feat(pydriver): add busybox, pip support, and user_agent patch

Signed-off-by: danbugs <danilochiarlone@gmail.com>

Author: danbugs

examples/python-agent-driver/Dockerfile

@@ -48,6 +48,17 @@ RUN set -eux; \
     find /deps -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true; \
     find /deps -type f -name '*.pyc' -delete 2>/dev/null || true; \
     find /deps -name '*.so*' -exec strip --strip-unneeded {} + 2>/dev/null || true
+# Patch pip's user_agent() — the original probes platform/distro/libc/ssl
+# which triggers buddy allocator corruption in unikraft's memory manager.
+RUN python3 -c "\
+import re, pathlib, sys; \
+p = pathlib.Path('/usr/local/lib/python3.12/site-packages/pip/_internal/network/session.py'); \
+src = p.read_text(); \
+patched = re.sub(r'(def user_agent\(\)[^:]*:).*?(\n(?:def |class ))', \
+    r'\1\n    return \"pip/hyperlight\"\n\n\2', src, count=1, flags=re.DOTALL); \
+assert patched != src, 'pip user_agent() regex did not match — pip version changed?'; \
+p.write_text(patched)" && \
+    python3 -c "from pip._internal.network.session import user_agent; assert user_agent() == 'pip/hyperlight'"
 
 # Stage 2: build hl_pydriver against the SAME Python 3.12-from-source
 # that produces local-python-base, so the glibc/libpython3.12.so ABI
@@ -70,11 +81,47 @@ FROM ${BASE} AS rootfs
 COPY --from=deps         /deps            /usr/local/lib/python3.12/site-packages
 COPY --from=driver-build /src/hl_pydriver /bin/hl_pydriver
 COPY pydoc_stub.py /usr/local/lib/python3.12/pydoc.py
+# pip for in-guest package installation (vfork+execve subprocess)
+COPY --from=deps /usr/local/lib/python3.12/site-packages/pip /usr/local/lib/python3.12/site-packages/pip
+COPY --from=deps /usr/local/lib/python3.12/ensurepip /usr/local/lib/python3.12/ensurepip
+# stdlib modules needed by pip but missing from python-base
+COPY --from=deps /usr/local/lib/python3.12/xmlrpc /usr/local/lib/python3.12/xmlrpc
+COPY --from=deps /usr/local/lib/python3.12/zipapp.py /usr/local/lib/python3.12/zipapp.py
+# DNS-over-TCP resolver and pip target path (vfork subprocess support)
+COPY rootfs/usr/local/lib/python3.12/sitecustomize.py /usr/local/lib/python3.12/sitecustomize.py
+COPY rootfs/etc/pip.conf /etc/pip.conf
+
+# Stage 3b: build static PIE busybox (elfloader only supports ET_DYN).
+FROM debian:bookworm-slim AS utils-build
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        gcc libc6-dev make wget bzip2 ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+RUN wget -q https://busybox.net/downloads/busybox-1.36.1.tar.bz2 && \
+    tar xf busybox-1.36.1.tar.bz2 && cd busybox-1.36.1 && \
+    make defconfig && \
+    sed -i 's/CONFIG_TC=y/# CONFIG_TC is not set/' .config && \
+    sed -i 's/# CONFIG_STATIC is not set/CONFIG_STATIC=y/' .config && \
+    sed -i 's|CONFIG_EXTRA_CFLAGS=""|CONFIG_EXTRA_CFLAGS="-fPIE -fPIC"|' .config && \
+    make -j$(nproc) && \
+    gcc -fPIE -fPIC -static-pie -o /busybox \
+      -Wl,--sort-common -Wl,--sort-section -Wl,alignment \
+      -Wl,--start-group \
+      applets/built-in.o \
+      $(find . -name 'lib.a' -path './*/lib.a' | sort) \
+      -Wl,--end-group \
+      -lm -lresolv && \
+    strip /busybox
 
 # Stage 4: pack CPIO.
 FROM alpine:3.20 AS cpio
 RUN apk add --no-cache cpio findutils ca-certificates
 COPY --from=rootfs / /rootfs/
+COPY --from=utils-build /busybox /rootfs/bin/busybox
+RUN cd /rootfs && for cmd in sh cat ls cp mv rm mkdir rmdir ln head tail wc \
+        grep sed awk sort uniq tr cut tee xargs find test basename dirname \
+        env which id whoami uname hostname date sleep echo true; do \
+        ln -sf busybox bin/$cmd; \
+    done
 
 # DNS configuration for glibc's getaddrinfo
 RUN mkdir -p /rootfs/etc && \