register toolchain only for container exec and use it in py*_image

.bazelci/presubmit.yml

@@ -6,7 +6,7 @@ buildifier:
   # are enabled except:
   # rule-impl-return, uninitialized, return-value, rule-impl-return
   # TODO (suvanjan): Re-enable once issues are fixed.
-  warnings: "attr-cfg,attr-license,attr-non-empty,attr-output-default,attr-single-file,confusing-name,constant-glob,ctx-actions,ctx-args,depset-iteration,depset-union,dict-concatenation,duplicated-name,filetype,function-docstring,git-repository,http-archive,integer-division,load,load-on-top,module-docstring,name-conventions,native-build,native-package,no-effect,out-of-order-load,output-group,package-name,package-on-top,positional-args,redefined-variable,repository-name,same-origin-load,string-iteration,unreachable,unsorted-dict-items,unused-variable"
+  warnings: "attr-cfg,attr-license,attr-non-empty,attr-output-default,attr-single-file,confusing-name,constant-glob,ctx-actions,ctx-args,depset-iteration,depset-union,dict-concatenation,duplicated-name,filetype,function-docstring,git-repository,http-archive,integer-division,load,load-on-top,module-docstring,name-conventions,native-build,native-package,no-effect,out-of-order-load,output-group,package-name,package-on-top,redefined-variable,repository-name,same-origin-load,string-iteration,unreachable,unsorted-dict-items,unused-variable"
 platforms:
   ubuntu1604:
     test_targets:
@@ -127,10 +127,10 @@ platforms:
     # Disabled e2e tests that pull from localhost in nested workspace
     - "-//testing/new_pusher_tests/..."
     build_flags:
-    - "--extra_toolchains=@bazel_toolchains//configs/ubuntu16_04_clang/latest:toolchain_docker"
-    - "--extra_execution_platforms=@bazel_toolchains//configs/ubuntu16_04_clang/latest:platform_docker"
-    - "--host_platform=@bazel_toolchains//configs/ubuntu16_04_clang/latest:platform_docker"
-    - "--platforms=@bazel_toolchains//configs/ubuntu16_04_clang/latest:platform_docker"
+    - "--extra_toolchains=@buildkite_config//config:cc-toolchain,//toolchains:rbe_container_cc_toolchain"
+    - "--extra_execution_platforms=@buildkite_config//config:platform,//platforms:rbe_container_platform"
+    - "--host_platform=@buildkite_config//config:platform"
+    - "--platforms=@buildkite_config//config:platform"
     - "--keep_going"
     # For tests/container:set_env_make_vars
     - "--define=ENV_KEY=my_key"
@@ -160,10 +160,10 @@ platforms:
     - "-//tests/contrib/automatic_container_release:configs_test"
     - "-//tests/contrib/automatic_container_release:configs_test_deps_spec_only"
     test_flags:
-    - "--extra_toolchains=@bazel_toolchains//configs/ubuntu16_04_clang/latest:toolchain_docker"
-    - "--extra_execution_platforms=@bazel_toolchains//configs/ubuntu16_04_clang/latest:platform_docker"
-    - "--host_platform=@bazel_toolchains//configs/ubuntu16_04_clang/latest:platform_docker"
-    - "--platforms=@bazel_toolchains//configs/ubuntu16_04_clang/latest:platform_docker"
+    - "--extra_toolchains=@buildkite_config//config:cc-toolchain,//toolchains:rbe_container_cc_toolchain"
+    - "--extra_execution_platforms=@buildkite_config//config:platform,//platforms:rbe_container_platform"
+    - "--host_platform=@buildkite_config//config:platform"
+    - "--platforms=@buildkite_config//config:platform"
     - "--keep_going"
     # For tests/container:set_env_make_vars_test
     - "--define=ENV_KEY=my_key"

README.md

@@ -1257,13 +1257,6 @@ python tools installed in a different location to those defined in
 toolchain that points to these paths and register it _before_ the call to
 `py*_images/image.bzl:deps` in your `WORKSPACE`.
 
-Until Bazel 0.26.0 is relesed, registration of the default python toolchain
-will result in all python targets using that same toolchain, which might
-result in errors if any of those targets need to run locally.
-Once Bazel 0.26.0 is out, this default toolchain will only be compatible with
-python targets that run inside a container and will not interfere with
-other python targets.
-
 Use of python toolchain features, currently, only supports picking one
 version of python for execution of host tools. `rules_docker` heavily depends
 on execution of python host tools that are only compatible with python 2.

