Skip to content

fix: python install is not required as it is ran using a sidecar #353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ruromero merged 2 commits into from
Jan 20, 2026
Merged

fix: python install is not required as it is ran using a sidecar #353

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7f398a9
fix: python install is not required as it is ran using a sidecar
ruromero Jan 19, 2026
5932f1d
chore: update python instructions for sidecars and fix yarn versions
ruromero Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 3 additions & 7 deletions docker-image/Dockerfiles/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ ARG IMAGE_CREATED

# Open Container Initiative (OCI) metadata labels
LABEL org.opencontainers.image.source=https://github.com/guacsec/trustify-da-javascript-client
LABEL org.opencontainers.image.description="Trustify Dependency Analytics JavaScript Client - Container image for dependency analysis and vulnerability scanning supporting Maven, NPM, Golang, Gradle, Pnpm, Yarn, and Python ecosystems"
LABEL org.opencontainers.image.description="Trustify Dependency Analytics JavaScript Client - Container image for dependency analysis and vulnerability scanning supporting Maven, NPM, Golang, Gradle, Pnpm and Yarn ecosystems"
LABEL org.opencontainers.image.licenses=Apache-2.0
LABEL org.opencontainers.image.title="Trustify Dependency Analytics JavaScript Client"
LABEL org.opencontainers.image.vendor="guacsec"
Expand All @@ -89,8 +89,6 @@ LABEL org.opencontainers.image.created="${IMAGE_CREATED}"
ENV TRUSTIFY_DA_PIP_FREEZE=''
# contains pip show data for all packages, base64 encoded
ENV TRUSTIFY_DA_PIP_SHOW=''
# indicate whether to use the virtual environment for python packages
ENV TRUSTIFY_DA_PYTHON_VIRTUAL_ENV='true'

# Copy OpenJDK (Temurin) from the builder stage
COPY --from=builder /usr/temurin-21/ /usr/temurin-21/
Expand All @@ -112,11 +110,9 @@ ENV GRADLE_HOME=/usr/gradle-9.2.1
COPY --from=builder /usr/local/corepack/ /usr/local/corepack/
ENV COREPACK_HOME=/usr/local/corepack/cache

# Install Python via microdnf, create yarn wrapper scripts, and fix permissions
# Create yarn wrapper scripts, and fix permissions
USER root
RUN microdnf install -y python3 python3-pip \
&& microdnf clean all \
&& chown -R 1001:0 /usr/local/corepack/cache \
RUN chown -R 1001:0 /usr/local/corepack/cache \
&& chmod -R g+rwX /usr/local/corepack/cache \
&& printf '#!/bin/sh\nexec corepack yarn@1.22.22 "$@"\n' > /usr/local/bin/yarn-classic \
&& printf '#!/bin/sh\nexec corepack yarn@4.9.1 "$@"\n' > /usr/local/bin/yarn-berry \
Expand Down
11 changes: 8 additions & 3 deletions docker-image/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,14 @@ Gradle | 9.2.1 |
Go | 1.25.5 |
NPM | 11.6.2 |
PNPM | 10.1.0 |
Yarn Classic | 4.9.1 |
Yarn Berry | 1.22.22 |
Python | 3.9.25 |
Yarn Classic | 1.22.22 |
Yarn Berry | 4.9.1 |
Python | n/a |

### Note for Python users

This container image doesn't come with Python or Pip installed. It is suggested that you run `pip install` and `pip freeze` in a previous step like a sidecar (see [Tekton sidecars](https://tekton.dev/docs/pipelines/tasks/#using-a-sidecar-in-a-task)) where you can specify exactly which Python version
your project requires and generate the required dependency data.

## Usage Notes

Expand Down
Loading