ci: check generated service containers

.github/workflows/ci.yml

@@ -295,6 +295,62 @@ jobs:
             exit 1
           fi
 
+  generated-container-checks:
+    name: containers / generated service files
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
+        with:
+          version: "0.10.10"
+
+      - name: Set up Python
+        run: uv python install 3.11
+
+      - name: Build Phlo and service wheels
+        run: uv build --all-packages --wheel --out-dir "$RUNNER_TEMP/phlo-container-wheelhouse"
+
+      - name: Install wheels into a clean environment
+        shell: bash
+        run: |
+          set -euo pipefail
+          env_dir="$RUNNER_TEMP/phlo-container-env"
+          uv venv "$env_dir" --python 3.11
+          uv pip install \
+            --python "$env_dir/bin/python" \
+            --find-links "$RUNNER_TEMP/phlo-container-wheelhouse" \
+            phlo \
+            phlo-alloy \
+            phlo-api \
+            phlo-clickhouse \
+            phlo-clickstack \
+            phlo-dagster \
+            phlo-grafana \
+            phlo-hasura \
+            phlo-loki \
+            phlo-minio \
+            phlo-nessie \
+            phlo-oauth2-proxy \
+            phlo-openmetadata \
+            phlo-observatory \
+            phlo-pgweb \
+            phlo-postgres \
+            phlo-postgrest \
+            phlo-prometheus \
+            phlo-rustfs \
+            phlo-superset \
+            phlo-traefik \
+            phlo-trino
+          echo "$env_dir/bin" >> "$GITHUB_PATH"
+
+      - name: Check generated service containers
+        run: phlo --no-color plugin check --containers
+
   release-golden-path:
     name: python / release golden path
     runs-on: ubuntu-latest
@@ -496,6 +552,7 @@ jobs:
       - python-quality
       - python-core-tests
       - quickstart-smoke
+      - generated-container-checks
       - release-golden-path
       - recovery-continuity-drill
       - windows-release-contract
@@ -509,6 +566,7 @@ jobs:
           PYTHON_QUALITY: ${{ needs.python-quality.result }}
           PYTHON_CORE_TESTS: ${{ needs.python-core-tests.result }}
           QUICKSTART_SMOKE: ${{ needs.quickstart-smoke.result }}
+          GENERATED_CONTAINER_CHECKS: ${{ needs.generated-container-checks.result }}
           RELEASE_GOLDEN_PATH: ${{ needs.release-golden-path.result }}
           RECOVERY_CONTINUITY_DRILL: ${{ needs.recovery-continuity-drill.result }}
           WINDOWS_RELEASE_CONTRACT: ${{ needs.windows-release-contract.result }}
@@ -526,6 +584,7 @@ jobs:
             echo "| python / quality | ${PYTHON_QUALITY} |"
             echo "| python / core tests | ${PYTHON_CORE_TESTS} |"
             echo "| python / quickstart smoke | ${QUICKSTART_SMOKE} |"
+            echo "| containers / generated service files | ${GENERATED_CONTAINER_CHECKS} |"
             echo "| python / release golden path | ${RELEASE_GOLDEN_PATH} |"
             echo "| python / recovery continuity drill | ${RECOVERY_CONTINUITY_DRILL} |"
             echo "| windows / release golden path contract | ${WINDOWS_RELEASE_CONTRACT} |"
@@ -538,6 +597,7 @@ jobs:
             "${PYTHON_QUALITY}" \
             "${PYTHON_CORE_TESTS}" \
             "${QUICKSTART_SMOKE}" \
+            "${GENERATED_CONTAINER_CHECKS}" \
             "${RELEASE_GOLDEN_PATH}" \
             "${RECOVERY_CONTINUITY_DRILL}" \
             "${WINDOWS_RELEASE_CONTRACT}" \

packages/phlo-api/src/phlo_api/Dockerfile

@@ -16,7 +16,7 @@ ARG PHLO_VERSION=
 ARG PHLO_API_VERSION=
 ARG PHLO_WHEELHOUSE=
 
-RUN pip install --no-cache-dir uv
+RUN pip install --no-cache-dir "uv==0.8.13"
 
