build(images): give the Elixir images jq, and take Python out of pipeline-tools

sean commented

2026-09-10 12:52:47 +00:00

Owner

Tests should not reach for an interpreter: a fixture that calls python3 -c pays interpreter startup on every call, and one invoked a few hundred times in a test makes that the dominant cost. elixir-builder and elixir-tester had no jq; both now install and prove it, VERSION 3 each. The tester installs its own because it copies only /opt and rebar3 from the builder. Measured, not assumed: no line installs python3 in either Elixir image, yet elixir-builder:v2 answers python3 3.12.13 with fourteen python3 rpms, because on AlmaLinux 10 dnf IS Python (dnf is a symlink to dnf-3) and dnf5 is not packaged for this release. So dropping it from an install list does nothing, and dnf remove python3 is refused because dnf is protected and requires python3-dnf. rpm can do it: a probe on this exact base digest showed rpm -e --nodeps over the python3/dnf/libdnf set leaves zero python3 rpms, no interpreter on disk, and a working gcc, jq, git, make, tar, unzip and perl. pipeline-tools takes that removal now, since nothing in it uses Python and its package manager is build-time only: every consumer uses it as a COPY source stage with zero commands and copies out only kubectl and yq. The Elixir images keep Python for now because binjovi's make contract-check runs two unittest suites over PRODUCTION Python, the node helper and kernel services that run on hosts during a kernel roll; the interpreter cannot leave until that is partitioned. Four controls confirmed red. All sixteen guards pass. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-10 12:52:47 +00:00

build(images): give the Elixir images jq, and take Python out of pipeline-tools

binjovi/ci Binjovi completed the frozen plan

Details

c0fd471b91

TESTS SHOULD NOT REACH FOR AN INTERPRETER. A guard or fixture that calls
`python3 -c` pays interpreter startup on every call, and a fixture invoked a
few hundred times in one test makes that the dominant cost of the run. jq
starts in about a millisecond and reads the JSON these tests actually handle.

elixir-builder and elixir-tester had NO jq. Both now install it and prove it
at build time. The tester installs its own rather than inheriting one, because
it copies only /opt/erlang, /opt/elixir, /opt/mix, /opt/hex and rebar3 from the
builder -- an rpm in /usr/bin does not cross that boundary. Both go to
VERSION 3.

PYTHON IS PRESENT WHETHER OR NOT ANYONE ASKS. Measured, not assumed: no line
in either Elixir Dockerfile installs python3, and `python3 --version` in
elixir-builder:v2 answers 3.12.13 with fourteen python3 rpms installed. On
AlmaLinux 10 `dnf` IS Python -- /usr/bin/dnf is a symlink to dnf-3, /usr/bin/dnf4
is the same link, and **dnf5 is not packaged for this release** -- so the
interpreter arrives with the package manager.

Dropping it from an install list therefore does nothing. `dnf remove python3`
does not work either: dnf is a protected package that requires python3-dnf, so
it refuses. rpm can do it, and it is clean -- measured in a probe on this exact
base digest, `rpm -e --nodeps` over the python3/dnf/libdnf set leaves zero
python3 rpms, no interpreter anywhere on disk, and a working gcc 14.3.1,
jq, git 2.52.0, make, tar, unzip and perl.

pipeline-tools takes that removal now. Nothing in it uses Python:
binjovi-oci-publish, binjovi-openbao-login and binjovi-go-operator-publish are
bash over crane, cosign, jq and curl. Its package manager is build-time only --
every consumer (argocd-deployer, flux-deployer, gitops-validator, pipelines-ci)
uses it as a COPY source stage with ZERO commands of its own, verified, and
copies out only the kubectl and yq binaries. VERSION 13 to 14, and the two
guards that pin that version move with it.

THE ELIXIR IMAGES KEEP PYTHON FOR NOW, and this is the reason. binjovi's
`make contract-check` runs in a stage built on elixir-builder and invokes
python3 seven times. Five are standalone harnesses that could be shell. Two
are not: `python3 -m unittest discover` over
apps/binjovi_agent/priv/linux-publication and apps/binjovi_control/priv/kernel,
which unit-test PRODUCTION Python -- the node helper and kernel services that
run on hosts during a kernel roll. Those tests cannot become shell without
losing the coverage, so the interpreter cannot leave these two images until
that code is partitioned into a stage of its own. The guard refuses an
EXPLICIT python install here, which is the part that would be a decision.

Controls confirmed red: python3 back in the pipeline-tools install list, a
`python3 -c` invocation added elsewhere in it, the removal step deleted, and
the build-time proof line removed. The refusal excludes the removal step
itself, because that step necessarily names python3 -- written the naive way it
fired on the very code that does the removing. All sixteen builder-images
guards pass.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit c0fd471b91 into trunk

2026-09-10 13:01:51 +00:00

Rows
Columns

build(images): give the Elixir images jq, and take Python out of pipeline-tools #269