Avoid conflicts with OS python packages by using Python venv in /opt/rucio

clients/Dockerfile

@@ -9,7 +9,6 @@ RUN dnf -y install yum-utils epel-release.noarch && \
         gfal2-all \
         python3-gfal2-util \
         python3-gfal2 \
-        python3-pip \
         nordugrid-arc-client \
         nordugrid-arc-plugins-gfal \
         nordugrid-arc-plugins-globus \
@@ -19,17 +18,13 @@ RUN dnf -y install yum-utils epel-release.noarch && \
         xrootd-client && \
     dnf clean all && \
     rm -rf /var/cache/dnf
-
-# Downgrade setuptools to avoid compatibility issues
-# TODO: remove once https://github.com/rucio/containers/issues/458 is resolved
-RUN dnf -y install https://vault.almalinux.org/9.6/BaseOS/x86_64/os/Packages/python3-setuptools-53.0.0-13.el9_6.1.noarch.rpm
-
-# Upgrade pip & setuptools and install Rucio
-RUN python3 -m pip install --no-cache-dir --upgrade pip && \
-    python3 -m pip install --no-cache-dir --upgrade setuptools && \
-    python3 -m pip install --no-cache-dir --pre rucio-clients[argcomplete]==$TAG && \
-    python3 -m pip install --no-cache-dir jinja2 j2cli pyyaml
 
+# Create venv, upgrade pip & setuptools and install Rucio
+RUN python3 -m venv --system-site-packages /opt/rucio && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade pip && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade setuptools && \
+    /opt/rucio/bin/pip install --no-cache-dir --pre rucio-clients[argcomplete]==$TAG && \
+    /opt/rucio/bin/pip install --no-cache-dir jinja2 j2cli pyyaml
 
 # Add a separate user and change ownership of config dir to that user
 RUN groupadd -g 1000 user && \
@@ -47,15 +42,16 @@ ADD --chown=user:user rucio.default.cfg /opt/user/rucio.default.cfg
 ADD init_rucio.sh /etc/profile.d/rucio_init.sh
 ADD --chown=user;user ./entrypoint.sh /opt/user/entrypoint.sh
 
-ENV PATH $PATH:/opt/rucio/bin
+# prepends venv with python to PATH, because there might be scripts depending on python being the correct executable
+ENV PATH /opt/rucio/bin:$PATH
 
 ARG POLICY_PACKAGE_REQUIREMENTS
 ARG USER=root
 USER root
 RUN if [ -n "$POLICY_PACKAGE_REQUIREMENTS" ]; then \
         dnf install -y git && \
         for package in $(echo $POLICY_PACKAGE_REQUIREMENTS | tr "," "\n"); do \
-            python3 -m pip install --no-cache-dir $package; \
+            /opt/rucio/bin/pip install --no-cache-dir $package; \
         done; \
         dnf remove -y git && \
         dnf autoremove && \

clients/init_rucio.sh

@@ -7,7 +7,7 @@ shopt -s checkwinsize
 if [ ! -f /opt/rucio/etc/rucio.cfg ]; then
     echo "File rucio.cfg not found. It will generate one."
     mkdir -p /opt/rucio/etc/
-    python3 /usr/local/rucio_client/merge_rucio_configs.py \
+    python3 /opt/rucio/rucio/tools/merge_rucio_configs.py \
         -s /opt/user/rucio.default.cfg \
         --use-env \
         -d /opt/rucio/etc/rucio.cfg

daemons/Dockerfile

@@ -24,7 +24,6 @@ RUN dnf install -y epel-release.noarch && \
         patch \
         python-gfal2 \
         procps-ng \
-        python-pip \
         python-mod_wsgi \
         sendmail \
         sendmail-cf \
@@ -34,6 +33,8 @@ RUN dnf install -y epel-release.noarch && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
+RUN update-crypto-policies --set DEFAULT:SHA1
+
 # cx_oracle requires `gcc` and Python headers, not present by default on arm64
 ARG TARGETARCH
 RUN if [ $TARGETARCH = "arm64" ]; then \
@@ -48,21 +49,18 @@ RUN rpm -i https://download.oracle.com/otn_software/linux/instantclient/1912000/
     echo "/usr/lib/oracle/19/client64/lib" >/etc/ld.so.conf.d/oracle.conf; \
     ldconfig
 
