pex 2.96.0__tar.gz → 2.96.2__tar.gz

{pex-2.96.0 → pex-2.96.2}/CHANGES.md

@@ -1,5 +1,18 @@
 # Release Notes
 
+## 2.96.2
+
+This release fixes `--scie-only` for foreign platforms.
+
+* Fix `--scie-only` for foreign platforms. (#3196)
+
+## 2.96.1
+
+This release fixes `pex3 lock sync` to handle multiple input requirements for the same project
+name.
+
+* Fix `pex3 lock sync` for multiple requirements for the same project. (#3191)
+
 ## 2.96.0
 
 This release adds support for `--pip-version 26.1.2`.

{pex-2.96.0 → pex-2.96.2}/PKG-INFO

@@ -1,15 +1,15 @@
 Metadata-Version: 2.4
 Name: pex
-Version: 2.96.0
+Version: 2.96.2
 Summary: The PEX packaging toolchain.
 Home-page: https://github.com/pex-tool/pex
-Download-URL: https://github.com/pex-tool/pex/releases/download/v2.96.0/pex
+Download-URL: https://github.com/pex-tool/pex/releases/download/v2.96.2/pex
 Author: The PEX developers
 Author-email: developers@pex-tool.org
 License-Expression: Apache-2.0
-Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.96.0/CHANGES.md
+Project-URL: Changelog, https://github.com/pex-tool/pex/blob/v2.96.2/CHANGES.md
 Project-URL: Documentation, https://docs.pex-tool.org/
-Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.96.0
+Project-URL: Source, https://github.com/pex-tool/pex/tree/v2.96.2
 Keywords: package,executable,virtualenv,lock,freeze
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers

{pex-2.96.0 → pex-2.96.2}/docker/base/Dockerfile

@@ -1,5 +1,6 @@
 # An image with the necessary binaries and libraries to develop pex.
-FROM ubuntu:24.04
+ARG UBUNTU_VERSION=24.04
+FROM ubuntu:${UBUNTU_VERSION}
 
 # We use pyenv to bootstrap interpreters and pyenv needs most of these packages.
 # See: https://github.com/pyenv/pyenv/wiki#suggested-build-environment
@@ -14,7 +15,7 @@ RUN apt update && \
     cargo \
     clang \
     curl \
-    git \
+    gpg-agent \
     libbz2-dev \
     libffi-dev \
     liblzma-dev \
@@ -24,8 +25,6 @@ RUN apt update && \
     libssl-dev \
     libxml2-dev \
     libxmlsec1-dev \
-    python3.12-dev \
-    python3.12-venv \
     software-properties-common \
     ssh \
     tk-dev \
@@ -33,8 +32,11 @@ RUN apt update && \
     xz-utils \
     zlib1g-dev
 
-COPY install_pythons.sh /root/
-RUN /root/install_pythons.sh
+# Setup a modern git:
+RUN add-apt-repository --yes ppa:git-core/ppa && \
+    apt update && \
+    DEBIAN_FRONTEND=noninteractive apt install --yes --no-install-recommends git && \
+    add-apt-repository --yes --remove ppa:git-core/ppa
 
 # Setup a modern uv:
 RUN curl -LsSf https://astral.sh/uv/install.sh | UV_INSTALL_DIR=/usr/bin sh
@@ -54,4 +56,10 @@ RUN mkdir -p -m 755 /etc/apt/keyrings && \
     echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | \
       tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
     apt update && \
-    DEBIAN_FRONTEND=noninteractive apt install --yes --no-install-recommends gh -y
+    DEBIAN_FRONTEND=noninteractive apt install --yes --no-install-recommends gh -y
+
+ARG PYTHONS=new
+COPY install-pythons.py /root/install-pythons.py
+COPY ${PYTHONS}-versions.toml /root/versions.toml
+RUN uv run /root/install-pythons.py /root/versions.toml && \
+    uv python uninstall --all

