mirror of
https://github.com/dataforcanada/d4c-datapkg-orthoimagery.git
synced 2026-10-02 04:05:43 +02:00
143 lines
7.1 KiB
Docker
143 lines
7.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# Stage 2: Python environment (uv-managed venv holding the repo's
|
|
# pyproject.toml + uv.lock dependency set — rioxarray, rasterio, xarray, dask,
|
|
# numpy, portolan-cli) on top of the stage-1 GDAL + ECW + MrSID image.
|
|
#
|
|
# To bump GDAL, change GDAL_VERSION (the base image tag) and rebuild. Nothing
|
|
# else here encodes the GDAL version: rasterio is compiled against whatever
|
|
# `gdal-config` the base image ships, and the build asserts that it matches.
|
|
# To change Python packages, edit ../../pyproject.toml (via `uv add`) and commit
|
|
# the regenerated ../../uv.lock; `uv sync --locked` below will pick them up.
|
|
#
|
|
# The build context is the REPO ROOT, not this directory, because pyproject.toml
|
|
# and uv.lock live there. .dockerignore keeps that context tiny — data/ and
|
|
# scripts/ hold hundreds of GB of imagery and are excluded.
|
|
#
|
|
# Build (from the repo root):
|
|
# docker/python/build.sh
|
|
# # or by hand:
|
|
# docker buildx build --platform linux/amd64 \
|
|
# --build-arg GDAL_VERSION=3.13.3 \
|
|
# --file docker/python/Dockerfile \
|
|
# -t dataforcanada/gdal-ecw-mrsid-python:3.13.3 .
|
|
|
|
ARG GDAL_VERSION=3.13.3
|
|
ARG GDAL_IMAGE=dataforcanada/gdal-ecw-mrsid
|
|
ARG UV_VERSION=0.12.13
|
|
|
|
# uv ships as a static binary in a scratch image; copying it in is the
|
|
# documented install method for Docker and avoids a curl|sh.
|
|
FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
|
|
|
|
FROM ${GDAL_IMAGE}:${GDAL_VERSION}
|
|
ARG GDAL_VERSION
|
|
ARG TARGETARCH
|
|
|
|
# ---- linux/amd64 only --------------------------------------------------------
|
|
# The ECW and MrSID SDKs are x86_64 binaries and the upstream GDAL Dockerfile
|
|
# only installs them on x86_64, so on any other architecture the base image
|
|
# would silently lack both drivers. Fail here, before doing any work.
|
|
RUN if [ "${TARGETARCH:-}" != "amd64" ] || [ "$(uname -m)" != "x86_64" ]; then \
|
|
echo "ERROR: this image is linux/amd64 only (TARGETARCH=${TARGETARCH:-unset}, uname -m=$(uname -m))." >&2; \
|
|
echo " The ECW and MrSID SDKs are x86_64 binaries; build with --platform linux/amd64 on an x86_64 host." >&2; \
|
|
exit 1; \
|
|
fi
|
|
|
|
# ---- build deps for compiling rasterio against the image's GDAL -------------
|
|
# Deliberately NOT installing libgdal-dev: the base image already provides
|
|
# gdal-config, the headers and libgdal.so for the pinned GDAL. Ubuntu's
|
|
# libgdal-dev would install a *second*, driver-less GDAL next to it, which is
|
|
# exactly the shadowing this image exists to prevent (see the warning in
|
|
# GDAL's docker/README.md). git is for the dev-container use case.
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
export DEBIAN_FRONTEND=noninteractive \
|
|
&& apt-get update -y \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
python3-dev \
|
|
git \
|
|
openssh-client
|
|
|
|
# Guard: gdal-config must be the pinned GDAL, and no apt GDAL may be present.
|
|
RUN test "$(gdal-config --version)" = "${GDAL_VERSION}" \
|
|
|| { echo "ERROR: gdal-config --version is '$(gdal-config --version)', expected '${GDAL_VERSION}'" >&2; exit 1; } \
|
|
&& if dpkg-query -W -f '${Status} ${Package}\n' 'libgdal*' 2>/dev/null | grep '^install ok installed'; then \
|
|
echo "ERROR: apt-provided GDAL packages are installed (above); they would shadow the built GDAL. Refusing to build." >&2; \
