feat(py_venv): Shell-less hermetic launcher for py_venv_binary#825
Merged
feat(py_venv): Shell-less hermetic launcher for py_venv_binary#825
Conversation
|
|
|
Adopt hermetic_launcher to produce statically-linked native binaries for py_venv_binary and py_venv_test instead of shell script wrappers. This enables running in shell-less environments like distroless containers. Closes #581 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The starlark_doc_extract rule needs all transitive .bzl dependencies declared via bzl_library. Add @hermetic_launcher//launcher:lib_bzl to the py_venv bzl_library deps.
Add e2e tests that build a py_venv_binary into a distroless (cc-debian12) container image and exec it, proving the hermetic native launcher works without a shell. Tests for both amd64 and arm64 (cross-arch tests skip as expected).
arrdem
force-pushed
the
arrdem/feat-prebuilt-launcher
branch
from
7771451 to
379e662
Compare
- New py_venv_test for env vars (BAZEL_TARGET, BAZEL_WORKSPACE, BAZEL_TARGET_NAME, custom env dict) verifying RunEnvironmentInfo works correctly with the hermetic launcher - New py_venv_test for argv passthrough - Richer distroless container assertions: VIRTUAL_ENV set, no double-slash in paths, BAZEL_TARGET present Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ners The hermetic launcher bypasses the shell `activate` script, so BAZEL_TARGET and friends (set via RunEnvironmentInfo) are only available under `bazel run`/`bazel test`. When the binary runs directly—e.g. in a distroless container—those vars were missing. Write a `.aspect_env` key=value file into the venv at build time and have the venv_shim apply it at exec time (only for vars not already set, so explicit env and RunEnvironmentInfo still take precedence). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
arrdem
added a commit
that referenced
this pull request
Mar 11, 2026
Reverts b482f38 and the follow-up fix 4721efc. The hermetic launcher (hermetic_launcher v0.0.4) has a manifest-based runfiles resolution bug: it does exact-match lookups only, but the runfiles spec requires prefix-matching to support TreeArtifact contents. Since the venv is a TreeArtifact and the exec target is a path within it (<tree_artifact>/bin/python), manifest resolution fails with ENOENT, breaking `bazel run` for all py_venv_binary targets. Upstream: hermeticbuild/hermetic-launcher#17 Fixes: #849 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
arrdem
added a commit
that referenced
this pull request
Mar 11, 2026
Reverts b482f38 and follow-up 4721efc. The hermetic launcher's manifest-based runfiles resolution does exact-match lookups, but the runfiles spec requires prefix-matching for TreeArtifact contents. Since the venv is a TreeArtifact and the exec target is `<tree_artifact>/bin/python`, manifest resolution fails with ENOENT, breaking `bazel run` for all `py_venv_binary` targets. Root cause analysis: #849 (comment) Upstream fix request: hermeticbuild/hermetic-launcher#17 Fixes #849 ### Changes are visible to end-users: yes - Breaking change (forces users to change their own code or config): no - Suggested release notes appear below: yes `py_venv_binary` and `py_venv_test` revert to shell script launchers. The hermetic (shell-less) launcher from 1.9.0 is removed due to a runfiles resolution bug that broke `bazel run`. Distroless/shell-less container support will return once the upstream launcher supports TreeArtifact resolution. ### Test plan - Covered by existing test cases - Manual: `bazel run //examples/py_binary:py_binary.venv` now succeeds Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the shell script launcher for
py_venv_binaryandpy_venv_testwith a statically-linked native binary from hermetic_launcher (~10-68KB). This enables running in shell-less environments like distroless containers (closes #581).The existing
venv_shimalready handles full virtualenv activation (VIRTUAL_ENV, PATH, PYTHONHOME, PYTHONEXECUTABLE, PYTHONNOUSERSITE). BAZEL_TARGET/BAZEL_WORKSPACE/BAZEL_TARGET_NAME are provided viaRunEnvironmentInfoforbazel run/bazel test, and also written to a.aspect_envfile in the venv so that the venv_shim can apply them when running outside Bazel (e.g. in containers).Unchanged:
py_venv(plain venv rule) still uses a shell entrypoint.py_binary/py_test(non-venv rules) are also unchanged.Changes are visible to end-users: yes
py_venv_binaryandpy_venv_testnow produce statically-linked native binaries instead of shell scripts, enabling use in shell-less environments like distroless containers.Test plan
py/tests/py-venv-*,py/tests/py-internal-venv,py/tests/py_venv_conflict)py/tests/py-venv-env— verifies BAZEL_TARGET/BAZEL_WORKSPACE/BAZEL_TARGET_NAME and customenvdict entries via RunEnvironmentInfopy/tests/py-venv-args— verifies CLI argument passthrough to the Python scripte2e/cases/oci/distroless— container_structure_test verifying execution in distroless (no-shell), checking VIRTUAL_ENV, BAZEL_TARGET, and no double-slash paths🤖 Generated with Claude Code