_cache
-from pathlib import Path
 from types import ModuleType
 from typing import List, Literal, Optional, Tuple, Union
 
@@ -322,18 +321,3 @@ def hash_file(file_path: typing.Union[os.PathLike, str]) -> Tuple[bytes, str, in
             size += len(chunk)
 
     return h.digest(), h.hexdigest(), size
-
-
-def _find_project_root(source_path) -> str:
-    """
-    Find the root of the project.
-    The root of the project is considered to be the first ancestor from source_path that does
-    not contain a __init__.py file.
-
-    N.B.: This assumption only holds for regular packages (as opposed to namespace packages)
-    """
-    # Start from the directory right above source_path
-    path = Path(source_path).parent.resolve()
-    while os.path.exists(os.path.join(path, "__init__.py")):
-        path = path.parent
-    return str(path)

flyte/_code_bundle/bundle.py

@@ -5,13 +5,13 @@ import os
 import pathlib
 import tempfile
 from pathlib import Path
-from typing import Type
+from typing import ClassVar, Type
 
 from flyteidl.core.tasks_pb2 import TaskTemplate
 
-import flyte.storage as storage
-from flyte._datastructures import CodeBundle
 from flyte._logging import log, logger
+from flyte._utils import AsyncLRUCache
+from flyte.models import CodeBundle
 
 from ._ignore import GitIgnore, Ignore, StandardIgnore
 from ._packaging import create_bundle, list_files_to_bundle, print_ls_tree
@@ -21,10 +21,34 @@ _pickled_file_extension = ".pkl.gz"
 _tar_file_extension = ".tar.gz"
 
 
+class _PklCache:
+    _pkl_cache: ClassVar[AsyncLRUCache[str, str]] = AsyncLRUCache[str, str](maxsize=100)
+
+    @classmethod
+    async def put(cls, digest: str, upload_to_path: str, from_path: pathlib.Path) -> str:
+        """
+        Get the pickled code bundle from the cache or build it if not present.
+
+        :param digest: The hash digest of the task template.
+        :param upload_to_path: The path to upload the pickled file to.
+        :param from_path: The path to read the pickled file from.
+        :return: CodeBundle object containing the pickled file path and the computed version.
+        """
+        import flyte.storage as storage
+
+        async def put_data() -> str:
+            return await storage.put(str(from_path), to_path=str(upload_to_path))
+
+        return await cls._pkl_cache.get(
+            key=digest,
+            value_func=put_data,
+        )
+
+
 async def build_pkl_bundle(
     o: TaskTemplate,
     upload_to_controlplane: bool = True,
-    upload_from_dataplane_path: str | None = None,
+    upload_from_dataplane_base_path: str | None = None,
     copy_bundle_to: pathlib.Path | None = None,
 ) -> CodeBundle:
     """
@@ -36,16 +60,14 @@ async def build_pkl_bundle(
 
     :param o: Object to be pickled. This is the task template.
     :param upload_to_controlplane: Whether to upload the pickled file to the control plane or not
-    :param upload_from_dataplane_path: If we are on the dataplane, this is the path where the
+    :param upload_from_dataplane_base_path: If we are on the dataplane, this is the path where the
         pickled file should be uploaded to. upload_to_controlplane has to be False in this case.
     :param copy_bundle_to: If set, the bundle will be copied to this path. This is used for testing purposes.
     :return: CodeBundle object containing the pickled file path and the computed version.
     """
     import cloudpickle
 
-    import flyte.storage as storage
-
-    if upload_to_controlplane and upload_from_dataplane_path:
+    if upload_to_controlplane and upload_from_dataplane_base_path:
         raise ValueError("Cannot upload to control plane and upload from dataplane path at the same time.")
 
     logger.debug("Building pickled code bundle.")
@@ -61,10 +83,17 @@ async def build_pkl_bundle(
             hash_digest, remote_path = await upload_file(dest)
             return CodeBundle(pkl=remote_path, computed_version=hash_digest)
 