|
|
exit 1; \
|
|
fi
|
|
|
|
COPY --from=uv /uv /uvx /usr/local/bin/
|
|
# Image-wide default: never install wheels that bundle libgdal (see file).
|
|
COPY docker/python/uv.toml /etc/uv/uv.toml
|
|
|
|
# ---- non-root runtime user ---------------------------------------------------
|
|
# Ubuntu 26.04 ships a stock "ubuntu" user at uid 1000; drop it so USER_UID can
|
|
# default to 1000 (what dev-container UID remapping and most hosts expect).
|
|
ARG USERNAME=d4c
|
|
ARG USER_UID=1000
|
|
ARG USER_GID=${USER_UID}
|
|
RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
|
|
&& groupadd --gid "${USER_GID}" "${USERNAME}" \
|
|
&& useradd --uid "${USER_UID}" --gid "${USER_GID}" --create-home --shell /bin/bash "${USERNAME}" \
|
|
&& mkdir -p /opt/venv \
|
|
&& chown "${USER_UID}:${USER_GID}" /opt/venv \
|
|
&& echo "source /usr/share/bash-completion/bash_completion" >> "/home/${USERNAME}/.bashrc"
|
|
|
|
COPY --chmod=0755 docker/python/verify_gdal_drivers.py /usr/local/bin/verify-gdal-drivers
|
|
|
|
# VIRTUAL_ENV/PATH: the venv is the default python for everything downstream.
|
|
# UV_PROJECT_ENVIRONMENT: point uv's *project* interface at that same venv, so
|
|
# `uv sync`/`uv add`/`uv run` in the repo update /opt/venv instead of creating
|
|
# a ./.venv next to pyproject.toml — both in this build and, more importantly,
|
|
# in the dev container, where the workspace is bind-mounted.
|
|
# UV_PYTHON_DOWNLOADS=never: always use the system interpreter, never a
|
|
# uv-managed one.
|
|
# GDAL_CONFIG: what rasterio's setup.py consults; explicit rather than PATH luck.
|
|
# D4C_GDAL_VERSION: what verify-gdal-drivers checks against at runtime.
|
|
# (Not named GDAL_VERSION: rasterio's setup.py treats that as an override.)
|
|
# (No UV_NO_BINARY_PACKAGE here on purpose: it does not apply to
|
|
# `uv pip install`. /etc/uv/uv.toml covers both interfaces image-wide, and
|
|
# pyproject.toml's [tool.uv] covers the project interface for this repo.)
|
|
ENV VIRTUAL_ENV=/opt/venv \
|
|
PATH=/opt/venv/bin:${PATH} \
|
|
UV_PROJECT_ENVIRONMENT=/opt/venv \
|
|
UV_PYTHON_DOWNLOADS=never \
|
|
UV_LINK_MODE=copy \
|
|
UV_COMPILE_BYTECODE=1 \
|
|
GDAL_CONFIG=/usr/bin/gdal-config \
|
|
D4C_GDAL_VERSION=${GDAL_VERSION}
|
|
|
|
USER ${USERNAME}
|
|
WORKDIR /home/${USERNAME}
|
|
|
|
# ---- venv + packages ---------------------------------------------------------
|
|
# The repo's pyproject.toml + uv.lock are the single source of truth for this
|
|
# environment; `--locked` fails the build if they have drifted apart, so the
|
|
# image can never be built from an unlocked (i.e. unreproducible) dependency
|
|
# set. The lock pins the whole transitive tree, not just the direct deps.
|
|
#
|
|
# --no-binary-package is the critical bit: the PyPI wheels for rasterio and
|
|
# pyogrio (the latter pulled in by portolan-cli) bundle their own libgdal, built
|
|
# without ECW/MrSID. Building the sdists makes them link against this image's
|
|
# libgdal via gdal-config. Both pyproject.toml's [tool.uv] and /etc/uv/uv.toml
|
|
# already say this; the flags are belt-and-braces. (`uv sync`/`uv add` take
|
|
# `--no-binary-package <pkg>`; `uv pip install` takes pip-style `--no-binary`.)
|
|
COPY --chown=${USER_UID}:${USER_GID} pyproject.toml uv.lock /tmp/project/
|
|
RUN --mount=type=cache,target=/home/${USERNAME}/.cache/uv,uid=${USER_UID},gid=${USER_GID} \
|
|
uv venv --python /usr/bin/python3 "${VIRTUAL_ENV}" \
|
|
&& uv sync --project /tmp/project --locked --no-dev \
|
|
--no-binary-package rasterio --no-binary-package pyogrio \
|
|
&& rm -rf /tmp/project
|
|
|
|
# ---- verification: the build fails unless all of these hold ------------------
|
|
# gdalinfo --formats lists ECW and MrSID
|
|
# rasterio.__gdal_version__ == GDAL_VERSION
|
|
# rasterio.Env().drivers() includes ECW and MrSID
|
|
# pyogrio.__gdal_version_string__ == GDAL_VERSION
|
|
# (+ exactly one libgdal, the system one, is loaded; rioxarray round-trips)
|
|
RUN verify-gdal-drivers --expect-gdal "${GDAL_VERSION}"
|
|
|
|
CMD ["/bin/bash", "-l"]
|