UV and Distroless by amanning9 · Pull Request #644 · azimuth-cloud/azimuth

amanning9 · 2026-07-23T10:26:55Z

UV: https://docs.astral.sh/uv/
I suggest we use UV for the python packaging, I think the main advantages of this are:

Installing packages is at least 10x faster than pip.
- Much faster buils and installs.
uv manages a lockfile (uv.lock) which replaces the requirements.txt file:
- Packages are securely locked by hash instead of just version number.
- When you add a new package, it resolves and pins all the dependencies automatially for all supported python versions.
- Dependabot will update this lockfile.
It takes away any effort in managing a local development environment.
- Manages the virtual environment for you.
- You always get the versions in the lockfile in your venv.
Able to manage the python install too.

Distroless: https://github.com/GoogleContainerTools/distroless/
The main advantage of distroless is a completely minimal image, so a very much reduced attack surface compared to a ubuntu image.
I think the main disadvantage/thing to note there is that final images will likely become harded to debug, since they contain no shell.
However, there are ways of working around this: https://edu.chainguard.dev/chainguard/chainguard-images/troubleshooting/debugging-distroless-images/

Because we are using python, we have to use the distroless version that includes glibc: https://github.com/GoogleContainerTools/distroless/blob/main/cc/README.md
I've used uv for the python install, since this way we don't depend on distroless keeping up with python security release, which apparently they haven't done in the past.

amanning9

Explanatory inline comments!

amanning9 · 2026-07-30T11:42:12Z


      - name: Build and push image
-        uses: azimuth-cloud/github-actions/docker-multiarch-build-push@master
+        uses: azimuth-cloud/github-actions/docker-multiarch-build-push@demo-uv #TODO: DO NOT MERGE THIS. For testing only.


Remove this change before merge.

amanning9 · 2026-07-30T11:42:33Z

-  #    - reopened
-  #  branches:
-  #    - master
+  pull_request: #TODO: This change should not make it into the final PR.


Remove this change before merge.

amanning9 · 2026-07-30T11:43:26Z

@@ -1,47 +0,0 @@
-anyio==4.14.2


The version locking which used to be contained in requirements.txt is now contained in the uv.lock file.

amanning9 · 2026-07-30T11:44:52Z

@@ -1,40 +0,0 @@
-[metadata]


Package info is now moved to pyproject.toml, as per PEP621

amanning9 · 2026-07-30T11:45:41Z

@@ -0,0 +1 @@
+3.12


This file locks the python version used for development and deployment.

amanning9 · 2026-07-30T11:55:30Z

+### INSTALL PINNED PYTHON ###
+# https://docs.astral.sh/uv/guides/install-python/
+COPY .python-version /app-source
+RUN uv python install \


Using uv to install python ensures that we can always get python security patches quickly and easily.

amanning9 · 2026-07-30T11:56:00Z

+### INSTALL PROJECT INTO VENV ###
+# uv sync --active makes uv (re)create the currently
+# active venv and install into it.
+ENV VIRTUAL_ENV /app


Installing the project into a venv makes it easy to wholesale copy it to the final image.

amanning9 · 2026-07-30T11:56:48Z

+###########################
+### COMPILE FINAL IMAGE ###
+###########################
+FROM gcr.io/distroless/cc-debian13:$FINAL_IMAGE_TAG AS final


Tag is only a build arg to allow easily using the debug version in dev.
Note that the non-debug version doesn't even have a shell.

amanning9 · 2026-07-30T11:57:38Z

-ENV SSL_CERT_FILE /etc/ssl/certs/ca-certificates.crt
-ENV REQUESTS_CA_BUNDLE /etc/ssl/certs/ca-certificates.crt
+### INSTALL CONFIG ###
+COPY ./api/etc/gunicorn /etc/gunicorn


In an ideal world all these config files would probably be in a more sane/easy-to-find place.

amanning9 · 2026-07-30T12:13:34Z

@@ -0,0 +1,4 @@
+ui


Build context was changed to the whole repo to make sure the uv.lock file was included, but when building the api we don't need this stuff to be sent to the docker daemon.

irt-shpc

LGTM. It differs a tiny bit from the pyhelm3 changes I made (I ripped out tox cos it wasn't doing anything and use black for formatting and ruff for check) but they are not really important unless someone decides we have to be absolutely in lock step across the estate

The base branch was changed.

amanning9 force-pushed the demo-uv branch 4 times, most recently from e769b6e to 9734ee2 Compare July 23, 2026 12:03

amanning9 changed the base branch from master to actions-dev July 23, 2026 14:45

amanning9 force-pushed the demo-uv branch 3 times, most recently from 6c31cd5 to 4992b6c Compare July 23, 2026 14:58

amanning9 changed the title ~~UV and Distroless~~ [Draft] UV and Distroless Jul 23, 2026

amanning9 marked this pull request as ready for review July 23, 2026 15:06

amanning9 requested a review from a team as a code owner July 23, 2026 15:06

irt-shpc reviewed Jul 23, 2026

View reviewed changes

Comment thread pyproject.toml

Comment thread pyproject.toml Outdated

amanning9 force-pushed the demo-uv branch 5 times, most recently from dfb2a4d to ab1bd8c Compare July 29, 2026 14:53

amanning9 commented Jul 30, 2026

View reviewed changes

irt-shpc previously approved these changes Jul 30, 2026

View reviewed changes

amanning9 changed the title ~~[Draft] UV and Distroless~~ UV and Distroless Aug 5, 2026

amanning9 mentioned this pull request Aug 5, 2026

Allow tilt components to set location of their Dockerfiles azimuth-cloud/azimuth-config#367

Open

amanning9 force-pushed the demo-uv branch from 98d24d6 to ee03924 Compare August 5, 2026 13:09

amanning9 force-pushed the actions-dev branch from c32c346 to 3b123c1 Compare August 5, 2026 13:10

amanning9 changed the base branch from actions-dev to master August 5, 2026 13:15

amanning9 changed the base branch from master to actions-dev August 5, 2026 13:15

amanning9 added 4 commits August 5, 2026 14:16

DROP COMMIT BEFORE MERGE: Fix CI to run on branch.

8d09cb1

Replace setuptools with UV.

3f28bee

Make tox use uv.

88199e3

Build into distroless image.

15e1543

Pass location of Dockerfiles to Tilt

e571e51

amanning9 force-pushed the demo-uv branch from ee03924 to e571e51 Compare August 5, 2026 13:17

Navigation Menu

Uh oh!

UV and Distroless - #644

UV and Distroless#644
amanning9 wants to merge 5 commits into
actions-devfrom
demo-uv

amanning9 commented Jul 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

amanning9 left a comment

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

amanning9 Jul 30, 2026

Uh oh!

irt-shpc left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1 @@
		3.12

Uh oh!

Conversation

amanning9 commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amanning9 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

irt-shpc left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

amanning9 commented Jul 23, 2026 •

edited

Loading