Multistage docker build for Python distroless image

Question

This is my Dockerfile for distroless image similar to this example

FROM python:3.9-slim AS build-venv
RUN python3 -m venv /venv 
# other installation steps go here
RUN /venv/bin/pip install --upgrade pip setuptools wheel
# installing from requirements.txt etc.

# Copy the virtualenv into a distroless image
FROM gcr.io/distroless/python3-debian11
COPY --from=build-venv /venv /venv
ENTRYPOINT ["/venv/bin/python3"]

I'm trying to just get into Python shell (with all the dependencies installed), but docker run -it my-distroless gives me this error

docker: Error response from daemon: failed to create shim task: 
OCI runtime create failed: runc create failed: 
unable to start container process: exec: "/venv/bin/python3": 
stat /venv/bin/python3: no such file or directory: unknown.

But when replacing base image with debian:11-slim everything works as expected.

FROM debian:11-slim AS build
RUN apt-get update && \
    apt-get install --no-install-suggests --no-install-recommends --yes python3-venv gcc libpython3-dev && \
    python3 -m venv /venv
# the rest is the same

Are there only "compatible" base images for distroless that I should use for my builds or what is the possible reason?

Answer 1

You're trying to copy just the /venv directory, but that's not going to work. Take a look at the contents of that directory, for example:

root@52bdcc57abd8:/# python3 -m venv /venv
root@52bdcc57abd8:/# ls -l /venv/bin/
total 48
-rw-r--r-- 1 root root 8834 Oct 22 03:52 Activate.ps1
-rw-r--r-- 1 root root 1880 Oct 22 03:52 activate
-rw-r--r-- 1 root root  829 Oct 22 03:52 activate.csh
-rw-r--r-- 1 root root 1969 Oct 22 03:52 activate.fish
-rwxr-xr-x 1 root root  222 Oct 22 03:52 pip
-rwxr-xr-x 1 root root  222 Oct 22 03:52 pip3
-rwxr-xr-x 1 root root  222 Oct 22 03:52 pip3.9
lrwxrwxrwx 1 root root    7 Oct 22 03:51 python -> python3
lrwxrwxrwx 1 root root   22 Oct 22 03:51 python3 -> /usr/local/bin/python3
lrwxrwxrwx 1 root root    7 Oct 22 03:51 python3.9 -> python3

As you can see /venv/bin/python3 isn't actually a file, it' just a symlink to whichever version of Python was used to create the virtual environment.

You won't get away with just copying the binary, either, because you need the full set of runtime files from /usr/local/lib/python3.9, as well as any shared libraries that are by required by Python.

---

But when replacing base image with debian:11-slim everything works as expected.

In this case, you're installing a compatible version of Python...but if you're going to do that, you might as well just stick with the python:3.9-slim image.