update docker python runner

Author: wrjade

.github/workflows/build.yml

@@ -83,6 +83,11 @@ jobs:
         # 设置环境变量以允许非自由包（Gurobi）
         export NIXPKGS_ALLOW_UNFREE=1
         
+        # 生成当前UTC时间戳
+        CURRENT_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+        echo "Setting Docker image timestamp to: $CURRENT_TIMESTAMP"
+        export DOCKER_IMAGE_TIMESTAMP="$CURRENT_TIMESTAMP"
+        
         # 进入 Nix 开发环境并构建
         echo "🔧 Setting up Nix Flake environment..."
         nix develop --command bash -c "

README.md

@@ -91,6 +91,8 @@ docker run --rm \
 
 - **Core**: pip, setuptools, wheel
 - **Scientific**: numpy, scipy, pandas, matplotlib, scikit-learn
+- **Visualization**: seaborn
+- **Financial**: yfinance
 - **Optimization**: gurobipy (Gurobi 12.0.3)
 - **Build Tools**: cython
 - **Package Manager**: uv

build.sh

@@ -8,76 +8,89 @@ set -e
 echo "=== Building Python Docker image with Nix dockerTools ==="
 echo "🔨 Building secure Docker image with restricted Python environment..."
 
-# 清理旧的镜像标签和可能冲突的镜像
+# Clean up old image tags and potentially conflicting images
 echo "🧹 Cleaning up old image tags and conflicting images..."
-# 删除目标标签
+
+# First stop and remove containers using docker-python-runner images
+echo "🧹 Cleaning up containers using docker-python-runner images..."
+CONTAINERS_TO_STOP=$(docker ps -a --format "{{.ID}} {{.Image}}" | grep "docker-python-runner" | awk '{print $1}' || echo "")
+if [ -n "$CONTAINERS_TO_STOP" ]; then
+    echo "   Found containers using docker-python-runner images, stopping and removing them..."
+    echo "$CONTAINERS_TO_STOP" | while read container_id; do
+        if [ -n "$container_id" ]; then
+            echo "   Stopping container: $container_id"
+            docker stop "$container_id" 2>/dev/null || echo "     Container $container_id already stopped"
+            echo "   Removing container: $container_id"
+            docker rm "$container_id" 2>/dev/null || echo "     Container $container_id already removed"
+        fi
+    done
+else
+    echo "   No containers using docker-python-runner images found"
+fi
+
+# Remove target tag
 docker rmi ghcr.io/reaslab/docker-python-runner:secure-latest 2>/dev/null || echo "   No existing tag to remove"
 
-# 清理所有悬空镜像
+# Clean up all dangling images
 echo "🧹 Cleaning up dangling images..."
 docker image prune -f 2>/dev/null || echo "   No dangling images to remove"
 
-# 清理可能冲突的镜像（通过镜像名称识别）
-echo "🧹 Cleaning up potentially conflicting images..."
-# 首先检查是否有ID冲突的镜像
-CONFLICTING_IMAGES=$(docker images --format "{{.ID}} {{.Repository}}:{{.Tag}}" | awk '{print $1}' | sort | uniq -d)
-if [ -n "$CONFLICTING_IMAGES" ]; then
-    echo "   Found conflicting image IDs: $CONFLICTING_IMAGES"
-    for conflict_id in $CONFLICTING_IMAGES; do
-        echo "   Removing all tags for conflicting ID: $conflict_id"
-        docker rmi "$conflict_id" 2>/dev/null || echo "     Could not remove ID $conflict_id"
-    done
-fi
-
-# 清理Python/UV相关的镜像
-docker images --format "{{.Repository}}:{{.Tag}} {{.ID}}" | grep -E "(python|uv)" | while read repo_tag id; do
-    if [ "$repo_tag" != "ghcr.io/reaslab/docker-python-runner:secure-latest" ]; then
-        echo "   Removing Python/UV related image: $repo_tag ($id)"
-        docker rmi "$id" 2>/dev/null || echo "     Could not remove $repo_tag"
-    fi
+# Clean up docker-python-runner related images
+echo "🧹 Cleaning up docker-python-runner related images..."
+docker images --format "{{.Repository}}:{{.Tag}} {{.ID}}" | grep "docker-python-runner" | while read repo_tag id; do
+    echo "   Removing docker-python-runner image: $repo_tag ($id)"
+    docker rmi -f "$id" 2>/dev/null || echo "     Could not remove $repo_tag"
 done
 
 echo "Building with Nix dockerTools..."
-# 配置 Nix 以支持 Flakes，与工作流保持一致
+# Configure Nix to support Flakes, consistent with workflow
 mkdir -p ~/.config/nix
 cat > ~/.config/nix/nix.conf << EOF
 experimental-features = nix-command flakes
 allow-import-from-derivation = true
 EOF
 