-# Downgrade setuptools to avoid compatibility issues
-# TODO: remove once https://github.com/rucio/containers/issues/458 is resolved
-RUN dnf -y install https://vault.almalinux.org/9.6/BaseOS/x86_64/os/Packages/python3-setuptools-53.0.0-13.el9_6.1.noarch.rpm
-
-RUN python3 -m pip install --no-cache-dir --upgrade pip && \
-    python3 -m pip install --no-cache-dir --upgrade setuptools
-RUN python3 -m pip install --no-cache-dir --pre rucio[oracle,mysql,postgresql,globus]==$TAG
+RUN python3 -m venv --system-site-packages /opt/rucio && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade pip && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade setuptools && \
+    /opt/rucio/bin/pip install --no-cache-dir --pre rucio[oracle,mysql,postgresql,globus]==$TAG && \
+    /opt/rucio/bin/pip install --no-cache-dir j2cli && \
+    mkdir -p /var/log/rucio
 
-RUN python3 -m pip install --no-cache-dir j2cli
-ADD rucio.config.default.cfg /tmp/
-ADD start-daemon.sh /
-
-RUN update-crypto-policies --set DEFAULT:SHA1
+COPY rucio.config.default.cfg /tmp/
+COPY start-daemon.sh /
 
-RUN mkdir /var/log/rucio
+# prepends venv with python to PATH, because there might be scripts depending on python being the correct executable
+ENV PATH /opt/rucio/bin:$PATH
 
 VOLUME /var/log/rucio
 VOLUME /opt/rucio/etc
@@ -73,7 +71,7 @@ USER root
 RUN if [ -n "$POLICY_PACKAGE_REQUIREMENTS" ]; then \
         dnf install -y git && \
         for package in $(echo $POLICY_PACKAGE_REQUIREMENTS | tr "," "\n"); do \
-            python3 -m pip install --no-cache-dir $package; \
+            /opt/rucio/bin/pip install --no-cache-dir $package; \
         done; \
         dnf remove -y git && \
         dnf autoremove && \

daemons/start-daemon.sh

@@ -4,7 +4,7 @@ if [ -f /opt/rucio/etc/rucio.cfg ]; then
     echo "rucio.cfg already mounted."
 else
     echo "rucio.cfg not found. will generate one."
-    python3 /usr/local/rucio/tools/merge_rucio_configs.py \
+    python3 /opt/rucio/rucio/tools/merge_rucio_configs.py \
         -s /tmp/rucio.config.default.cfg $RUCIO_OVERRIDE_CONFIGS \
         --use-env \
         -d /opt/rucio/etc/rucio.cfg
@@ -46,7 +46,7 @@ then
 
         if [ -s ${tmp_bin_file} ]
         then
-            if patch -p2 -d "/usr/local/bin/" < ${tmp_bin_file}
+            if patch -p2 -d "/opt/rucio/bin/" < ${tmp_bin_file}
             then
                 echo "Patch ${patchfile}/bin applied."
             else
@@ -85,7 +85,7 @@ echo "starting daemon with: $RUCIO_DAEMON $RUCIO_DAEMON_ARGS"
 echo ""
 
 if [ -z "$RUCIO_ENABLE_LOGS" ]; then
-    eval "exec /usr/bin/python3 /usr/local/bin/rucio-$RUCIO_DAEMON $RUCIO_DAEMON_ARGS"
+    eval "exec rucio-$RUCIO_DAEMON $RUCIO_DAEMON_ARGS"
 else
-    eval "exec /usr/bin/python3 /usr/local/bin/rucio-$RUCIO_DAEMON $RUCIO_DAEMON_ARGS >> /var/log/rucio/daemon.log 2>> /var/log/rucio/error.log"
+    eval "exec rucio-$RUCIO_DAEMON $RUCIO_DAEMON_ARGS >> /var/log/rucio/daemon.log 2>> /var/log/rucio/error.log"
 fi

dev/Dockerfile

@@ -41,8 +41,6 @@ RUN dnf -y install yum-utils epel-release.noarch && \
         nmap-ncat \
         openssh-clients \
         openssl-devel \
-        python3-setuptools \
-        python3-pip \
         python3-devel \
         python3-mod_wsgi \
         python3-m2crypto \
@@ -62,22 +60,19 @@ RUN curl https://rclone.org/install.sh | bash
 RUN git clone --depth 1 --branch "$TAG" https://github.com/rucio/rucio.git /tmp/rucio && rm -rf /tmp/rucio/.git
 