-        elif upload_from_dataplane_path:
-            logger.debug(f"Uploading pickled code bundle to dataplane path {upload_from_dataplane_path}.")
+        elif upload_from_dataplane_base_path:
+            from flyte._internal.runtime import io
+
             _, str_digest, _ = hash_file(file_path=dest)
-            final_path = await storage.put(str(dest), upload_from_dataplane_path)
+            upload_path = io.pkl_path(upload_from_dataplane_base_path, str_digest)
+            logger.debug(f"Uploading pickled code bundle to dataplane path {upload_path}.")
+            final_path = await _PklCache.put(
+                digest=str_digest,
+                upload_to_path=upload_path,
+                from_path=dest,
+            )
             return CodeBundle(pkl=final_path, computed_version=str_digest)
 
         else:
@@ -117,7 +146,7 @@ async def build_code_bundle(
         logger.info(f"Code bundle created at {bundle_path}, size: {tar_size} MB, archive size: {archive_size} MB")
         if not dryrun:
             hash_digest, remote_path = await upload_file(bundle_path)
-            logger.info(f"Code bundle uploaded to {remote_path}")
+            logger.debug(f"Code bundle uploaded to {remote_path}")
         else:
             remote_path = "na"
             if copy_bundle_to:
@@ -138,6 +167,8 @@ async def download_bundle(bundle: CodeBundle) -> pathlib.Path:
 
     :return: The path to the downloaded code bundle.
     """
+    import flyte.storage as storage
+
     dest = pathlib.Path(bundle.destination)
     if not dest.is_dir():
         raise ValueError(f"Destination path should be a directory, found {dest}, {dest.stat()}")

flyte/_context.py

@@ -4,7 +4,8 @@ import contextvars
 from dataclasses import dataclass, replace
 from typing import TYPE_CHECKING, Awaitable, Callable, Optional, ParamSpec, TypeVar
 
-from flyte._datastructures import GroupData, RawDataPath, TaskContext
+from flyte._logging import logger
+from flyte.models import GroupData, RawDataPath, TaskContext
 
 if TYPE_CHECKING:
     from flyte.report import Report
@@ -49,6 +50,7 @@ class Context:
             raise ValueError("Cannot create a new context without contextdata.")
         self._data = data
         self._id = id(self)  # Immutable unique identifier
+        self._token = None  # Context variable token to restore the previous context
 
     @property
     def data(self) -> ContextData:
@@ -106,7 +108,11 @@ class Context:
 
     def __exit__(self, exc_type, exc_val, exc_tb):
         """Exit the context, restoring the previous context."""
-        root_context_var.reset(self._token)
+        try:
+            root_context_var.reset(self._token)
+        except Exception as e:
+            logger.warn(f"Failed to reset context: {e}")
+            raise e
 
     async def __aenter__(self):
         """Async version of context entry."""

flyte/_deploy.py

@@ -6,11 +6,13 @@ from typing import TYPE_CHECKING, Dict, List, Optional, Tuple
 
 import rich.repr
 
-from ._api_commons import syncer
-from ._datastructures import SerializationContext
+import flyte.errors
+from flyte.models import SerializationContext
+from flyte.syncify import syncify
+
 from ._environment import Environment
 from ._image import Image
-from ._initialize import get_client, get_common_config, requires_client, requires_initialization
+from ._initialize import ensure_client, get_client, get_common_config, requires_initialization
 from ._logging import logger
 from ._task import TaskTemplate
 from ._task_environment import TaskEnvironment
@@ -45,22 +47,55 @@ class Deployment:
         )
         return f"Deployment(envs=[{env_names}], tasks=[{task_names_versions}])"
 