pex-2.96.2/docker/base/install-pythons.py

@@ -0,0 +1,246 @@
+# Copyright 2026 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+# /// script
+# requires-python = "==3.11.*"
+# ///
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Iterable, Iterator
+
+import tomllib
+
+
+def parse_str_field(subject: str, name: str, data: dict[str, Any]) -> str:
+    try:
+        value = data.pop(name)
+    except KeyError:
+        raise InstallError(f"A {subject} must define a `{name}` field.")
+    if not isinstance(value, str):
+        raise InstallError(
+            f"The `{name}` field must be a string; given {value} of type {type(value)}."
+        )
+    return value
+
+
+def parse_list_field(subject: str, name: str, data: dict[str, Any]) -> list[Any]:
+    try:
+        values = data.pop(name)
+    except KeyError:
+        raise InstallError(f"A {subject} must define a `{name}` field.")
+    if not isinstance(values, list):
+        raise InstallError(
+            f"The `{name}` field must be a list; given {values} of type {type(values)}."
+        )
+    return values
+
+
+def parse_str_list_field(subject: str, name: str, data: dict[str, Any]) -> list[str]:
+    values = parse_list_field(subject, name, data)
+    if not all(isinstance(value, str) for value in values):
+        raise InstallError(
+            f"The `{name}` field must be a list of strings; given {values} which contains "
+            f"non-strings."
+        )
+    return values
+
+
+# See: https://launchpad.net/~deadsnakes/+archive/ubuntu/ppa
+@dataclass(frozen=True)
+class DeadSnake:
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> DeadSnake:
+        subject = "Dead Snakes version"
+        version = parse_str_field(subject=subject, name="version", data=data)
+        packages = parse_str_list_field(subject=subject, name="packages", data=data)
+        if data:
+            raise InstallError(f"Unrecognized Dead Snakes fields: {', '.join(data.keys())}")
+        return cls(precise_version=version, packages=packages)
+
+    precise_version: str
+    packages: list[str]
+
+    def iter_packages(self) -> Iterator[str]:
+        version = ".".join(self.precise_version.split(".")[:2])
+        for package in self.packages:
+            yield f"python{version}-{package}={self.precise_version}*"
+
+
+def install_deadsnakes_versions(
+    dead_snakes: Iterable[DeadSnake], uninstall: Iterable[str] = ()
+) -> None:
+    env = {**os.environ, "DEBIAN_FRONTEND": "noninteractive"}
+    if dead_snakes:
+        subprocess.run(
+            args=["add-apt-repository", "--yes", "ppa:deadsnakes/ppa"], env=env, check=True
+        )
+
+        packages = [package for dead_snake in dead_snakes for package in dead_snake.iter_packages()]
+        subprocess.run(args=["apt", "install", "--yes", *packages], env=env, check=True)
+
+        subprocess.run(
+            args=["add-apt-repository", "--yes", "--remove", "ppa:deadsnakes/ppa"],
+            env=env,
+            check=True,
+        )
+
+    subprocess.run(
+        args=["apt", "remove", "--yes", "software-properties-common", *uninstall],
+        env=env,
+        check=True,
+    )
+    subprocess.run(args=["apt", "autoremove", "--yes"], env=env, check=True)
+
+
+# See: https://github.com/pyenv/pyenv
+PYENV_ROOT = Path("/pyenv")
+PYENV_REPO = os.environ.get("PYENV_REPO", "https://github.com/pyenv/pyenv")
+PYENV_SHA = os.environ.get("PYENV_SHA", "HEAD")
+PYENV_ENV = {**os.environ, "PYENV_ROOT": str(PYENV_ROOT)}
+
+
+@dataclass(frozen=True)
+class Pyenv:
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> Pyenv:
+        version = parse_str_field(subject="Pyenv version", name="version", data=data)
+        if data:
+            raise InstallError(f"Unrecognized pyenv fields: {', '.join(data.keys())}")
+        return cls(version=version)
+
+    version: str
+    exe: str = field(init=False)
+    exe_path: Path = field(init=False)
+
+    def __post_init__(self):
+        if self.version.startswith("pypy"):
+            exe = self.version.split("-")[0]
+        else:
+            major, minor = self.version.split(".")[:2]
+            exe = f"python{major}.{minor}"
+        object.__setattr__(self, "exe", exe)
+        object.__setattr__(self, "exe_path", PYENV_ROOT / "versions" / self.version / "bin" / exe)
+
+
+def install_pyenv() -> None:
+    subprocess.run(args=["git", "clone", "--depth", "1", PYENV_REPO, PYENV_ROOT], check=True)
+    subprocess.run(args=["git", "checkout", PYENV_SHA], cwd=PYENV_ROOT, check=True)
+    subprocess.run(args=["src/configure"], env=PYENV_ENV, cwd=PYENV_ROOT, check=True)
+    subprocess.run(args=["make", "-C", "src"], env=PYENV_ENV, cwd=PYENV_ROOT, check=True)
+
+
+def install_pyenv_versions(pyenvs: Iterable[Pyenv]) -> None:
+    if not pyenvs:
+        return
+
+    install_pyenv()
+    subprocess.run(
+        args=[
+            PYENV_ROOT / "bin" / "pyenv",
+            "install",
+            "--force",
+            *(pyenv.version for pyenv in pyenvs),
+        ],
+        env=PYENV_ENV,
+        check=True,
+    )
+    for pyenv in pyenvs:
+        if not pyenv.exe_path.is_file() or not os.access(pyenv.exe_path, os.R_OK | os.X_OK):
+            raise InstallError(
+                f"For pyenv version {pyenv.version}, expected Python exe path does not exist:\n"
+                f"  {pyenv.exe_path}"
+            )
+        os.symlink(pyenv.exe_path, f"/usr/bin/{pyenv.exe}")
+
+
+@dataclass(frozen=True)
+class Versions:
+    @classmethod
+    def parse(cls, versions_file: Path) -> Versions:
+        with versions_file.open(mode="rb") as fp:
+            data = tomllib.load(fp)
+
+        subject = "Versions config file"
+        default_python_exe_name = parse_str_field(
+            subject=subject, name="default-version", data=data
+        )
+        pyenv_versions: list[Pyenv] = []
+        deadsnakes_versions: list[DeadSnake] = []
+        for index, version in enumerate(
+            parse_list_field(subject=subject, name="versions", data=data)
+        ):
+            if not isinstance(version, dict):
+                raise InstallError(
+                    f"The `versions` field must be a list of tables; "
+                    f"item {index} is {version} of type {type(version)}."
+                )
+            match parse_str_field(
+                subject=f"{subject} `versions` field item {index}", name="source", data=version
+            ):
+                case "dead-snakes":
+                    try:
+                        deadsnakes_versions.append(DeadSnake.from_dict(version))
+                    except InstallError as e:
+                        raise InstallError(
+                            f"Invalid `versions` field dead-snakes item {index}: {e}"
+                        )
+                case "pyenv":
+                    try:
+                        pyenv_versions.append(Pyenv.from_dict(version))
+                    except InstallError as e:
+                        raise InstallError(f"Invalid `versions` field pyenv item {index}: {e}")
+                case other:
+                    raise InstallError(
+                        f"The `versions` field item {index} has unrecognized source of '{other}'; "
+                        f"must be either 'dead-snakes' or 'pyenv'."
+                    )
+        uninstall_packages = parse_str_list_field(
+            subject=subject, name="uninstall-packages", data=data
+        )
+        return cls(
+            default_python_exe_name=default_python_exe_name,
+            deadsnakes_versions=tuple(deadsnakes_versions),
+            pyenv_versions=tuple(pyenv_versions),
+            uninstall_packages=tuple(uninstall_packages),
+        )
+
+    default_python_exe_name: str
+    deadsnakes_versions: tuple[DeadSnake, ...]
+    pyenv_versions: tuple[Pyenv, ...]
+    uninstall_packages: tuple[str, ...]
+
+
+def install_pythons(versions: Versions) -> None:
+    install_deadsnakes_versions(versions.deadsnakes_versions, uninstall=versions.uninstall_packages)
+    install_pyenv_versions(versions.pyenv_versions)
+
+    default_python = shutil.which(versions.default_python_exe_name)
+    if default_python is None:
+        raise InstallError(
+            f"Expected default Python {versions.default_python_exe_name} does not exist"
+        )
+    os.symlink(default_python, "/usr/bin/python")
+
+
+class InstallError(Exception):
+    pass
+
+
+def main() -> Any:
+    if len(sys.argv) != 2:
+        raise InstallError(f"Usage: {sys.argv[0]} <versions config file>")
+    versions = Versions.parse(Path(sys.argv[1]))
+    install_pythons(versions)
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    except InstallError as e:
+        sys.exit(str(e))