 ENV RUCIOHOME=/opt/rucio
-RUN mkdir -p $RUCIOHOME && \
-    mkdir -p $RUCIOHOME/etc/multi_vo/tst/etc && \
-    mkdir -p $RUCIOHOME/etc/multi_vo/ts2/etc
+RUN python3 -m venv --system-site-packages "$RUCIOHOME" && \
+    mkdir -p "$RUCIOHOME/etc/multi_vo/tst/etc" \
+             "$RUCIOHOME/etc/multi_vo/ts2/etc" \
+             "$RUCIOHOME/lib/rucio" \
+             "$RUCIOHOME/tools"
 WORKDIR $RUCIOHOME
-RUN mkdir -p \
-      bin \
-      etc \
-      lib/rucio \
-      tools
+ENV PATH=$RUCIOHOME/bin:$PATH
 
-RUN python3 -m pip install --no-cache --upgrade pip && \
-    python3 -m pip install --no-cache --upgrade setuptools wheel && \
-    python3 -m pip install --no-cache --upgrade -r /tmp/rucio/requirements/requirements.dev.txt ; \
-    ln -s $RUCIOHOME/lib/rucio /usr/local/lib/python3.9/site-packages/rucio
-
-RUN python3 -m pip install --no-cache --upgrade fts3
+RUN "$RUCIOHOME/bin/pip" install --no-cache --upgrade pip && \
+    "$RUCIOHOME/bin/pip" install --no-cache --upgrade setuptools wheel && \
+    "$RUCIOHOME/bin/pip" install --no-cache --upgrade -r /tmp/rucio/requirements/requirements.dev.txt && \
+    "$RUCIOHOME/bin/pip" install --no-cache --upgrade fts3 && \
+    ln -s ../../rucio "$RUCIOHOME/lib/python3.9/site-packages/rucio"
 
 COPY .pep8 .pep8
 COPY .flake8 .flake8
@@ -109,25 +104,23 @@ RUN chmod 777 /var/log/rucio/trace && \
     echo "" > /etc/httpd/conf.d/welcome.conf && \
     echo "" > /etc/httpd/conf.d/zgridsite.conf
 
-COPY logshow restartweb run_daemons create_monit_data /usr/local/bin/
+COPY logshow restartweb run_daemons create_monit_data $RUCIOHOME/bin/
 COPY monit-entrypoint.sh /monit-entrypoint.sh
 
 COPY dashboards/* $RUCIOHOME/etc/dashboards/
 COPY rse_repository.json $RUCIOHOME/etc/rse_repository.json
 
 RUN rm -r /tmp/rucio && \
-    chmod +x /usr/local/bin/logshow && \
-    chmod +x /usr/local/bin/restartweb && \
-    chmod +x /usr/local/bin/run_daemons && \
-    chmod +x /usr/local/bin/create_monit_data && \
-    chmod +x $RUCIOHOME/etc/dashboards/import_dashboards.sh && \
-    chmod +x /monit-entrypoint.sh && \
-    ln -fs /usr/bin/python3 /usr/bin/python
+    chmod +x "$RUCIOHOME/bin/logshow" \
+             "$RUCIOHOME/bin/restartweb" \
+             "$RUCIOHOME/bin/run_daemons" \
+             "$RUCIOHOME/bin/create_monit_data" \
+             "$RUCIOHOME/etc/dashboards/import_dashboards.sh" \
+             /monit-entrypoint.sh
 
 RUN update-crypto-policies --set DEFAULT:SHA1
 
 EXPOSE 443
-ENV PATH $PATH:$RUCIOHOME/bin
 RUN mkdir /tmp/prometheus && chown apache:apache /tmp/prometheus/
 ENV PROMETHEUS_MULTIPROC_DIR /tmp/prometheus
 CMD ["httpd","-D","FOREGROUND"]

fs/Dockerfile

@@ -13,7 +13,7 @@ RUN dnf -y install \
     rm -rf /var/cache/dnf
 
 ENV HOME=/opt/app-root/src \
-    PATH=/opt/app-root/src/bin:/opt/app-root/bin:/opt/rh/devtoolset-9/root/usr/bin/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+    PATH=/opt/app-root/src/bin:/opt/app-root/bin:/opt/rh/devtoolset-9/root/usr/bin/:/opt/rucio/bin:$PATH
 ENV BASH_ENV=/opt/app-root/etc/scl_enable \
     ENV=/opt/app-root/etc/scl_enable
 
@@ -23,7 +23,6 @@ RUN git clone --recursive https://github.com/rucio/fuse-posix.git
 WORKDIR /opt/fuse-posix
 RUN /bin/bash ./build.sh
 