+    def task_repr(self) -> List[List[Tuple[str, str]]]:
+        """
+        Returns a detailed representation of the deployed tasks.
+        """
+        tuples = []
+        if self.deployed_tasks:
+            for task in self.deployed_tasks:
+                tuples.append(
+                    [
+                        ("name", task.task_template.id.name),
+                        ("version", task.task_template.id.version),
+                    ]
+                )
+        return tuples
+
+    def env_repr(self) -> List[List[Tuple[str, str]]]:
+        """
+        Returns a detailed representation of the deployed environments.
+        """
+        tuples = []
+        for env_name, env in self.envs.items():
+            tuples.append(
+                [
+                    ("environment", env_name),
+                    ("image", env.image.uri if isinstance(env.image, Image) else env.image or ""),
+                ]
+            )
+        return tuples
+
 
-@requires_client
 async def _deploy_task(
     task: TaskTemplate, serialization_context: SerializationContext, dryrun: bool = False
 ) -> task_definition_pb2.TaskSpec:
     """
     Deploy the given task.
     """
+    ensure_client()
+    from ._internal.runtime.convert import convert_upload_default_inputs
     from ._internal.runtime.task_serde import translate_task_to_wire
     from ._protos.workflow import task_definition_pb2, task_service_pb2
 
     image_uri = task.image.uri if isinstance(task.image, Image) else task.image
 
-    spec = translate_task_to_wire(task, serialization_context)
     if dryrun:
-        return spec
+        return translate_task_to_wire(task, serialization_context)
+
+    default_inputs = await convert_upload_default_inputs(task.interface)
+    spec = translate_task_to_wire(task, serialization_context, default_inputs=default_inputs)
+
     msg = f"Deploying task {task.name}, with image {image_uri} version {serialization_context.version}"
     if spec.task_template.HasField("container") and spec.task_template.container.args:
         msg += f" from {spec.task_template.container.args[-3]}.{spec.task_template.container.args[-1]}"
@@ -98,7 +133,7 @@ async def build_images(deployment: DeploymentPlan) -> ImageCache:
     image_identifier_map = {}
     for env_name, env in deployment.envs.items():
         if not isinstance(env.image, str):
-            logger.info(f"Building Image for environment {env_name}, image: {env.image}")
+            logger.warning(f"Building Image for environment {env_name}, image: {env.image}")
             images.append(_build_image_bg(env_name, env.image))
 
         elif env.image == "auto" and "auto" not in image_identifier_map:
@@ -107,7 +142,7 @@ async def build_images(deployment: DeploymentPlan) -> ImageCache:
     final_images = await asyncio.gather(*images)
 
     for env_name, image_uri in final_images:
-        logger.info(f"Built Image for environment {env_name}, image: {image_uri}")
+        logger.warning(f"Built Image for environment {env_name}, image: {image_uri}")
         env = deployment.envs[env_name]
         if isinstance(env.image, Image):
             image_identifier_map[env.image.identifier] = env.image.uri
@@ -121,19 +156,24 @@ async def apply(deployment: DeploymentPlan, copy_style: CopyFiles, dryrun: bool
 
     cfg = get_common_config()
     image_cache = await build_images(deployment)
-    if copy_style == "none":
-        code_bundle = None
-        assert deployment.version is not None, "Version must be set when copy_style is none"
+
+    version = deployment.version
+    code_bundle = None
+    if copy_style == "none" and not version:
+        raise flyte.errors.DeploymentError("Version must be set when copy_style is none")
     else:
         code_bundle = await build_code_bundle(from_dir=cfg.root_dir, dryrun=dryrun, copy_style=copy_style)
-        deployment.version = code_bundle.computed_version
+        version = version or code_bundle.computed_version
+        # TODO we should update the version to include the image cache digest and code bundle digest. This is
+        # to ensure that changes in image dependencies, cause an update to the deployment version.
+        # TODO Also hash the environment and tasks to ensure that changes in the environment or tasks
 