 COPY --from=phlo-build-context /opt/phlo-build-context/wheelhouse /opt/phlo-wheelhouse
 
@@ -38,6 +38,12 @@ RUN set -eux; \
 
 COPY --from=phlo-build-context /opt/phlo-build-context/phlo-api-entrypoint.sh /usr/local/bin/phlo-api-entrypoint.sh
 
+RUN groupadd --system phlo \
+    && useradd --system --gid phlo --home-dir /app --no-create-home phlo \
+    && chown -R phlo:phlo /app
+
+USER phlo
+
 EXPOSE 4000
 
 ENTRYPOINT ["/usr/local/bin/phlo-api-entrypoint.sh"]

packages/phlo-dagster/src/phlo_dagster/Dockerfile

@@ -13,12 +13,14 @@ ARG PHLO_VERSION=""
 ARG PHLO_DBT_VERSION=""
 ARG PHLO_WHEELHOUSE=""
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 # Install system dependencies and uv
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    git \
+    curl="$(apt-cache policy curl | awk '/Candidate:/ {print $2}')" \
+    git="$(apt-cache policy git | awk '/Candidate:/ {print $2}')" \
     && rm -rf /var/lib/apt/lists/* \
-    && pip install uv
+    && pip install --no-cache-dir "uv==0.8.13"
 
 # Copy only the artifact directory from the context stage; normal generated builds receive an
 # empty directory and retain the existing PyPI installation path.
@@ -38,15 +40,22 @@ RUN \
     else \
         uv pip install --system --no-deps --prerelease explicit "phlo==$PHLO_VERSION"; \
         PHLO_PRERELEASE_REQUIREMENTS="$(python -c 'import importlib.metadata as md, re; print(" ".join(req.split(";")[0].strip() for req in (md.metadata("phlo").get_all("Requires-Dist") or []) if "extra == '\''defaults'\''" in req and re.search(r"(a|b|rc|dev)[0-9]+", req)))')"; \
-        uv pip install --system --prerelease explicit "phlo[defaults]==$PHLO_VERSION" "$PHLO_DBT_REQUIREMENT" $PHLO_PRERELEASE_REQUIREMENTS dagster-webserver dagster-postgres "psycopg[binary]"; \
+        base_requirements=("phlo[defaults]==$PHLO_VERSION" "$PHLO_DBT_REQUIREMENT" dagster-webserver dagster-postgres "psycopg[binary]"); \
+        if [ -n "$PHLO_PRERELEASE_REQUIREMENTS" ]; then read -r -a prerelease_requirements <<< "$PHLO_PRERELEASE_REQUIREMENTS"; base_requirements+=("${prerelease_requirements[@]}"); fi; \
+        uv pip install --system --prerelease explicit "${base_requirements[@]}"; \
     fi; \
     else \
         uv pip install --system "phlo[defaults]" "$PHLO_DBT_REQUIREMENT" dagster-webserver dagster-postgres "psycopg[binary]"; \
     fi
 
 # Keep entrypoint outside /opt/dagster so dev volume mounts never hide it.
 COPY dagster/entrypoint.sh /usr/local/bin/phlo-dagster-entrypoint.sh
-RUN chmod +x /usr/local/bin/phlo-dagster-entrypoint.sh
+RUN chmod +x /usr/local/bin/phlo-dagster-entrypoint.sh \
+    && groupadd --system phlo \
+    && useradd --system --gid phlo --home-dir /opt/dagster --no-create-home phlo \
+    && chown -R phlo:phlo /opt/dagster
+
+USER phlo
 
 # Copy workspace configuration
 COPY dagster/workspace.yaml /opt/dagster/workspace.yaml