Dockerfile

# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7
# check=error=true

FROM local-image/shared/statsd-exporter AS statsd_exporter-builder

FROM local-image/stackable-devel AS opa-authorizer-builder

ARG PYTHON_VERSION

COPY superset/stackable/opa-authorizer /tmp/opa-authorizer

RUN <<EOF
microdnf update
microdnf install \
    gcc \
    gcc-c++ \
    python${PYTHON_VERSION} \
    python${PYTHON_VERSION}-devel \
    python${PYTHON_VERSION}-pip
microdnf clean all
rm -rf /var/cache/yum

pip${PYTHON_VERSION} install \
    --no-cache-dir \
    --upgrade \
    poetry==2.1.1 \
    pytest==8.3.4

cd /tmp/opa-authorizer

poetry sync
poetry run pytest
poetry build
EOF

FROM local-image/stackable-devel AS builder

ARG PRODUCT_VERSION
ARG PYTHON_VERSION
ARG AUTHLIB_VERSION
ARG TARGETARCH
ARG TARGETOS
ARG CYCLONEDX_BOM_VERSION
ARG UV_VERSION
ARG NODEJS_VERSION
ARG STACKABLE_USER_UID

RUN microdnf module enable -y nodejs:${NODEJS_VERSION} && \
    microdnf update \
    && microdnf install \
        cyrus-sasl-devel \
        # Needed by ./configure to work out SQLite compilation flags, see snippet [1] at the end of file
        diffutils \
        # According to https://stackoverflow.com/q/19530974 normally sqlite3 should be shipped with the Python
        # distribution. However, while addig ARM support we noticed that this does not seem to be the case for the
        # Python installation shipped in the ARM image variant. So I guess Make is used to find out the sqlite
        # compilation flags (and propably to not build sqlite from source(?)), see snippet [1] at the end of file
        make \
        gcc \
        gcc-c++ \
        libffi-devel \
        openldap-devel \
        openssl-devel \
        python${PYTHON_VERSION} \
        python${PYTHON_VERSION}-devel \
        python${PYTHON_VERSION}-pip \
        python${PYTHON_VERSION}-wheel \
        libpq-devel \
        # Needed to build Superset UI assets
        npm \
        nodejs \
        # Needed to create the source code snapshot
        tar \
        # Needed by `npm run build`:
        which \
        zstd \
    && microdnf clean all && \
    rm -rf /var/cache/yum

COPY superset/stackable/constraints/${PRODUCT_VERSION}/constraints.txt /tmp/constraints.txt
COPY superset/stackable/constraints/${PRODUCT_VERSION}/build-constraints.txt /tmp/build-constraints.txt
COPY --from=opa-authorizer-builder /tmp/opa-authorizer/dist/opa_authorizer-0.1.0-py3-none-any.whl /tmp/

COPY --chown=${STACKABLE_USER_UID}:0 superset/stackable/patches/patchable.toml /stackable/src/superset/stackable/patches/patchable.toml
COPY --chown=${STACKABLE_USER_UID}:0 superset/stackable/patches/${PRODUCT_VERSION} /stackable/src/superset/stackable/patches/${PRODUCT_VERSION}

WORKDIR /stackable

# Upgrade pip to the latest version
# Also install uv to get support for build constraints
# DL3042 false-positive, --no-chache-dir is specified a few lines below.
#        See https://github.com/hadolint/hadolint/issues/1042.
# hadolint ignore=DL3042
RUN <<EOF
python${PYTHON_VERSION} -m venv --system-site-packages /stackable/app

source /stackable/app/bin/activate

# Upgrade pip to the latest version
# Also install uv to get support for build constraints
pip install --no-cache-dir --upgrade pip setuptools==75.2.0 uv==${UV_VERSION}

cd "$(/stackable/patchable --images-repo-root=src checkout superset ${PRODUCT_VERSION})"

# Create snapshot of the source code including custom patches
tar -czf /stackable/superset-${PRODUCT_VERSION}-src.tar.gz .