     sc = SerializationContext(
         project=cfg.project,
         domain=cfg.domain,
         org=cfg.org,
         code_bundle=code_bundle,
-        version=deployment.version,
+        version=version,
         image_cache=image_cache,
         root_dir=cfg.root_dir,
     )
@@ -141,6 +181,7 @@ async def apply(deployment: DeploymentPlan, copy_style: CopyFiles, dryrun: bool
     tasks = []
     for env_name, env in deployment.envs.items():
         logger.info(f"Deploying environment {env_name}")
+        # TODO Make this pluggable based on the environment type
         if isinstance(env, TaskEnvironment):
             for task in env.tasks.values():
                 tasks.append(_deploy_task(task, dryrun=dryrun, serialization_context=sc))
@@ -161,7 +202,7 @@ def _recursive_discover(
         if env.name in planned_envs:
             continue
         # Recursively discover dependent environments
-        for dependent_env in env.env_dep_hints:
+        for dependent_env in env.depends_on:
             _recursive_discover(planned_envs, dependent_env)
         # Add the environment to the existing envs
         planned_envs[env.name] = env
@@ -175,7 +216,7 @@ def plan_deploy(*envs: Environment, version: Optional[str] = None) -> Deployment
     return DeploymentPlan(planned_envs, version=version)
 
 
-@syncer.wrap
+@syncify
 async def deploy(
     *envs: Environment,
     dryrun: bool = False,

flyte/_environment.py

@@ -1,7 +1,8 @@
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass, field
-from typing import TYPE_CHECKING, Dict, List, Literal, Optional, Union
+from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Union
 
 import rich.repr
 
@@ -14,6 +15,10 @@ if TYPE_CHECKING:
     from kubernetes.client import V1PodTemplate
 
 
+def is_snake_or_kebab_with_numbers(s: str) -> bool:
+    return re.fullmatch(r"^[a-z0-9]+([_-][a-z0-9]+)*$", s) is not None
+
+
 @rich.repr.auto
 @dataclass(init=True, repr=True)
 class Environment:
@@ -23,12 +28,12 @@ class Environment:
     :param resources: Resources to allocate for the environment.
     :param env: Environment variables to set for the environment.
     :param secrets: Secrets to inject into the environment.
-    :param env_dep_hints: Environment dependencies to hint, so when you deploy the environment, the dependencies are
+    :param depends_on: Environment dependencies to hint, so when you deploy the environment, the dependencies are
         also deployed. This is useful when you have a set of environments that depend on each other.
     """
 
     name: str
-    env_dep_hints: List[Environment] = field(default_factory=list)
+    depends_on: List[Environment] = field(default_factory=list)
     pod_template: Optional[Union[str, "V1PodTemplate"]] = None
     description: Optional[str] = None
     secrets: Optional[SecretRequest] = None
@@ -36,8 +41,44 @@ class Environment:
     resources: Optional[Resources] = None
     image: Union[str, Image, Literal["auto"]] = "auto"
 
+    def __post_init__(self):
+        if not is_snake_or_kebab_with_numbers(self.name):
+            raise ValueError(f"Environment name '{self.name}' must be in snake_case or kebab-case format.")
+
     def add_dependency(self, *env: Environment):
         """
         Add a dependency to the environment.
         """
-        self.env_dep_hints.extend(env)
+        self.depends_on.extend(env)
+
+    def clone_with(
+        self,
+        name: str,
+        image: Optional[Union[str, Image, Literal["auto"]]] = None,
+        resources: Optional[Resources] = None,
+        env: Optional[Dict[str, str]] = None,
+        secrets: Optional[SecretRequest] = None,
+        depends_on: Optional[List[Environment]] = None,
+        **kwargs: Any,
+    ) -> Environment:
+        raise NotImplementedError
+
+    def _get_kwargs(self) -> Dict[str, Any]:
+        """
+        Get the keyword arguments for the environment.
+        """
+        kwargs: Dict[str, Any] = {
+            "depends_on": self.depends_on,
+            "image": self.image,
+        }
+        if self.resources is not None:
+            kwargs["resources"] = self.resources
+        if self.secrets is not None:
+            kwargs["secrets"] = self.secrets
+        if self.env is not None:
+            kwargs["env"] = self.env
+        if self.pod_template is not None:
+            kwargs["pod_template"] = self.pod_template
+        if self.description is not None:
+            kwargs["description"] = self.description
+        return kwargs

