Skip to content

chore: migrate dependency management from pip to uv for Docker containers #2630

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
nicomiguelino wants to merge 7 commits into
base: master
Choose a base branch
from
Draft

chore: migrate dependency management from pip to uv for Docker containers #2630

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3f3d957
chore(anthias-server): migrate dependency management from `pip` to `uv`
nicomiguelino Jan 5, 2026
b6cdb6d
chore: resolve stash conflicts
nicomiguelino Jan 5, 2026
79be710
bump `requests` used by `anthias-server`
nicomiguelino Jan 5, 2026
660d85a
chore: update
nicomiguelino Jan 5, 2026
90e4be3
chore: fix `anthias-server` startup in development mode
nicomiguelino Jan 5, 2026
e588951
Merge branch 'master' into migrate-pip-to-uv
nicomiguelino Jan 12, 2026
f75483a
chore(anthias-viewer): migrate dependency management from `pip` to `uv`
nicomiguelino Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions bin/start_server.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,21 @@ echo "Running migration..."
# database is not left in an inconsistent state if the migration fails.

if [ -f /data/.screenly/screenly.db ]; then
./manage.py dbbackup --noinput --clean && \
./manage.py migrate --fake-initial --noinput || \
./manage.py dbrestore --noinput
uv run python manage.py dbbackup --noinput --clean && \
uv run python manage.py migrate --fake-initial --noinput || \
uv run python manage.py dbrestore --noinput
else
./manage.py migrate && \
./manage.py dbbackup --noinput --clean
uv run python manage.py migrate && \
uv run python manage.py dbbackup --noinput --clean
fi

if [[ "$ENVIRONMENT" == "development" ]]; then
echo "Starting Django development server..."
npm install && npm run build
./manage.py runserver 0.0.0.0:8080
uv run python manage.py runserver 0.0.0.0:8080
else
echo "Generating Django static files..."
./manage.py collectstatic --clear --noinput
uv run python manage.py collectstatic --clear --noinput
echo "Starting Gunicorn..."
python run_gunicorn.py
uv run python run_gunicorn.py
fi
4 changes: 3 additions & 1 deletion bin/start_viewer.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,12 @@ chown -f viewer /data/.screenly/latest_anthias_sha
mkdir -p /data/.local/share/ScreenlyWebview/QtWebEngine \
/data/hotspot \
/data/.cache/ScreenlyWebview \
/data/.cache/uv \
/data/.pki

chown -Rf viewer /data/.local/share/ScreenlyWebview
chown -Rf viewer /data/.cache/ScreenlyWebview/
chown -Rf viewer /data/.cache/uv
chown -Rf viewer /data/.pki
chown -Rf viewer /data/hotspot

Expand All @@ -39,7 +41,7 @@ trap '' 16
echo 0 > /sys/fs/cgroup/memory/memory.swappiness

# Start viewer
sudo -E -u viewer dbus-run-session python -m viewer &
sudo -E -u viewer dbus-run-session uv run python -m viewer &

# Wait for the viewer
while true; do
Expand Down
1 change: 1 addition & 0 deletions docker-compose.dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ services:
- CELERY_BROKER_URL=redis://redis:6379/0
- CELERY_RESULT_BACKEND=redis://redis:6379/0
- ENVIRONMENT=development
- UV_PROJECT_ENVIRONMENT=/tmp/.venv
restart: always
volumes:
- anthias-data:/data
Expand Down
2 changes: 2 additions & 0 deletions docker-compose.yml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ services:
- LISTEN=0.0.0.0
- CELERY_BROKER_URL=redis://redis:6379/0
- CELERY_RESULT_BACKEND=redis://redis:6379/0
- UV_PROJECT_ENVIRONMENT=/tmp/.venv
devices:
- "/dev/vchiq:/dev/vchiq"
restart: always
Expand All @@ -59,6 +60,7 @@ services:
- PORT=80
- NOREFRESH=1
- LISTEN=anthias-nginx
- UV_PROJECT_ENVIRONMENT=/tmp/.venv
extra_hosts:
- "host.docker.internal:host-gateway"
privileged: true
Expand Down
11 changes: 2 additions & 9 deletions docker/Dockerfile.base.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,13 +22,6 @@ RUN --mount=type=cache,target=/var/cache/apt \
# https://github.com/balena-io-library/base-images/issues/562
RUN c_rehash

# We need this to ensure that the wheels can be built.
# Otherwise we get "invalid command 'bdist_wheel'"
{% if disable_cache_mounts %}
RUN \
{% else %}
RUN --mount=type=cache,target=/root/.cache/pip \
{% endif %}
pip3 install --upgrade pip --break-system-packages && \
pip3 install wheel --break-system-packages
# Install uv for fast Python package management
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
Copy link

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv stage pulls a third-party build tool image using the mutable latest tag, which creates a supply-chain risk: if that image is compromised or replaced in the registry, your builds will transparently consume and execute attacker-controlled code inside production images. Because this runs during image build with high privileges, an attacker controlling that tag could inject backdoors or exfiltrate secrets during builds. To mitigate this, pin the uv image to an immutable reference (e.g., a specific version tag and preferably a digest) and update it deliberately as part of your release process.