WORKSPACE

@@ -194,8 +194,8 @@ container_pull(
 
 # This image is used by tests/contrib tests.
 container_pull(
-    name = "bazel_0271",
-    digest = "sha256:436708ebb76c0089b94c46adac5d3332adb8c98ef8f24cb32274400d01bde9e3",
+    name = "bazel_0291",
+    digest = "sha256:957c063f1296220c55d640ce82542b4c50d7a75b968fa3fd104e5cf293391ede",
     registry = "l.gcr.io",
     repository = "google/bazel",
 )
@@ -400,23 +400,39 @@ dockerfile_image(
     "kaniko_debug",
 ]]
 
-# Register the default py_toolchain for containerized execution
-register_toolchains("//toolchains/python:container_py_toolchain")
+# Register the default py_toolchain / platform for containerized execution
+register_toolchains("//toolchains:container_py_toolchain")
+
+register_execution_platforms("//platforms:local_container_platform")
 
 http_archive(
     name = "bazel_toolchains",
-    sha256 = "1411f2648185b0e7d8c2bb88b25cc8f2c477cc4223133461652ddce2b3154ac4",
-    strip_prefix = "bazel-toolchains-0.29.3",
+    sha256 = "b0c426d36826554f34e433e96dbd9b271e7f5b248a750f080a12534dcb944f48",
+    strip_prefix = "bazel-toolchains-0.29.8",
     urls = [
-        "https://github.com/bazelbuild/bazel-toolchains/archive/0.29.3.tar.gz",
-        "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/archive/0.29.3.tar.gz",
+        "https://github.com/bazelbuild/bazel-toolchains/archive/0.29.8.tar.gz",
     ],
 )
 
+# Define several exec property repo rules to be used in testing.
+load("@bazel_toolchains//rules/experimental/rbe:exec_properties.bzl", "merge_dicts", "rbe_exec_properties")
+
+# A standard RBE execution property set repo rule.
+rbe_exec_properties(
+    name = "exec_properties",
+)
+
 load("@bazel_toolchains//rules:rbe_repo.bzl", "rbe_autoconfig")
+load("@exec_properties//:constants.bzl", "DOCKER_SIBLINGS_CONTAINERS", "NETWORK_ON")
 
 rbe_autoconfig(
     name = "buildkite_config",
+    base_container_digest = "sha256:4bfd33aa9ce73e28718385b8c01608a79bc6546906f01cf9329311cace1766a1",
+    digest = "sha256:c20046852a2d7910c55d76e0ec9c182b37532a9f0360d22dd5c9a1451b7c3a15",
+    exec_properties = merge_dicts(DOCKER_SIBLINGS_CONTAINERS, NETWORK_ON),
+    registry = "marketplace.gcr.io",
+    repository = "google/bazel",
+    use_legacy_platform_definition = False,
 )
 
 # gazelle:repo bazel_gazelle

contrib/repro_test.bzl

@@ -57,7 +57,7 @@ container_repro_test(
 
 container_repro_test(
     name = "derivative_with_volume_repro_test",
-    base = "@bazel_0271//image",
+    base = "@bazel_0291//image",
     container_diff_args = [
         "history",
         "file",

platforms/BUILD

@@ -0,0 +1,58 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache 2.0
+
+# Constraints used to describe docker compatible toolchains.
+
+constraint_setting(name = "containerized")
+
+constraint_value(
+    name = "run_in_container",
+    constraint_setting = ":containerized",
+)
+
+# Default host platform that has constraint_value set for the
+# "@io_bazel_rules_docker//toolchains:run_in_container" constraint.
+# This platform must be registered to run xx_image targets
+# that require a custom toolchain to run inside the container
+# (other than, e.g., the autogenerated toolchain). This
+# currently only applies to py_image and py3_image targets
+# as the autogenerated py toolchain might point to a different
+# location than the py in the container.
+platform(
+    name = "local_container_platform",
+    constraint_values = [
+        "@io_bazel_rules_docker//platforms:run_in_container",
+    ],
+    parents = ["@bazel_tools//platforms:host_platform"],
+)
+
+# Default RBE platform that has constraint_value set for the
+# "@io_bazel_rules_docker//toolchains:run_in_container" constraint.
+# This platform must be registered to run xx_image targets
+# that require a custom toolchain to run inside the container
+# (other than, e.g., the autogenerated toolchain). This
+# currently only applies to py_image and py3_image targets
+# as the autogenerated py toolchain might point to a different
+# location than the py in the container.
+platform(
+    name = "rbe_container_platform",
+    constraint_values = [
+        "@io_bazel_rules_docker//platforms:run_in_container",
+    ],
+    parents = ["@buildkite_config//config:platform"],
+)

python/image.bzl

@@ -41,8 +41,9 @@ def repositories():
     """
     _go_deps()
 
-    # Register the default py_toolchain for containerized execution
-    native.register_toolchains("@io_bazel_rules_docker//toolchains/python:container_py_toolchain")
+    # Register the default py_toolchain / platform for containerized execution
+    native.register_toolchains("@io_bazel_rules_docker//toolchains:container_py_toolchain")
+    native.register_execution_platforms("@io_bazel_rules_docker//platforms:local_container_platform")
 
     excludes = native.existing_rules().keys()
     if "py_image_base" not in excludes:
@@ -91,9 +92,13 @@ def py_image(name, base = None, deps = [], layers = [], **kwargs):
     # TODO(mattmoor): Consider using par_binary instead, so that
     # a single target can be used for all three.
 