flyte/_excepthook.py

@@ -0,0 +1,37 @@
+import logging
+import sys
+import traceback
+
+from flyte._logging import logger
+
+# Save the original excepthook so we can call it later
+original_excepthook = sys.excepthook
+
+# Filters: exclude frames where filename or function name contains these substrings
+EXCLUDED_MODULE_SUBSTRINGS = ["_internal", "syncify"]
+EXCLUDED_FILE_SUBSTRINGS = ["syncify", "_code_bundle"]
+
+
+def should_include_frame(frame: traceback.FrameSummary) -> bool:
+    return not (
+        any(sub in frame.name for sub in EXCLUDED_MODULE_SUBSTRINGS)
+        or any(sub in frame.filename for sub in EXCLUDED_FILE_SUBSTRINGS)
+    )
+
+
+def custom_excepthook(exc_type, exc_value, exc_tb):
+    """
+    Custom exception hook to filter and format tracebacks.
+    If the logger's level is DEBUG, it uses the original excepthook.
+    """
+
+    if logger.getEffectiveLevel() <= logging.DEBUG:
+        original_excepthook(exc_type, exc_value, exc_tb)
+    else:
+        # Extract and filter traceback
+        tb_list = traceback.extract_tb(exc_tb)
+        filtered_tb = [frame for frame in tb_list if should_include_frame(frame)]
+        # Print the filtered version (custom format)
+        print("Filtered traceback (most recent call last):")
+        print("".join(traceback.format_list(filtered_tb)))
+        print(f"{exc_type.__name__}: {exc_value}\n")

flyte/_group.py

@@ -1,7 +1,7 @@
 from contextlib import contextmanager
 
 from ._context import internal_ctx
-from ._datastructures import GroupData
+from .models import GroupData
 
 
 @contextmanager
@@ -29,3 +29,4 @@ def group(name: str):
     new_tctx = tctx.replace(group_data=GroupData(name))
     with ctx.replace_task_context(new_tctx):
         yield
+        # Exit the context and restore the previous context

flyte/_image.py

@@ -342,8 +342,7 @@ class Image:
         """Internal hacky function to see if the current install is editable or not."""
         curr = Path(__file__)
         pyproject = curr.parent.parent.parent / "pyproject.toml"
-        dist_folder = curr.parent.parent.parent / "dist"
-        return pyproject.exists() and dist_folder
+        return pyproject.exists()
 
     @classmethod
     def from_uv_debian(
@@ -445,8 +444,7 @@ class Image:
         ```
 
         For more information on the uv script format, see the documentation:
-        <href="https://docs.astral.sh/uv/guides/scripts/#declaring-script-dependencies">
-            UV: Declaring script dependencies</href>
+        [UV: Declaring script dependencies](https://docs.astral.sh/uv/guides/scripts/#declaring-script-dependencies)
 
         :param name: name of the image
         :param registry: registry to use for the image
@@ -468,9 +466,15 @@ class Image:
         header = parse_uv_script_file(script)
         if registry is None:
             raise ValueError("registry must be specified")
+
         img = cls.from_uv_debian(registry=registry, name=name, arch=arch, python_version=python_version)
+
+        # add ca-certificates to the image by default
+        img = img.with_apt_packages(["ca-certificates"])
+
         if header.dependencies:
             return img.with_pip_packages(header.dependencies)
+        
         # todo: override the _identifier_override to be the script name or a hash of the script contents
         # This is needed because inside the image, the identifier will be computed to be something different.
         return img