From 9837627557e998058b787ad888267b33bc02dcb6 Mon Sep 17 00:00:00 2001 From: tammy-baylis-swi Date: Tue, 27 Oct 2026 10:29:47 -0700 Subject: [PATCH 1/4] k8s image build after update OS ca-cert, pip upgrade --- image/Dockerfile | 9 ++++++++- image/Dockerfile-beta | 9 ++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/image/Dockerfile b/image/Dockerfile index 752788c1b..01daac252 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -17,6 +17,10 @@ FROM python:3.10 AS build-310 WORKDIR /operator-build ADD requirements-nodeps.txt . ADD requirements.txt . +RUN apt-get update \ + && apt-get install -y --no-install-recommends ca-certificates \ + && rm -rf /var/lib/apt/lists/* +RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2" RUN mkdir workspace RUN pip install --no-deps --target workspace -r requirements-nodeps.txt RUN pip install --target workspace -r requirements.txt @@ -25,7 +29,10 @@ FROM python:3.10-alpine AS build-musl-310 WORKDIR /operator-build ADD requirements-nodeps.txt . ADD requirements.txt . -RUN apk add g++ gcc python3-dev musl-dev linux-headers +RUN apk update \ + && apk add --no-cache ca-certificates g++ gcc python3-dev musl-dev linux-headers \ + && apk upgrade ca-certificates +RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2" RUN mkdir workspace RUN pip install --no-deps --target workspace -r requirements-nodeps.txt RUN pip install --target workspace -r requirements.txt diff --git a/image/Dockerfile-beta b/image/Dockerfile-beta index 8704288e3..dd35c11bf 100644 --- a/image/Dockerfile-beta +++ b/image/Dockerfile-beta @@ -17,6 +17,10 @@ FROM python:3.10 AS build-310 WORKDIR /operator-build ADD requirements-nodeps-beta.txt . ADD requirements.txt . +RUN apt-get update \ + && apt-get install -y --no-install-recommends ca-certificates \ + && rm -rf /var/lib/apt/lists/* +RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2" RUN mkdir workspace RUN pip install --no-deps --target workspace --extra-index-url https://test.pypi.org/simple/ -r requirements-nodeps-beta.txt RUN pip install --target workspace -r requirements.txt @@ -25,7 +29,10 @@ FROM python:3.10-alpine AS build-musl-310 WORKDIR /operator-build ADD requirements-nodeps-beta.txt . ADD requirements.txt . -RUN apk add g++ gcc python3-dev musl-dev linux-headers +RUN apk update \ + && apk add --no-cache ca-certificates g++ gcc python3-dev musl-dev linux-headers \ + && apk upgrade ca-certificates +RUN python -m pip install --no-cache-dir --upgrade "pip>=2026.2.2" RUN mkdir workspace RUN pip install --no-deps --target workspace --extra-index-url https://test.pypi.org/simple/ -r requirements-nodeps-beta.txt RUN pip install --target workspace -r requirements.txt From ecfafdc886ac54afabf0d5cb2f97d2ad71ba3198 Mon Sep 17 00:00:00 2001 From: tammy-baylis-swi Date: Tue, 27 Oct 2026 11:55:30 -0700 Subject: [PATCH 2/4] Factor out Dockerfile.manylinux.example for dev and ca mgmt --- .gitignore | 3 +++ CONTRIBUTING.md | 16 ++++++++++++++++ Dockerfile.manylinux.example | 20 ++++++++++++++++++++ docker-compose.yml | 14 ++++++++++++-- 4 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 Dockerfile.manylinux.example diff --git a/.gitignore b/.gitignore index f89018215..6542a8c3b 100644 --- a/.gitignore +++ b/.gitignore @@ -134,3 +134,6 @@ dmypy.json # IDE .idea/ .vscode/ + +# Local CA-configured manylinux build image +/Dockerfile.manylinux diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1d9f4f658..558edea9a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -33,6 +33,22 @@ A PR is ready to merge when all tests pass, any major feedback has been resolved The build containers are based on the [PyPA image](https://github.com/pypa/manylinux) for `manylinux_2_28_x86_64` or `manylinux_2_28_aarch64`. Choose what will run best on your setup (e.g. aarch64 for Apple silicon, or x86_64 for Intel). +Compose expects a root-level `Dockerfile.manylinux` for either service. If you do not already have a customized local file, create one from the example: + +```bash +cp Dockerfile.manylinux.example Dockerfile.manylinux +``` + +For networks with TLS inspection, edit `Dockerfile.manylinux` to use your organization's approved CA download URL and verified SHA-256 checksum. Keep CA verification enabled. + +If your network does not use TLS inspection, remove or comment out the `ORGANIZATION_CA_URL` and `ORGANIZATION_CA_SHA256` arguments and the `ADD --checksum` instruction. Keep the `dnf upgrade -y ca-certificates` step; it refreshes the normal manylinux trust store. If `Dockerfile.manylinux` already exists, edit it rather than copying over your local