From f150682240954b3654aeb1c535b8ab66f73d2886 Mon Sep 17 00:00:00 2001
From: bitsofsteve <11381249+bitsofsteve@users.noreply.github.com>
Date: Mon, 3 Aug 2026 16:58:50 +0000
Subject: [PATCH] Base the enclave image on Ubuntu 24.04 LTS

Move the enclave container from python:3.12-slim (Debian 13 trixie) to
Ubuntu 24.04 LTS, which ships Python 3.12 as its system interpreter -- the
version the workspace already targets.

Two adjustments the base change requires: python3-venv is packaged separately
on Ubuntu and uv needs it to build /repo/.venv, and uv is installed from its
standalone distribution rather than pip because Ubuntu marks the system
interpreter externally managed (PEP 668).

Verified: image builds, reports Ubuntu 24.04.4 LTS with Python 3.12.3 and
uv 0.12.1, and syft_client, syft_enclaves, fastapi, uvicorn and the
attestation server module all import in the built venv.
---
 packages/syft-enclave/docker/Dockerfile | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/packages/syft-enclave/docker/Dockerfile b/packages/syft-enclave/docker/Dockerfile
index 4a6d4523908..ef8f14a22cf 100644
--- a/packages/syft-enclave/docker/Dockerfile
+++ b/packages/syft-enclave/docker/Dockerfile
@@ -1,6 +1,20 @@
-FROM python:3.12-slim
+FROM ubuntu:24.04
 
-RUN pip install uv
+# Ubuntu 24.04 LTS ships Python 3.12 as its system interpreter, which is the
+# version the workspace targets. python3-venv is separate on Debian/Ubuntu and
+# uv needs it to build /repo/.venv; ca-certificates is required for TLS to the
+# package index. uv is installed from its standalone distribution rather than
+# pip, since Ubuntu marks the system interpreter externally managed (PEP 668).
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        python3 \
+        python3-venv \
+        ca-certificates \
+        curl \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV UV_INSTALL_DIR=/usr/local/bin
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh && uv --version
 
 # Build context is the monorepo root (set by packages/syft-enclave/Justfile).
 # We install syft-enclave from the workspace so syft-client + its workspace