Dockerfile

# python-agent-driver — Python runtime driver for Hyperlight.
#
# Same deps as python-agent (numpy + pandas + the usual stack) PLUS
# a small C program `hl_pydriver` that embeds libpython3.12, does
# Py_Initialize + warm-up imports on its first invocation, and then
# installs an FC-aware dispatch callback that handles every
# subsequent host->guest call without re-running main().

ARG BASE=ghcr.io/hyperlight-dev/hyperlight-unikraft/python-base:latest

# Stage 1: Python deps (same as python-agent).
FROM python:3.12-slim AS deps
RUN pip install --target=/deps --no-cache-dir --prefer-binary \
    tqdm pyyaml jinja2 beautifulsoup4 tabulate click tenacity \
    python-dotenv pypdf openpyxl markdown-it-py pydantic pillow \
    lxml cryptography python-dateutil numpy pandas \
    python-docx python-pptx \
    chardet charset-normalizer \
    requests httpx aiohttp \
    feedparser markdown markdownify \
    Faker pycountry \
    loguru schedule send2trash \
    duckdb polars \
    xlrd xlsxwriter pyxlsb odfpy \
    pdfplumber pdfrw PyPDF2 \
    qrcode svgwrite \
    rapidfuzz \
    networkx sympy \
    pydub srt mutagen \
    plotly altair bokeh \
    statsmodels scikit-learn scipy \
    wordcloud \
    nltk textblob gensim \
    fastapi uvicorn hypercorn \
    typer pygments platformdirs distro \
    pytest pytest-cov pytest-asyncio coverage hypothesis \
    ruff pylint pyflakes bandit vulture radon rope \
    websockets \
    fpdf2 reportlab \
    APScheduler celery \
    numpy-financial docx2txt pipdeptree watchdog rarfile \
    boto3 google-api-python-client slack-sdk praw tweepy \
    scrapy trafilatura builtwith exchange-calendars \
    paramiko fabric pexpect gitpython
RUN set -eux; \
    find /deps -maxdepth 1 -type d -name '*.dist-info' -exec rm -rf {} + 2>/dev/null || true; \
    find /deps \( -type d -name tests -o -type d -name test \) -exec rm -rf {} + 2>/dev/null || true; \
    find /deps -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true; \
    find /deps -type f -name '*.pyc' -delete 2>/dev/null || true; \
    find /deps -name '*.so*' -exec strip --strip-unneeded {} + 2>/dev/null || true

# Stage 2: build hl_pydriver against the SAME Python 3.12-from-source
# that produces local-python-base, so the glibc/libpython3.12.so ABI
# matches the runtime.
FROM local-python-base-dev AS driver-build
COPY hl_pydriver.c /src/hl_pydriver.c
RUN PY_INC=$(python3.12 -c 'import sysconfig; print(sysconfig.get_path("include"))') && \
    PY_LIBDIR=$(python3.12 -c 'import sysconfig; print(sysconfig.get_config_var("LIBDIR"))') && \
    gcc -O2 -fPIE -pie -Wl,-E \
        -fno-stack-protector \
        -I$PY_INC \
        -o /src/hl_pydriver /src/hl_pydriver.c \
        -L$PY_LIBDIR \
        -Wl,-rpath,/usr/local/lib \
        -Wl,-rpath,/lib/x86_64-linux-gnu \
        -lpython3.12 -ldl -lpthread -lm -lutil

# Stage 3: assemble rootfs.
FROM ${BASE} AS rootfs
COPY --from=deps         /deps            /usr/local/lib/python3.12/site-packages
COPY --from=driver-build /src/hl_pydriver /bin/hl_pydriver
COPY pydoc_stub.py /usr/local/lib/python3.12/pydoc.py

# pip: the python-base image strips pip for size; bring it back from the
# deps stage (python:3.12-slim) so `python3 -m pip install` works as a
# subprocess.
COPY --from=deps /usr/local/lib/python3.12/site-packages/pip \
     /usr/local/lib/python3.12/site-packages/pip

# stdlib modules that python-base strips but pip needs at runtime
COPY --from=deps /usr/local/lib/python3.12/xmlrpc \
     /usr/local/lib/python3.12/xmlrpc


# Stage 4: pack CPIO.
FROM alpine:3.20 AS cpio
RUN apk add --no-cache cpio findutils ca-certificates
COPY --from=rootfs / /rootfs/

# DNS configuration for glibc's getaddrinfo
RUN mkdir -p /rootfs/etc && \
    echo "nameserver 8.8.8.8" > /rootfs/etc/resolv.conf && \
    echo "nameserver 8.8.4.4" >> /rootfs/etc/resolv.conf && \
    echo "hosts: files dns" > /rootfs/etc/nsswitch.conf && \
    echo "127.0.0.1 localhost" > /rootfs/etc/hosts

# CA certificates for TLS
RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/usr/lib/ssl && \
    cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/ && \
    ln -sf /etc/ssl/certs/ca-certificates.crt /rootfs/usr/lib/ssl/cert.pem

# pip configuration: disable version-check (no internet during warm-up)
RUN mkdir -p /rootfs/etc && \
    printf '[global]\ndisable-pip-version-check = true\n' > /rootfs/etc/pip.conf

# /tmp for pip's temp files during install
RUN mkdir -p /rootfs/tmp

# Busybox: use the static-PIE build from the shell-base image.
# Alpine's busybox-static is ET_EXEC (non-PIE) which the elfloader
# rejects; the shell-base image has a static-PIE (ET_DYN) build.
COPY --from=ghcr.io/hyperlight-dev/hyperlight-unikraft/shell-base:latest \
     /bin/busybox /rootfs/bin/busybox
RUN for cmd in sh echo ls cat grep find wc head tail sort cut sed awk \
               cp mv rm mkdir rmdir ln basename dirname env sleep date \
               hostname id uname whoami which test true tr uniq tee xargs; do \
        ln -sf busybox /rootfs/bin/$cmd; \
    done

RUN cd /rootfs && find . | cpio -o -H newc > /output.cpio 2>/dev/null