# Build front-end assets
cd superset-frontend

npm ci
npm run build

# Install build to properly handle pyproject.toml
uv pip install --no-cache-dir build

# Build superset wheel from superset root folder
# This picks up the UI assets from the npm build
cd ..
python${PYTHON_VERSION} -m build --wheel
uv pip install --no-cache-dir dist/apache_superset-*-py3-none-any.whl --constraint /tmp/constraints.txt --build-constraints /tmp/build-constraints.txt

# Install additional dependencies
# Add optional dependencies for use in custom Superset configurations.
# Since https://github.com/stackabletech/superset-operator/pull/530
# admins can add custom configuration to superset_conf.py.
# Redhat has removed `tzdata` from the ubi-minimal images: see https://bugzilla.redhat.com/show_bug.cgi?id=2223028.
# Superset relies on ZoneInfo (https://docs.python.org/3/library/zoneinfo.html#data-sources) to resolve time zones, and this is done
# by searching first under `TZPATH` (which is empty due to the point above) or for the tzdata python package.
# That package is therefore added here (airflow has tzdata in its list of dependencies, but superset does not).
uv pip install --no-cache-dir \
    gevent \
    psycopg2-binary \
    statsd \
    pydruid \
    python-ldap \
    'trino[sqlalchemy]' \
    Flask_OIDC==2.2.0 \
    Flask-OpenID==1.3.1 \
    tzdata

# We bumped this from 21.2.0 to 22.0.0 to fix CVE-2024-1135
# Superset 4.1.0 will contain at least 22.0.0, the bump was done in https://github.com/apache/superset/commit/4f693c6db0dc5c7286a36b8d23e90541943ff13f
# We only want to bump this for the 4.0.x line, as the others already have updated and we don't want to accidentially downgrade the version
if [[ "$PRODUCT_VERSION" =~ ^4\.0\..* ]]; then
    echo "Superset 4.0.x detected, installing gunicorn 22.0.0 to fix CVE-2024-1135"
    uv pip install gunicorn==22.0.0
fi

uv pip install --no-cache-dir \
    python-json-logger \
    cyclonedx-bom==${CYCLONEDX_BOM_VERSION}

if [ -n "$AUTHLIB_VERSION" ]; then
    uv pip install Authlib==${AUTHLIB_VERSION}
fi

uv pip install --no-cache-dir /tmp/opa_authorizer-0.1.0-py3-none-any.whl

cyclonedx-py environment --schema-version 1.5 --outfile /stackable/app/superset-${PRODUCT_VERSION}.cdx.json
uv pip uninstall cyclonedx-bom

# Clean up build artifacts and temporary files to reduce image size
cd /stackable
rm -rf ./src

chmod --recursive g=u /stackable
EOF

# Final image
FROM local-image/vector

ARG PRODUCT_VERSION
ARG PYTHON_VERSION
ARG RELEASE_VERSION
ARG STACKABLE_USER_UID
ARG SHARED_STATSD_EXPORTER_VERSION

LABEL name="Apache Superset" \
    maintainer="info@stackable.tech" \
    vendor="Stackable GmbH" \
    version="${PRODUCT_VERSION}" \
    release="${RELEASE_VERSION}" \
    summary="The Stackable image for Apache Superset." \
    description="This image is deployed by the Stackable Operator for Apache Superset."