pex-2.96.2/docker/base/new-versions.toml

@@ -0,0 +1,23 @@
+# N.B.: 2.7, 3.9 and 3.11 are needed in both version sets to run certain dev-cmd commands.
+
+default-version = "python3.14"
+versions = [
+    # N.B.: Old, but needed for some dev-cmd commands.
+    { source = "pyenv", version = "2.7.18" },
+    { source = "dead-snakes", version = "3.9.25", packages = ["dev", "venv", "distutils"] },
+
+    # New:
+    { source = "dead-snakes", version = "3.10.20", packages = ["dev", "venv", "distutils"] },
+    { source = "dead-snakes", version = "3.11.15", packages = ["dev", "venv"] },
+    { source = "pyenv", version = "3.12.13" },
+    { source = "dead-snakes", version = "3.13.14", packages = ["dev", "venv"] },
+    { source = "dead-snakes", version = "3.14.6", packages = ["dev", "venv"] },
+    { source = "dead-snakes", version = "3.15.0~b3", packages = ["dev", "venv"] },
+    { source = "pyenv", version = "pypy3.10-7.3.19" },
+    { source = "pyenv", version = "pypy3.11-7.3.22" },
+]
+
+# N.B.: These versions are installed on Ubuntu 24.04 which ships its own (older) CPython 3.12.
+uninstall-packages = [
+    "python3.12"
+]

pex-2.96.2/docker/base/old-versions.toml

@@ -0,0 +1,34 @@
+# N.B.: 2.7, 3.9 and 3.11 are needed in both version sets to run certain dev-cmd commands.
+
+# N.B.: These versions are installed on Ubuntu 20.04 and Dead Snakes only supports 22.04 and higher;
+# so we stick to pyenv.
+
+default-version = "python3.9"
+versions = [
+    # N.B.: New, but needed for some dev-cmd commands.
+    { source = "pyenv", version = "3.11.15" },
+
+    # Old:
+    { source = "pyenv", version = "2.7.18" },
+    { source = "pyenv", version = "3.5.10" },
+    { source = "pyenv", version = "3.6.15" },
+    { source = "pyenv", version = "3.7.17" },
+    { source = "pyenv", version = "3.8.20" },
+    { source = "pyenv", version = "3.9.25" },
+    { source = "pyenv", version = "pypy2.7-7.3.22" },
+    # This is served from:
+    #   https://bitbucket-archive.softwareheritage.org/static/14/140b7b14-aa94-424e-b191-9cd3438381f7/attachments/pypy3.5-7.0.0-linux_x86_64-portable.tar.bz2
+    # which has begun to prove flaky; so we comment out for now and perhaps need to drop or
+    # self-host:
+    # { source = "pyenv", version = "pypy3.5-7.0.0" },
+    # This is failing install for unknown reasons:
+    # { source = "pyenv", version = "pypy3.6-7.3.3" },
+    { source = "pyenv", version = "pypy3.7-7.3.9" },
+    { source = "pyenv", version = "pypy3.8-7.3.11" },
+    { source = "pyenv", version = "pypy3.9-7.3.16" },
+]
+
+# N.B.: These versions are installed on Ubuntu 20.04 which ships its own (older) CPython 3.8.
+uninstall-packages = [
+    "python3.8"
+]