-    # TODO(ngiraldo): Add exec_compatible_with=["@io_bazel_rules_docker//toolchains/pythin:run_in_container"]
-    # once py_binary targets support it.
-    native.py_binary(name = binary_name, python_version = "PY2", deps = deps + layers, **kwargs)
+    native.py_binary(
+        name = binary_name,
+        python_version = "PY2",
+        deps = deps + layers,
+        exec_compatible_with = ["@io_bazel_rules_docker//platforms:run_in_container"],
+        **kwargs
+    )
 
     # TODO(mattmoor): Consider making the directory into which the app
     # is placed configurable.

python3/image.bzl

@@ -40,8 +40,9 @@ def repositories():
     """
     _go_deps()
 
-    # Register the default py_toolchain for containerized execution
-    native.register_toolchains("@io_bazel_rules_docker//toolchains/python:container_py_toolchain")
+    # Register the default py_toolchain / platform for containerized execution
+    native.register_toolchains("@io_bazel_rules_docker//toolchains:container_py_toolchain")
+    native.register_execution_platforms("@io_bazel_rules_docker//platforms:local_container_platform")
 
     excludes = native.existing_rules().keys()
     if "py3_image_base" not in excludes:
@@ -85,9 +86,13 @@ def py3_image(name, base = None, deps = [], layers = [], **kwargs):
     # TODO(mattmoor): Consider using par_binary instead, so that
     # a single target can be used for all three.
 
-    # TODO(ngiraldo): Add exec_compatible_with=["@io_bazel_rules_docker//toolchains/pythin:run_in_container"]
-    # once py_binary targets support it.
-    native.py_binary(name = binary_name, python_version = "PY3", deps = deps + layers, **kwargs)
+    native.py_binary(
+        name = binary_name,
+        python_version = "PY3",
+        deps = deps + layers,
+        exec_compatible_with = ["@io_bazel_rules_docker//platforms:run_in_container"],
+        **kwargs
+    )
 
     # TODO(mattmoor): Consider making the directory into which the app
     # is placed configurable.

tests/contrib/BUILD

@@ -188,7 +188,7 @@ container_repro_test(
 
 container_repro_test(
     name = "derivative_with_volume_repro_test",
-    base = "@bazel_0271//image",
+    base = "@bazel_0291//image",
     container_diff_args = [
         "history",
         "file",

toolchains/python/BUILD → toolchains/BUILD

@@ -37,27 +37,33 @@ py_runtime_pair(
 )
 
 # A toolchain to run python outputs inside a container.
-# If you are using --incompatible_use_python_toolchains this toolchain must
-# be used to indicate the location of python tools inside the container as
-# the auto-detected toolchain relies on using "which", which is not present
-# in the default python containers.
 # If you are using a custom base for py_image which has python tools in a
 # different location, you must register that toolchain prior to the
 # registration of this one in @io_bazel_rules_docker//python:image.bzl
 toolchain(
     name = "container_py_toolchain",
-    # TODO(ngiraldo): Uncomment the line below once py_binary targets
-    # support using 'exec_compatible_with'
-    #target_compatible_with = [":run_in_container"],
+    exec_compatible_with = [
+        "@io_bazel_rules_docker//platforms:run_in_container",
+    ],
     toolchain = ":default_container_py_runtime_pair",
     toolchain_type = "@bazel_tools//tools/python:toolchain_type",
 )
 
-# Constraints used to describe docker compatible toolchains.
-
-constraint_setting(name = "docker")
-
-constraint_value(
-    name = "run_in_container",
-    constraint_setting = ":docker",
+# Toolchain required for xx_image targets that rely on xx_binary
+# which transitively require a C/C++ toolchain (currently only
+# py_binary). This is only needed for remote execution.
+toolchain(
+    name = "rbe_container_cc_toolchain",
+    exec_compatible_with = [
+        "@io_bazel_rules_docker//platforms:run_in_container",
+        "@bazel_tools//platforms:x86_64",
+        "@bazel_tools//platforms:linux",
+        "@bazel_tools//tools/cpp:clang",
+    ],
+    target_compatible_with = [
+        "@bazel_tools//platforms:linux",
+        "@bazel_tools//platforms:x86_64",
+    ],
+    toolchain = "@buildkite_config//cc:cc-compiler-k8",
+    toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
 )