ENV FLASK_APP="superset.app:create_app()" \
    FLASK_ENV="production" \
    HOME="/stackable" \
    SUPERSET_PORT="8088"
ENV PATH="${HOME}/app/bin:${PATH}" \
    PYTHONPATH="${HOME}/app/pythonpath"

COPY superset/licenses /licenses

COPY --from=builder --chown=${STACKABLE_USER_UID}:0 /stackable/ ${HOME}/

COPY --from=statsd_exporter-builder --chown=${STACKABLE_USER_UID}:0 /statsd_exporter/statsd_exporter /stackable/statsd_exporter
COPY --from=statsd_exporter-builder --chown=${STACKABLE_USER_UID}:0 /statsd_exporter/statsd_exporter-${SHARED_STATSD_EXPORTER_VERSION}.cdx.json /stackable/statsd_exporter-${SHARED_STATSD_EXPORTER_VERSION}.cdx.json

RUN <<EOF
microdnf update
microdnf install \
  cyrus-sasl \
  openldap \
  openldap-clients \
  openssl-libs \
  openssl-pkcs11 \
  "python${PYTHON_VERSION}"

microdnf clean all
rm -rf /var/cache/yum

chmod g=u /stackable/statsd_exporter /stackable/statsd_exporter-${SHARED_STATSD_EXPORTER_VERSION}.cdx.json
EOF

# ----------------------------------------
# Checks
# This section is to run final checks to ensure the created final images
# adhere to several minimal requirements like:
# - check file permissions and ownerships
# ----------------------------------------

# Check that permissions and ownership in ${HOME} are set correctly
# This will fail and stop the build if any mismatches are found.
RUN <<EOF
/bin/check-permissions-ownership.sh ${HOME} ${STACKABLE_USER_UID} 0
EOF

# ----------------------------------------
# Attention: Do not perform any file based actions (copying/creating etc.) below this comment because the permissions would not be checked.
# ----------------------------------------

USER ${STACKABLE_USER_UID}
WORKDIR ${HOME}

CMD ["/bin/sh", "-c", \
    "gunicorn \
    --bind 0.0.0.0:${SUPERSET_PORT} \
    --worker-class gthread \
    --threads 20 \
    --timeout 60 \
    --limit-request-line 0 \
    --limit-request-field_size 0 \
    'superset.app:create_app()'"]

# SNIPPET 1
# 60.38   × Getting requirements to build wheel did not run successfully.
# 60.38   │ exit code: 1
# 60.38   ╰─> [77 lines of output]
# 60.38       running egg_info
# 60.38       writing apsw.egg-info/PKG-INFO
# 60.38       writing dependency_links to apsw.egg-info/dependency_links.txt
# 60.38       writing top-level names to apsw.egg-info/top_level.txt
# 60.38         Getting the SQLite amalgamation
# 60.38           Fetching https://sqlite.org/2023/sqlite-autoconf-3420000.tar.gz
# 60.38           Length: 3148813  SHA1: 036575929b174c1b829769255491ba2b32bda9ee  MD5: 0c5a92bc51cf07cae45b4a1e94653dea
# 60.38           Checksums verified
# 60.38       /usr/lib64/python3.9/tarfile.py:2239: RuntimeWarning: The default behavior of tarfile extraction has been changed to disallow common exploits (including CVE-2007-4559). By default, absolute/parent paths are disallowed and some mode bits are cleared. See https://access.redhat.com/articles/7004769 for more details.
# 60.38         warnings.warn(
# 60.38           Running configure to work out SQLite compilation flags
# 60.38       ./configure: line 8084: cmp: command not found
# 60.38       ./configure: line 8084: cmp: command not found
# 60.38       ./configure: line 9847: diff: command not found
# 60.38       config.status: error: in `/tmp/pip-install-eu6p7tvi/apsw_df5f74a30ca84a5c90de5ea3a0691bec/sqlite3':
# 60.38       config.status: error: Something went wrong bootstrapping makefile fragments
# 60.38           for automatic dependency tracking.  If GNU make was not used, consider
# 60.38           re-running the configure script with MAKE="gmake" (or whatever is
# 60.38           necessary).  You can also try re-running configure with the
# 60.38           '--disable-dependency-tracking' option to at least be able to build
# 60.38           the package (albeit without support for automatic dependency tracking).
# 60.38       See `config.log' for more details