{pex-2.96.0 → pex-2.96.2}/docker/cache/Dockerfile

@@ -1,10 +1,27 @@
 # A data image with the necessary binaries and libraries to develop pex.
-
+ARG PYTHONS=new
 ARG SEED_IMAGE=scratch
 FROM ${SEED_IMAGE} AS seed
 
 # Populate the ~/.pex_dev cache.
-FROM ghcr.io/pex-tool/pex/base:latest AS cache
+FROM ghcr.io/pex-tool/pex/base:latest-${PYTHONS} AS cache
+
+ARG USER
+ARG UID
+ARG GROUP
+ARG GID
+
+COPY create_docker_image_user.sh /root/
+RUN /root/create_docker_image_user.sh "${USER}" "${UID}" "${GROUP}" "${GID}" && \
+    mkdir -p /development "/var/cache/${USER}" && \
+    chown -R "${USER}:${GROUP}" /development "/var/cache/${USER}" && \
+    DEBIAN_FRONTEND=noninteractive apt install --yes --no-install-recommends sudo && \
+    echo "${USER}	ALL=(ALL:ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${USER}" && \
+    chmod 440 "/etc/sudoers.d/${USER}"
+
+USER "${USER}":"${GROUP}"
+ENV HOME="/home/${USER}"
+ENV XDG_CACHE_HOME="/var/cache/${USER}"
 
 ARG SEED_PATH=/
 ARG CACHE_PATH=/development/pex_dev
@@ -20,11 +37,11 @@ RUN git clone "${PEX_REPO}" /development/pex && \
     git reset --hard "${GIT_REF}"
 
 WORKDIR /development/pex
-COPY populate_cache.sh /root/
-COPY .env /root/
+COPY populate_cache.sh "${HOME}/"
+COPY .env "${HOME}/"
 COPY --from=seed ${SEED_PATH} ${CACHE_PATH}
-RUN chown -R $(id -u):$(id -g) ${CACHE_PATH} && \
-    ENV_FILE=/root/.env /root/populate_cache.sh ${CACHE_PATH} "${TEST_CMDS}" && \
+RUN sudo chown -R "${USER}:${GROUP}" "${CACHE_PATH}" "${XDG_CACHE_HOME}" && \
+    ENV_FILE="${HOME}/.env" "${HOME}/populate_cache.sh" ${CACHE_PATH} "${TEST_CMDS}" && \
     touch "${CACHE_PATH}/.fingerprint-${FINGERPRINT}"
 
 # Grab just the ~/.pex_dev cache files for the final data-only image.

{pex-2.96.0 → pex-2.96.2}/docker/user/Dockerfile

@@ -27,7 +27,7 @@ ENV _PEX_CACHE_WINDOWS_STUBS_DIR=${_PEX_TEST_DEV_ROOT}/windows_stubs
 
 # This will be a named volume used to persist caches on the host but isolated from the host caches.
 VOLUME /var/cache
-ENV XDG_CACHE_HOME=/var/cache
+ENV XDG_CACHE_HOME=/var/cache/${USER}
 
 # This will be a named volume used to persist the pytest tmp tree (/tmp/pytest-of-$USER/) for use \
 # in `./duvrc.sh inspect` sessions.

{pex-2.96.0 → pex-2.96.2}/duvrc.sh

@@ -4,27 +4,57 @@ set -euo pipefail
 
 ROOT="$(git rev-parse --show-toplevel)"
 
+if echo $0 | grep -E '\-old.sh$' >/dev/null; then
+  BASE_PYTHONS=old
+else
+  BASE_PYTHONS="${BASE_PYTHONS:-new}"
+fi
+
+if [[ "${BASE_PYTHONS}" == "new" ]]; then
+  UBUNTU_VERSION=24.04
+else
+  UBUNTU_VERSION=20.04
+fi
+
+CACHE_TAG="${CACHE_TAG:-latest-${BASE_PYTHONS}}"
+VOLUME_DEV_CACHES="pex-dev-caches-${BASE_PYTHONS}"
+VOLUME_XDG_CACHES="pex-xdg-caches-${BASE_PYTHONS}"
+VOLUME_TMP_CACHES="pex-tmp-${BASE_PYTHONS}"
+VOLUME_VENV="pex-venv-${BASE_PYTHONS}"
+VOLUME_DEV_CMD="pex-dev-cmd-${BASE_PYTHONS}"
+
 BASE_MODE="${BASE_MODE:-build}"
 CACHE_MODE="${CACHE_MODE:-}"
-CACHE_TAG="${CACHE_TAG:-latest}"
 
