Skip to content

fix(docker): stop shipping empty pixi environments #368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xraymemory merged 1 commit into from
Aug 12, 2026
Merged

fix(docker): stop shipping empty pixi environments #368

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 31 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,14 +127,42 @@ RUN --mount=type=bind,from=checkpoints,target=/ck \
# IMPORTANT: keep these installs in a single RUN. Splitting them into separate
# Docker layers duplicates shared conda packages (numpy, CUDA libs, etc.) and can
# add tens of GB to the image.
RUN --mount=type=cache,target=/root/.cache/pixi \
--mount=type=cache,target=/root/.cache/rattler \
#
# The `rm -rf` and the assertion below are both load-bearing. Published images
# have shipped with all five environments as empty shells: the directories and
# pixi's own bookkeeping in conda-meta present, but no package records, no bin/,
# no lib/. `pixi install --frozen` then reports "The <env> environment has been
# installed" against them and exits 0, so the breakage is invisible at build
# time and only surfaces when a scientist finds /app/.pixi/envs/protenix has no
# python. `SAMPLEWORKS_REQUIRE_PREBUILT_PIXI=1` makes the runner refuse to fall
# back, so the image promises environments it does not carry.
#
# Clearing the prefix first forces a genuine install even when a stale or stub
# prefix arrives from a cached layer, the base image, or the registry
# buildcache. The per-environment check then makes an empty env fail the build
# instead of shipping: a directory that exists but has no interpreter is exactly
# the state that got published, and `pixi install` alone does not catch it.
#
# `/root/.cache/pixi` is deliberately not cached across builds — it carries
# pixi's own "is this environment current" state, which is the thing that can
# disagree with a prefix restored from a different build. The rattler and uv
# caches stay: they hold downloaded packages and wheels, are what actually make
# rebuilds fast, and were verified not to affect what lands in the layer.
RUN --mount=type=cache,target=/root/.cache/rattler \
--mount=type=cache,target=/root/.cache/uv \
rm -rf /app/.pixi/envs && \
pixi install -e boltz --frozen && \
pixi install -e protenix --frozen && \
pixi install -e rf3 --frozen && \
pixi install -e protpardelle --frozen && \
pixi install -e analysis --frozen
pixi install -e analysis --frozen && \
for env in boltz protenix rf3 protpardelle analysis; do \
test -x "/app/.pixi/envs/${env}/bin/python" || { \
echo "FATAL: pixi environment '${env}' has no interpreter at /app/.pixi/envs/${env}/bin/python."; \
echo " pixi reported success but installed nothing — refusing to ship an empty environment."; \
exit 1; \
}; \
Comment on lines +159 to +164

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/sh
set -eu
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

printf '#!/bin/sh\nexit 127\n' > "$tmp/python"
chmod +x "$tmp/python"

test -x "$tmp/python"

if "$tmp/python" -c 'import sys'; then
  echo "unexpected: fake interpreter ran"
  exit 1
fi

Repository: diff-use/sampleworks

Length of output: 158

🏁 Script executed:

#!/bin/sh
set -eu
printf '%s\n' '--- Dockerfile ---'
sed -n '145,170p' Dockerfile
printf '%s\n' '--- Python constraints ---'
rg -n -C 2 'requires-python|python' pyproject.toml
printf '%s\n' '--- Interpreter guard occurrences ---'
rg -n -C 3 'test -x|\.pixi/envs/.*/bin/python|pixi install' Dockerfile

Repository: diff-use/sampleworks

Length of output: 4818

Run each environment’s Python interpreter during validation.

test -x checks only execute permission. It can accept an executable directory or non-Python file. Add test -f, then run the interpreter with -c and enforce >= 3.11, < 3.14 from pyproject.toml.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` around lines 159 - 164, Update the environment validation loop in
the Dockerfile to require each `/app/.pixi/envs/${env}/bin/python` path to be a
regular executable file, then invoke it with `-c` to validate its version is at
least 3.11 and below 3.14, matching the pyproject.toml constraint; retain the
existing fatal error behavior when validation fails.

Source: MCP tools

done

# A GPU is not required to build the image. Pre-compile CUDA extensions only when
# the builder exposes NVIDIA devices; if present, failures should stop the build.
Expand Down
Loading