-ENV PATH $PATH:/opt/rucio/bin
 RUN pip3 install argcomplete
 RUN /etc/profile.d/rucio_init.sh
 

fts-cron/Dockerfile_cpp

@@ -15,7 +15,7 @@ RUN dnf update -y && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
-    RUN dnf -y install -y httpd python-pip python-mod_wsgi libaio gcc python-devel mod_ssl openssl-devel python3-m2crypto libnsl patch xrootd-client && \
+    RUN dnf -y install -y httpd python-mod_wsgi libaio gcc python-devel mod_ssl openssl-devel python3-m2crypto libnsl patch xrootd-client && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
@@ -26,7 +26,7 @@ RUN chmod +x /usr/bin/kubectl
 # Install VOMS and FTS clients for delegating proxies
 RUN dnf -y install ca-certificates.noarch ca-policy-lcg fetch-crl voms-clients-cpp fts-rest-cli \
     wlcg-iam-lsc-atlas wlcg-iam-vomses-atlas wlcg-iam-lsc-cms wlcg-iam-vomses-cms \
-    python-setuptools python-requests && \
+    python-requests && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
@@ -35,14 +35,13 @@ RUN yum -y install wget && \
     yum clean all && \
     rm -rf /var/cache/yum
 
-# Downgrade setuptools to avoid compatibility issues
-# TODO: remove once https://github.com/rucio/containers/issues/458 is resolved
-RUN dnf -y install https://vault.almalinux.org/9.6/BaseOS/x86_64/os/Packages/python3-setuptools-53.0.0-13.el9_6.1.noarch.rpm
+RUN python3 -m venv --system-site-packages /opt/rucio && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade pip && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade setuptools && \
+    /opt/rucio/bin/pip install --no-cache-dir j2cli
 
-
-RUN python3 -m pip install --no-cache-dir --upgrade pip
-RUN python3 -m pip install --no-cache-dir --upgrade setuptools
-RUN python3 -m pip install --no-cache-dir j2cli
+# prepends venv with python to PATH, because there might be scripts depending on python being the correct executable
+ENV PATH /opt/rucio/bin:$PATH
 
 RUN mkdir -p /opt/rucio/certs/
 RUN mkdir -p /opt/rucio/kubeconfig/

fts-cron/Dockerfile_java

@@ -14,7 +14,7 @@ RUN dnf update -y && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
-RUN dnf -y install httpd python-pip python-mod_wsgi libaio gcc python-devel mod_ssl openssl-devel python3-m2crypto libnsl patch xrootd-client && \
+RUN dnf -y install httpd python-mod_wsgi libaio gcc python-devel mod_ssl openssl-devel python3-m2crypto libnsl patch xrootd-client && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
@@ -25,17 +25,17 @@ RUN chmod +x /usr/bin/kubectl
 # Install VOMS and FTS clients for delegating proxies
 RUN dnf -y install ca-certificates.noarch ca-policy-lcg fetch-crl voms-clients-java fts-rest-cli \
     wlcg-iam-lsc-atlas wlcg-iam-vomses-atlas wlcg-iam-lsc-cms wlcg-iam-vomses-cms \
-    python-pip python-setuptools python-requests && \
+    python-requests && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
-# Downgrade setuptools to avoid compatibility issues
-# TODO: remove once https://github.com/rucio/containers/issues/458 is resolved
-RUN dnf -y install https://vault.almalinux.org/9.6/BaseOS/x86_64/os/Packages/python3-setuptools-53.0.0-13.el9_6.1.noarch.rpm
+RUN python3 -m venv --system-site-packages /opt/rucio && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade pip && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade setuptools && \
+    /opt/rucio/bin/pip install --no-cache-dir j2cli
 
-RUN python3 -m pip install --no-cache-dir --upgrade pip
-RUN python3 -m pip install --no-cache-dir --upgrade setuptools
-RUN python3 -m pip install --no-cache-dir j2cli
+# prepends venv with python to PATH, because there might be scripts depending on python being the correct executable
+ENV PATH /opt/rucio/bin:$PATH
 
 RUN mkdir -p /opt/rucio/certs/
 RUN mkdir -p /opt/rucio/kubeconfig/

init/Dockerfile

@@ -14,23 +14,22 @@ RUN dnf install -y epel-release.noarch && \
         mod_ssl \
         procps-ng \
         python-devel \
-        python3-m2crypto \
-        python-pip && \
+        python3-m2crypto && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
 RUN rpm -i https://download.oracle.com/otn_software/linux/instantclient/1912000/oracle-instantclient19.12-basiclite-19.12.0.0.0-1.x86_64.rpm; \
     echo "/usr/lib/oracle/19/client64/lib" >/etc/ld.so.conf.d/oracle.conf; \
     ldconfig
 