 BASE_INPUT=(
   "${ROOT}/docker/base/Dockerfile"
-  "${ROOT}/docker/base/install_pythons.sh"
+  "${ROOT}/docker/base/install-pythons.py"
 )
+if [[ "${BASE_PYTHONS}" == "new" ]]; then
+  BASE_INPUT+=(
+    "${ROOT}/docker/base/new-versions.toml"
+  )
+else
+  BASE_INPUT+=(
+    "${ROOT}/docker/base/old-versions.toml"
+  )
+fi
 base_hash=$(cat "${BASE_INPUT[@]}" | git hash-object -t blob --stdin)
 
 function base_image_id() {
-  docker image ls -q "ghcr.io/pex-tool/pex/base:${base_hash}"
+  docker image ls -q "ghcr.io/pex-tool/pex/base:${BASE_PYTHONS}-${base_hash}"
 }
 
 if [[ "${BASE_MODE}" == "build" && -z "$(base_image_id)" ]]; then
   docker build \
+    --build-arg "UBUNTU_VERSION=${UBUNTU_VERSION}" \
+    --build-arg "PYTHONS=${BASE_PYTHONS}" \
     --tag ghcr.io/pex-tool/pex/base:latest \
-    --tag "ghcr.io/pex-tool/pex/base:${base_hash}" \
+    --tag "ghcr.io/pex-tool/pex/base:latest-${BASE_PYTHONS}" \
+    --tag "ghcr.io/pex-tool/pex/base:${BASE_PYTHONS}-${base_hash}" \
     "${ROOT}/docker/base"
 elif [[ "${BASE_MODE}" == "pull" ]]; then
-  docker pull "ghcr.io/pex-tool/pex/base:${base_hash}"
+  docker pull "ghcr.io/pex-tool/pex/base:${BASE_PYTHONS}-${base_hash}"
 fi
 
 CONTAINER_HOME="/home/$(id -un)"
@@ -34,40 +64,45 @@ USER_INPUT=(
   "${ROOT}/docker/user/create_docker_image_user.sh"
 )
 user_hash=$(cat "${USER_INPUT[@]}" | git hash-object -t blob --stdin)
+USER_CACHE_DIR="/var/cache/$(id -un)"
+
+function fix_perms() {
+  docker run \
+      --rm \
+      --volume "${VOLUME_DEV_CACHES}:/development/pex_dev" \
+      --volume "${VOLUME_XDG_CACHES}:${USER_CACHE_DIR}" \
+      --volume "${VOLUME_TMP_CACHES}:/tmp" \
+      --volume "${VOLUME_VENV}:/development/pex/.venv" \
+      --volume "${VOLUME_DEV_CMD}:/development/pex/.dev-cmd" \
+      --entrypoint bash \
+      --user root \
+      "pex-tool/pex/user:${BASE_PYTHONS}-${user_hash}" \
+      -c "
+        chown -R $(id -un):$(id -gn) \
+        /development/pex_dev \
+        ${USER_CACHE_DIR} \
+        /tmp \
+        /development/pex/.venv \
+        /development/pex/.dev-cmd
+      "
+}
 
 function user_image_id() {
-  docker image ls -q "pex-tool/pex/user:${user_hash}"
+  docker image ls -q "pex-tool/pex/user:${BASE_PYTHONS}-${user_hash}"
 }
 