configuration. + +After creating or changing the local Dockerfile, rebuild the selected image before running it; for example: + +```bash +docker-compose build aarch64 +``` + To create and run a Docker container for testing and builds, run one of the following: ```bash docker-compose run x86_64 diff --git a/Dockerfile.manylinux.example b/Dockerfile.manylinux.example new file mode 100644 index 000000000..d486f792f --- /dev/null +++ b/Dockerfile.manylinux.example @@ -0,0 +1,20 @@ +ARG MANYLINUX_IMAGE +FROM ${MANYLINUX_IMAGE} + +# Replace these placeholders with your organization's approved CA source and +# independently verified SHA-256 checksum before building. +# Or, comment them out entirely. +ARG ORGANIZATION_CA_URL=https://example.invalid/path/to/organization-root-ca.pem +ARG ORGANIZATION_CA_SHA256=replace-with-verified-sha256 + +ADD --checksum=sha256:${ORGANIZATION_CA_SHA256} ${ORGANIZATION_CA_URL} \ + /etc/pki/ca-trust/source/anchors/organization-root-ca.crt + +RUN update-ca-trust extract \ + && dnf upgrade -y ca-certificates \ + && update-ca-trust extract \ + && dnf clean all + +ENV PIP_CERT=/etc/pki/tls/certs/ca-bundle.crt \ + REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt \ + SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 4887b3224..2ec4145ba 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,7 +5,12 @@ # to locally build and publish solarwinds_apm Python APM library services: x86_64: - image: quay.io/pypa/manylinux_2_28_x86_64 + image: solarwinds/apm-python-manylinux-x86_64:local + build: + context: . + dockerfile: Dockerfile.manylinux + args: + MANYLINUX_IMAGE: quay.io/pypa/manylinux_2_28_x86_64 stdin_open: true tty: true network_mode: host @@ -26,7 +31,12 @@ services: /bin/bash aarch64: - image: quay.io/pypa/manylinux_2_28_aarch64 + image: solarwinds/apm-python-manylinux-aarch64:local + build: + context: . + dockerfile: Dockerfile.manylinux + args: + MANYLINUX_IMAGE: quay.io/pypa/manylinux_2_28_aarch64 stdin_open: true tty: true network_mode: host From ff9f2fe1e77d4a22d27e4b7762c501c47575ce16 Mon Sep 17 00:00:00 2001 From: tammy-baylis-swi Date: Tue, 27 Oct 2026 12:02:53 -0700 Subject: [PATCH 3/4] Add ca-certs, pip upgrade to lambda build --- Makefile | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 2234ca51c..609a4a571 100644 --- a/Makefile +++ b/Makefile @@ -23,6 +23,9 @@ nothing: # check if build deps are installed #----------------------------------------------------------------------------------------------------------------------# +upgrade-ca-certificates: + @command dnf upgrade ca-certificates -y; + check-zip: @echo -e "Is zip installed?" @command -v zip >/dev/null 2>&1 || \ @@ -68,6 +71,8 @@ install-lambda-modules: rm -rf ${target_dir} @echo -e "Creating target directory ${target_dir} for AWS Lambda layer artifacts." mkdir -p ${target_dir}/python + @echo -e "Upgrade pip in the Lambda build environment" + /opt/python/cp310-cp310/bin/python -m pip install --no-cache-dir --upgrade "pip>=26.2.2" @echo -e "Install setuptools" /opt/python/cp310-cp310/bin/pip install setuptools @echo -e "Install upstream dependencies to include in layer" @@ -97,7 +102,7 @@ check-lambda-modules: target_dir := "./tmp-lambda" aws-lambda: export AWS_LAMBDA_FUNCTION_NAME = set-for-build aws-lambda: export LAMBDA_TASK_ROOT = set-for-build -aws-lambda: check-zip install-lambda-modules check-lambda-modules +aws-lambda: upgrade-ca-certificates check-zip install-lambda-modules check-lambda-modules @if [[ ! -d dist ]]; then mkdir dist; fi @pushd ${target_dir} && zip -r ../dist/solarwinds_apm_lambda.zip . && popd @rm -rf ${target_dir} ./build @@ -138,4 +143,4 @@ clean-tox: @rm -rf .tox/ @echo -e "Done." -.PHONY: nothing check-zip sdist check-sdist-local wheel check-wheel-local package install-lambda-modules check-lambda-modules aws-lambda tox format lint clean clean-tox +.PHONY: nothing upgrade-ca-certificates check-zip sdist check-sdist-local wheel check-wheel-local package install-lambda-modules check-lambda-modules aws-lambda tox format lint clean clean-tox From ef3d7e739e3e5fd37b5ee2bb11275f221180a2d0 Mon Sep 17 00:00:00 2001 From: tammy-baylis-swi Date: Tue, 27 Oct 2026 12:48:52 -0700 Subject: [PATCH 4/4] Add header --- Dockerfile.manylinux.example | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Dockerfile.manylinux.example b/Dockerfile.manylinux.example index d486f792f..cb2ec62d9 100644 --- a/Dockerfile.manylinux.example +++ b/Dockerfile.manylinux.example @@ -1,3 +1,6 @@ +# Copyright SolarWinds Worldwide, LLC. +# SPDX-License-Identifier: Apache-2.0 + ARG MANYLINUX_IMAGE FROM ${MANYLINUX_IMAGE}