-# 设置环境变量以允许非自由包（Gurobi）
+# Set environment variable to allow unfree packages (Gurobi)
 export NIXPKGS_ALLOW_UNFREE=1
-# 使用 nix build 命令，与工作流保持一致
+
+# Generate current UTC timestamp
+CURRENT_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+echo "Setting Docker image timestamp to: $CURRENT_TIMESTAMP"
+
+# Use environment variable to pass timestamp to Nix
+export DOCKER_IMAGE_TIMESTAMP="$CURRENT_TIMESTAMP"
+
+# Use nix build command, consistent with workflow
 nix build .#docker-image --option sandbox false --impure
 
 echo "Loading Nix image into Docker..."
-# 记录加载前的镜像ID和标签
+# Record image IDs and tags before loading
 BEFORE_IMAGES=$(docker images --format "{{.ID}} {{.Repository}}:{{.Tag}}" | sort)
 
-# 加载Nix构建的镜像
+# Load Nix-built image
 docker load < result
 
-# 记录加载后的镜像ID和标签
+# Record image IDs and tags after loading
 AFTER_IMAGES=$(docker images --format "{{.ID}} {{.Repository}}:{{.Tag}}" | sort)
 
 echo "Tagging image..."
-# 找出新加载的镜像（通过比较ID和标签）
+# Find newly loaded image (by comparing IDs and tags)
 NEW_IMAGE_INFO=$(comm -13 <(echo "$BEFORE_IMAGES") <(echo "$AFTER_IMAGES") | head -1)
 
 if [ -n "$NEW_IMAGE_INFO" ]; then
     NEW_IMAGE_ID=$(echo "$NEW_IMAGE_INFO" | awk '{print $1}')
     NEW_IMAGE_TAG=$(echo "$NEW_IMAGE_INFO" | awk '{print $2}')
     echo "   Found new image: $NEW_IMAGE_TAG ($NEW_IMAGE_ID)"
 
-    # 检查是否是我们期望的镜像
+    # Check if this is our expected image
     if [[ "$NEW_IMAGE_TAG" == *"python"* ]] || [[ "$NEW_IMAGE_TAG" == *"uv"* ]] || [[ "$NEW_IMAGE_TAG" == *"reaslab"* ]]; then
         echo "   Using new image ID: $NEW_IMAGE_ID"
     else
         echo "   New image doesn't match expected pattern, using it anyway"
     fi
 else
     echo "   No new image detected, checking for existing suitable images"
-    # 查找现有的Python相关镜像
+    # Find existing Python-related images
     EXISTING_PYTHON=$(docker images --format "{{.ID}} {{.Repository}}:{{.Tag}}" | grep -E "(python|uv|reaslab)" | head -1)
     if [ -n "$EXISTING_PYTHON" ]; then
         EXISTING_ID=$(echo "$EXISTING_PYTHON" | awk '{print $1}')
@@ -90,7 +103,7 @@ else
     fi
 fi
 
-# 生成标签，与工作流保持一致
+# Generate tags, consistent with workflow
 TIMESTAMP=$(date +%Y%m%d-%H%M%S)
 SHORT_SHA=$(git rev-parse --short HEAD 2>/dev/null || echo "local")
 
@@ -99,18 +112,20 @@ echo "   - ghcr.io/reaslab/docker-python-runner:secure-latest"
 echo "   - ghcr.io/reaslab/docker-python-runner:secure-$TIMESTAMP"
 echo "   - ghcr.io/reaslab/docker-python-runner:secure-$SHORT_SHA"
 
-# 创建多个标签，与工作流保持一致
+# Create multiple tags, consistent with workflow
 docker tag $NEW_IMAGE_ID ghcr.io/reaslab/docker-python-runner:secure-latest
 docker tag $NEW_IMAGE_ID ghcr.io/reaslab/docker-python-runner:secure-$TIMESTAMP
 docker tag $NEW_IMAGE_ID ghcr.io/reaslab/docker-python-runner:secure-$SHORT_SHA
 