Copilot uses AI. Check for mistakes.

6 changes: 3 additions & 3 deletions docker/Dockerfile.server.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@ RUN npm run build
{% endif %}
{% include 'Dockerfile.base.j2' %}

COPY requirements/requirements.txt /tmp/requirements.txt
COPY pyproject.toml uv.lock /tmp/
{% if disable_cache_mounts %}
RUN \
{% else %}
RUN --mount=type=cache,target=/root/.cache/pip \
RUN --mount=type=cache,target=/root/.cache/uv \
{% endif %}
pip3 install -r /tmp/requirements.txt --break-system-packages
cd /tmp && uv sync --frozen --no-dev --group server
Copy link

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The command 'uv sync --frozen --no-dev --group server' will install dependencies into a virtual environment, but the resulting binaries won't be in PATH unless the virtual environment is activated. The start_server.sh script uses 'uv run python' which should work, but direct command invocations in other scripts may fail. Consider adding ENV PATH="/tmp/.venv/bin:$PATH" to the Dockerfile or ensure all Python commands use 'uv run' prefix.

Copilot uses AI. Check for mistakes.

RUN mkdir -p /usr/src/app
COPY . /usr/src/app/
Expand Down
23 changes: 7 additions & 16 deletions docker/Dockerfile.viewer.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@

FROM {{ base_image }}:{{ base_image_tag }}

# This list needs to be trimmed back later
{% include 'Dockerfile.base.j2' %}

{% if disable_cache_mounts %}
RUN \
{% else %}
Expand All @@ -19,25 +20,15 @@ RUN --mount=type=cache,target=/var/cache/apt \
{% endif %}
{% endfor %}

# We need this to ensure that the wheels can be built.
# Otherwise we get "invalid command 'bdist_wheel'"
{% if disable_cache_mounts %}
RUN \
{% else %}
RUN --mount=type=cache,target=/root/.cache/pip \
{% endif %}
pip3 install --upgrade pip --break-system-packages && \
pip3 install wheel --break-system-packages

# Install Python requirements
COPY requirements/requirements.viewer.txt /tmp/requirements.txt

COPY pyproject.toml uv.lock /tmp/
{% if disable_cache_mounts %}
RUN \
{% else %}
RUN --mount=type=cache,target=/root/.cache/pip \
RUN --mount=type=cache,target=/root/.cache/uv \
{% endif %}
pip3 install -r /tmp/requirements.txt --break-system-packages
cd /tmp && \
uv venv --system-site-packages && \
uv sync --frozen --no-dev --group viewer

# Works around issue with `curl`
# https://github.com/balena-io-library/base-images/issues/562
Expand Down
66 changes: 66 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,69 @@ docker-image-builder = [
"requests==2.32.5",
"python-on-whales==0.79.0",
]
server = [
"cec==0.2.8",
"celery==5.2.2",
"certifi==2025.10.5",
"cffi==2.0.0",
"configparser==7.2.0",
"cryptography==3.3.2",
"Cython==3.2.3",
"Django==4.2.27",
"djangorestframework==3.16.1",
"django-dbbackup==4.2.1",
"drf-spectacular==0.29.0",
"future==1.0.0",
"gevent-websocket==0.10.1",
"gevent==25.9.1",
"gunicorn==23.0.0",
"hurry.filesize==0.9",
"importlib-metadata==4.13.0",
"Jinja2==3.1.6",
"jsonschema==4.25.1",
"kombu==5.5.4",
"Mako==1.2.2",
"netifaces==0.11.0",
"psutil==7.1.2",
"pyasn1==0.6.1",
"pydbus==0.6.0",
"pyOpenSSL==19.1.0",
"python-dateutil==2.9.0.post0",
"pytz==2025.2",
"PyYAML==6.0.2",
"pyzmq==23.2.1",
"redis==7.1.0",
"requests[security]==2.32.5",
"tenacity==9.1.2",
"sh==1.8",
"six==1.17.0",
"urllib3==2.6.0",
"wheel==0.38.1",
"yt-dlp==2025.10.22",
]
viewer = [
"cec==0.2.8",
"certifi==2025.10.5",
"configparser==7.2.0",
"cryptography==3.3.2",
"Cython==3.2.3",
"Django==4.2.27",
"django-dbbackup==4.2.1",
"drf-spectacular==0.29.0",
"future==1.0.0",
"idna==3.11",
"Jinja2==3.1.6",
"jsonschema==4.25.1",
"netifaces==0.11.0",
"pydbus==0.6.0",
"python-dateutil==2.9.0.post0",
"python-vlc==3.0.20123",
"pytz==2025.2",
"pyzmq==23.2.1",
"redis==7.1.0",
"requests[security]==2.32.5",
"tenacity==9.1.2",
"sh==1.8",
"uptime==3.0.1",
"urllib3==2.6.0",
]
Loading
Loading