 if [[ -z "$(user_image_id)" ]]; then
   docker build \
-    --build-arg BASE_IMAGE_TAG="${base_hash}" \
+    --build-arg BASE_IMAGE_TAG="${BASE_PYTHONS}-${base_hash}" \
     --build-arg USER="$(id -un)" \
     --build-arg UID="$(id -u)" \
     --build-arg GROUP="$(id -gn)" \
     --build-arg GID="$(id -g)" \
     --tag pex-tool/pex/user:latest \
-    --tag "pex-tool/pex/user:${user_hash}" \
+    --tag "pex-tool/pex/user:latest-${BASE_PYTHONS}" \
+    --tag "pex-tool/pex/user:${BASE_PYTHONS}-${user_hash}" \
     "${ROOT}/docker/user"
-
-  docker run \
-    --rm \
-    --volume pex-dev-caches:/development/pex_dev \
-    --volume pex-xdg-caches:/var/cache \
-    --volume pex-tmp:/tmp \
-    --volume pex-venv:/development/pex/.venv \
-    --volume pex-dev-cmd:/development/pex/.dev-cmd \
-    --entrypoint bash \
-    --user root \
-    "pex-tool/pex/user:${user_hash}" \
-    -c "
-      chown -R $(id -un):$(id -gn) \
-      /development/pex_dev \
-      /var/cache \
-      /tmp \
-      /development/pex/.venv \
-      /development/pex/.dev-cmd
-    "
+  fix_perms
 fi
 
 if [[ "${CACHE_MODE}" == "pull" ]]; then
@@ -75,20 +110,14 @@ if [[ "${CACHE_MODE}" == "pull" ]]; then
   # with the contents of a data-only image. In particular, starting with an empty named volume is
   # required to get the subsequent no-op `docker run --volume pex-dev-caches:...` to populate that
   # volume. This population only happens under that condition.
-  docker volume rm --force pex-dev-caches
-  docker volume create pex-dev-caches
+  docker volume rm --force ${VOLUME_DEV_CACHES}
+  docker volume create ${VOLUME_DEV_CACHES}
   docker run \
     --rm \
-    --volume pex-dev-caches:/development/pex_dev \
+    --volume "${VOLUME_DEV_CACHES}:/development/pex_dev" \
     --pull always \
     "ghcr.io/pex-tool/pex/cache:${CACHE_TAG}" true || true
-  docker run \
-    --rm \
-    --volume pex-dev-caches:/development/pex_dev \
-    --entrypoint bash \
-    --user root \
-    "pex-tool/pex/user:${user_hash}" \
-    -c "chown -R $(id -u):$(id -g) /development/pex_dev"
+  fix_perms
 fi
 
 DOCKER_ARGS=()
@@ -111,6 +140,12 @@ for env_var in $(/usr/bin/env | grep -E "^(_PEX_|SCIENCE_)"); do
     --env "${env_var}"
   )
 done
+# Testing also looks at CI.
+if [[ -n "${CI:-}" ]]; then
+  DOCKER_ARGS+=(
+      --env "CI=${CI}"
+  )
+fi
 
 if [[ -n "${GH_TOKEN:-}" ]]; then
   # Some tests in CI may need access to the GH_TOKEN.
@@ -157,15 +192,16 @@ if [[ -d "${HOME}/.ssh" ]]; then
   )
 fi
 
+
 exec docker run \
   --rm \
-  --volume pex-tmp:/tmp \
-  --volume pex-xdg-caches:/var/cache \
-  --volume pex-dev-caches:/development/pex_dev \
   --volume "${ROOT}:/development/pex" \
-  --volume pex-venv:/development/pex/.venv \
-  --volume pex-dev-cmd:/development/pex/.dev-cmd \
+  --volume "${VOLUME_DEV_CACHES}:/development/pex_dev" \
+  --volume "${VOLUME_XDG_CACHES}:${USER_CACHE_DIR}" \
+  --volume "${VOLUME_TMP_CACHES}:/tmp" \
+  --volume "${VOLUME_VENV}:/development/pex/.venv" \
+  --volume "${VOLUME_DEV_CMD}:/development/pex/.dev-cmd" \
   "${DOCKER_ARGS[@]}" \
-  "pex-tool/pex/user:${user_hash}" \
+  "pex-tool/pex/user:${BASE_PYTHONS}-${user_hash}" \
   "$@"