-# 验证最终镜像状态
+# Verify final image state
 echo "🔍 Verifying final image state..."
 FINAL_IMAGE_ID=$(docker images --format "{{.ID}}" ghcr.io/reaslab/docker-python-runner:secure-latest 2>/dev/null || echo "")
 if [ -n "$FINAL_IMAGE_ID" ]; then
     echo "   Final image ID: $FINAL_IMAGE_ID"
+    echo "   Created: $(docker images --format "{{.CreatedAt}}" ghcr.io/reaslab/docker-python-runner:secure-latest)"
+    echo "   Size: $(docker images --format "{{.Size}}" ghcr.io/reaslab/docker-python-runner:secure-latest)"
 
-    # 检查是否有其他镜像使用相同的ID
+    # Check if other images use the same ID
     DUPLICATE_TAGS=$(docker images --format "{{.Repository}}:{{.Tag}} {{.ID}}" | awk -v target_id="$FINAL_IMAGE_ID" '$2 == target_id && $1 != "ghcr.io/reaslab/docker-python-runner:secure-latest" {print $1}')
 
     if [ -n "$DUPLICATE_TAGS" ]; then
@@ -130,13 +145,14 @@ fi
 echo "✅ Build completed successfully!"
 
 echo "📋 Secure Image Configuration:"
-echo "   - Python version: 3.12 (restricted environment)"
+echo "   - Python Version: 3.12 (restricted environment)"
 echo "   - Security: Dangerous modules blocked (os, subprocess, sys, etc.)"
-echo "   - Resource limits: 1GB memory, CPU shares limit"
-echo "   - Safe packages: pip, setuptools, wheel, cython, numpy, scipy, pandas, matplotlib, scikit-learn"
+echo "   - Resource Limits: 1GB memory, CPU share limits"
+echo "   - Safe Packages: pip, setuptools, wheel, cython, numpy, scipy, pandas, matplotlib, scikit-learn, yfinance, seaborn"
 echo "   - Gurobi: 12.0.3 (via nixpkgs)"
-echo "   - Container: Read-only rootfs, non-root user (1000:1000)"
+echo "   - Container: Read-only root filesystem, non-root user (1000:1000)"
 echo "   - Network: Restricted (disabled by default)"
 echo "   - Tools: Minimal set (bash, coreutils, curl, tar, gzip)"
-echo "   - Compilation tools: Removed for security"
+echo "   - Compilation Tools: Removed for security"
+echo "   - Module Installation: Support via UV installation to /tmp/.local/lib/python3.12/site-packages"
 echo "Image: ghcr.io/reaslab/docker-python-runner:secure-latest"

docker-compose.yml

@@ -14,7 +14,7 @@ services:
       - ./gurobi.lic:/app/gurobi.lic:ro
     environment:
       - GRB_LICENSE_FILE=/app/gurobi.lic
-      - PYTHONPATH=/app
+      - PYTHONPATH=/app:/tmp/.local/lib/python3.12/site-packages
     working_dir: /app
     command: tail -f /dev/null
     # Security settings
@@ -27,10 +27,11 @@ services:
       - SETGID
       - SETUID
     tmpfs:
-      - /tmp:noexec,nosuid,size=100m
-      - /.cache:noexec,nosuid,size=1g,uid=1000,gid=1000,mode=755
-      - /.local:nosuid,size=500m,uid=1000,gid=1000,mode=755
-      - /.local/share:nosuid,size=1g,uid=1000,gid=1000,mode=755
+      - /tmp:nosuid,size=2g,uid=1000,gid=1000,mode=755
+      - /.cache:nosuid,size=1g,uid=1000,gid=1000,mode=755
+      - /.local:nosuid,size=1g,uid=1000,gid=1000,mode=755
+      - /.local/share:nosuid,size=512m,uid=1000,gid=1000,mode=755
+      - /.uv_cache:nosuid,size=1g,uid=1000,gid=1000,mode=755
     networks:
       - python-network
 
@@ -42,11 +43,17 @@ services:
       - ./gurobi.lic:/app/gurobi.lic:ro
     environment:
       - GRB_LICENSE_FILE=/app/gurobi.lic
-      - PYTHONPATH=/app
+      - PYTHONPATH=/app:/tmp/.local/lib/python3.12/site-packages
     working_dir: /app
     command: bash
     # Development mode - less restrictive
     user: "1000:1000"
+    tmpfs:
+      - /tmp:nosuid,size=2g,uid=1000,gid=1000,mode=755
+      - /.cache:nosuid,size=1g,uid=1000,gid=1000,mode=755
+      - /.local:nosuid,size=1g,uid=1000,gid=1000,mode=755
+      - /.local/share:nosuid,size=512m,uid=1000,gid=1000,mode=755
+      - /.uv_cache:nosuid,size=1g,uid=1000,gid=1000,mode=755
     networks:
       - python-network