(airflow) branch main updated: Put the PROD build virtualenv before /usr/python/bin on PATH (#75236)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git


The following commit(s) were added to refs/heads/main by this push:
     new 6639577b61e Put the PROD build virtualenv before /usr/python/bin on PATH (#75236)
6639577b61e is described below

commit 6639577b61edb56a91e1fb5e5817a2dbfada5af1
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Tue Oct 20 19:50:52 2026 +0200

    Put the PROD build virtualenv before /usr/python/bin on PATH (#75236)
    
    With the hardened base images /usr/python is /usr, so the build stage's
    PATH="/usr/python/bin:$PATH" put Debian's pip ahead of the ~/.local
    virtualenv. Its Python also sees /usr/lib/python3/dist-packages, so pip
    treated packages there as already satisfied and never installed them into
    the virtualenv - the final image, which runs the virtualenv's Python, was
    then missing them. "pip check" in the PROD pip image failed with
    "snowflake-snowpark-python 1.55.2 requires wheel, which is not installed".
    
    Use the same PATH order as the main image.
    
    Generated-by: Claude Opus 5
---
 Dockerfile | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 94bd2533a82..6f02f2cde6d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2270,7 +2270,11 @@ ARG USE_CONSTRAINTS_FOR_CONTEXT_DISTRIBUTIONS="false"
 
 # By default PIP installs everything to ~/.local and it's also treated as VIRTUALENV
 ENV VIRTUAL_ENV="${AIRFLOW_USER_HOME_DIR}/.local"
-ENV PATH="/usr/python/bin:$PATH"
+# The virtualenv must come before /usr/python/bin - same as in the main image. In hardened images
+# /usr/python is /usr, so /usr/python/bin holds Debian's pip, whose Python also sees
+# /usr/lib/python3/dist-packages. Installing with it treats packages there (for example wheel) as
+# already satisfied, so they never land in the virtualenv and are missing from the final image.
+ENV PATH="${AIRFLOW_USER_HOME_DIR}/.local/bin:/usr/python/bin:$PATH"
 RUN bash /scripts/docker/install_packaging_tools.sh; bash /scripts/docker/create_prod_venv.sh
 
 COPY --chown=airflow:0 ${AIRFLOW_SOURCES_FROM} ${AIRFLOW_SOURCES_TO}