-# Downgrade setuptools to avoid compatibility issues
-# TODO: remove once https://github.com/rucio/containers/issues/458 is resolved
-RUN dnf -y install https://vault.almalinux.org/9.6/BaseOS/x86_64/os/Packages/python3-setuptools-53.0.0-13.el9_6.1.noarch.rpm
+RUN python3 -m venv --system-site-packages /opt/rucio && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade pip && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade setuptools && \
+    /opt/rucio/bin/pip install --pre rucio[oracle,mysql,postgresql]==$TAG && \
+    /opt/rucio/bin/pip install --no-cache-dir jinja2 j2cli pyyaml
 
-RUN python3 -m pip install --no-cache-dir --upgrade pip
-RUN python3 -m pip install --no-cache-dir --upgrade setuptools
-RUN python3 -m pip install --pre rucio[oracle,mysql,postgresql]==$TAG
-RUN python3 -m pip install jinja2 j2cli pyyaml
+# prepends venv with python to PATH, because there might be scripts depending on python being the correct executable
+ENV PATH /opt/rucio/bin:$PATH
 
 RUN mkdir -p /opt/rucio/etc
 
@@ -45,7 +44,7 @@ USER root
 RUN if [ -n "$POLICY_PACKAGE_REQUIREMENTS" ]; then \
         dnf install -y git && \
         for package in $(echo $POLICY_PACKAGE_REQUIREMENTS | tr "," "\n"); do \
-            python3 -m pip install --no-cache-dir $package; \
+            /opt/rucio/bin/pip install --no-cache-dir $package; \
         done; \
         dnf remove -y git && \
         dnf autoremove && \

init/docker-entrypoint.sh

@@ -3,7 +3,7 @@
 if [ -f /opt/rucio/etc/rucio.cfg ]; then
     echo "rucio.cfg already mounted."
 else
-    python3 /usr/local/rucio/tools/merge_rucio_configs.py \
+    python3 /opt/rucio/rucio/tools/merge_rucio_configs.py \
         -s /tmp/rucio.config.default.cfg $RUCIO_OVERRIDE_CONFIGS \
         --use-env \
         -d /opt/rucio/etc/rucio.cfg

probes/Dockerfile

@@ -21,8 +21,7 @@ RUN dnf install -y epel-release.noarch && \
         libaio \
         openssl-devel \
         procps-ng \
-        python-devel \
-        python-pip && \
+        python-devel && \
     dnf clean all && \
     rm -rf /var/cache/dnf
 
@@ -32,16 +31,15 @@ RUN rpm -i https://download.oracle.com/otn_software/linux/instantclient/1912000/
 
 RUN rpm -i https://github.com/dshearer/jobber/releases/download/v1.4.0/jobber-1.4.0-1.el7.x86_64.rpm
 
-# Downgrade setuptools to avoid compatibility issues
-# TODO: remove once https://github.com/rucio/containers/issues/458 is resolved
-RUN dnf -y install https://vault.almalinux.org/9.6/BaseOS/x86_64/os/Packages/python3-setuptools-53.0.0-13.el9_6.1.noarch.rpm
+RUN python3 -m venv --system-site-packages /opt/rucio && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade pip && \
+    /opt/rucio/bin/pip install --no-cache-dir --upgrade setuptools && \
+    /opt/rucio/bin/pip install --no-cache-dir --pre rucio[oracle,mysql,postgresql] && \
+    /opt/rucio/bin/pip install --no-cache-dir j2cli psycopg2-binary && \
+    /opt/rucio/bin/pip install --no-cache-dir cx-oracle PyMySQL
 
-RUN python3 -m pip install --no-cache-dir --upgrade pip
-RUN python3 -m pip install --no-cache-dir --upgrade setuptools
-RUN rm -rf /usr/lib/python3.6/site-packages/ipaddress*
-RUN python3 -m pip install --no-cache-dir --pre rucio[oracle,mysql,postgresql]
-RUN python3 -m pip install --no-cache-dir j2cli psycopg2-binary
-RUN python3 -m pip install --no-cache-dir cx-oracle PyMySQL
+# prepends venv with python to PATH, because there might be scripts depending on python being the correct executable
+ENV PATH /opt/rucio/bin:$PATH
 
 WORKDIR /
 RUN git clone https://github.com/rucio/probes.git