Chainguard wolfi-base image as base for docker

[peters-david]

This pull request exchanges the python/ubuntu and alpine images in the Dockerfile for the wolfi-base image (see https://github.com/wolfi-dev). This was requested in #58 .
As the wolfi-base image is very restrictive with dependencies / packages, some of the dependencies needed to be changed in order to be able to build with nuitka. Especially the dependency dll caused issues as building the harbor.bin from python code also involves building its dependencies like harborapi.

[bavaria-blue]

Works in local cluster.

[steadyk]

Linting works fine!

I tried to build it locally via docker build . -t test. This results in the following error:

0.428 ImportError: cannot import name 'sha512' from 'hashlib' (/usr/lib/python3.12/hashlib.py)

Does this works for you?

In my local cluster, I changed the image to sha-43beb4c11cc3. It looks like that no processing happens besides Found id templates ....

Does this works for you?

Maybe I'm doing something wrong! xD

[peters-david]

Linting works fine!

I tried to build it locally via docker build . -t test. This results in the following error:

0.428 ImportError: cannot import name 'sha512' from 'hashlib' (/usr/lib/python3.12/hashlib.py)

Does this works for you?

This works for me and I am not able to reproduce. Could you share more of the logs?

In my local cluster, I changed the image to sha-43beb4c11cc3. It looks like that no processing happens besides Found id templates ....

Does this works for you?

Maybe I'm doing something wrong! xD

You are not doing something wrong, this is because the non-json logging is still missing. You could try the wolfi-image branch in the harbor repository in Gitea to see all logging messages. I will add the logging this week.

[steadyk]

@peters-david Here are the tracebacks. Seems to happen on pip3 install --no-cache-dir -U pip.
Not sure why this happens. Maybe just a issue on my machine then.

docker_build_error.txt

[steadyk]

You are not doing something wrong, this is because the non-json logging is still missing. You could try the wolfi-image branch in the harbor repository in Gitea to see all logging messages. I will add the logging this week.

Thanks for the info! Take your time! I tested with the wolfi-image branch. Operator looks good! :-)

[steadyk]

@peters-david

This works for me and I am not able to reproduce. Could you share more of the logs?

It turned out to be a problem on my side. On my local machine the wolfi-base:lastest image was already present, but in an older version, which seems to cause the problems.

If I pull the latest image again or build with docker build --pull -t test . the build works fine! Sorry for the noise!

You do not need to remove pip then! :-)

Alternatively we cause also use sha256 digests and let Renovate update them, e.g.:

cgr.dev/chainguard/wolfi-base:latest@sha256:a9547b680d3d322b14c2e46963b04d7afe71d927a3fa701a839559041989debe

But just an idea!

[steadyk]

We could also think about using non root users on later build stages at the Dockerfile. But this might be something for another PR. Just as hint.

[peters-david]

The current error TypeError: mro() returned a non-class ('PydanticRecursiveRef') seems to be an error in pydantic.

[peters-david]

Added a temporal fix to pin the httpx version as other versions caused trouble in harborapi.