Distroless python sdk

[damondouglas]

Addresses #32817 adding Python SDK (non-ML) distroless variants.

Latest vulnerability report

Expand for more details:

Testing

Prior to submitting this PR, ran:

./gradlew :sdks:python:test-suites:dataflow:py311:validatesDistrolessContainer -PpythonVersion=3.11

Expand for more detail:

> Task :sdks:python:test-suites:dataflow:py311:validatesDistrolessContainer
============================= test session starts ==============================
platform linux -- Python 3.11.9, pytest-7.4.4, pluggy-1.5.0
rootdir: /usr/local/google/home/damondouglas/projects/distroless-python-sdk/sdks/python
configfile: pytest.ini
plugins: xdist-3.6.1, hypothesis-6.116.0, timeout-2.3.1, requests-mock-1.12.1
timeout: 600.0s
timeout method: signal
timeout func_only: False
collected 1 item

apache_beam/examples/wordcount_it_test.py .                              [100%]

======================== 1 passed in 306.46s (0:05:06) =========================

------------------------

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
• Update CHANGES.md with noteworthy changes.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[github-actions]

Assigning reviewers. If you would like to opt out of this review, comment assign to next reviewer:

R: @liferoad for label python.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

[Abacn]

Thanks, this is a good start. Note that the current change does not enter new automatically ran workflows. Could consider add a "beam_PostCommit_Python_ValidatesContainer_Dataflow_Distroless.yml" GitHub Action workflow, or just create another job running distroless containers in the existing "beam_PostCommit_Python_ValidatesContainer_Dataflow.yml" workflow

[Abacn]

overwriting root properties may have surprising effect, saying if one creates another task that produces container sequentially,

• py39
• py39-distroless
• py310
• py310-distroless

Could it happen that py39-distroless invocation affects the configurations for the py310 target? If so is there a way to avoid it?

[damondouglas]

@Abacn , thank you for meeting with me a couple days back. I realized that having separate py<version>-distroless gradle projects could be avoided with the logic introduced in container/common.gradle by querying the container-build-target property. Thus, there is no py<version>-distroless. The description has a screenshot in the collapsed markdown of the Dataflow Job that succeeded with the validatesDistrolessContainer task. I don't have the means while currently on vacation to test again but I (mostly) remember that the tag is needed to be set on the rootProject level to work. validatesDistrolessContainer should not interfere with other tasks and these properties should only be set when the task executes, not when it is configured.

[damondouglas]

Thanks, this is a good start. Note that the current change does not enter new automatically ran workflows. Could consider add a "beam_PostCommit_Python_ValidatesContainer_Dataflow_Distroless.yml" GitHub Action workflow, or just create another job running distroless containers in the existing "beam_PostCommit_Python_ValidatesContainer_Dataflow.yml" workflow

Thank @Abacn , the GitHub Action workflow will be addressed in #33003. The goal of this PR is to make backward compatible changes to existing Python container-related Dockerfile and related gradle tasks. Could you let me know if adding the workflow is important to your review of this PR and I can do so when I return from vacation in a couple weeks?

[Abacn]

thanks for the clarifications. This looks good to me. I understand this is currently an no-op to workflow as both test workflow and push docker image to dockerhub are pending. Defer to you for the timeline to merge