faster linux build

build/wheel/docker/Dockerfile.manylinux

@@ -4,23 +4,51 @@
 FROM quay.io/pypa/manylinux_2_28_x86_64:latest
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
-    PIP_ROOT_USER_ACTION=ignore
+    PIP_ROOT_USER_ACTION=ignore \
+    ORISYS_WHEELHOUSE_ROOT=/opt/orisys-wheelhouse
 
-# Only install compile/repair tooling here. Runtime deps (numpy/scipy/opencv/numba)
-# are declared in the wheel metadata and installed by pip when users install orisys.
-# Nuitka is configured with --nofollow-import-to for those packages.
-RUN for PYBIN in \
-        /opt/python/cp310-cp310/bin \
-        /opt/python/cp311-cp311/bin \
-        /opt/python/cp312-cp312/bin; do \
-      echo "=== Installing build tooling into ${PYBIN} ===" && \
-      "${PYBIN}/python" -m pip install --upgrade pip setuptools wheel && \
-      "${PYBIN}/python" -m pip install \
-          "nuitka>=2.0" \
-          ordered-set \
-          zstandard \
-          auditwheel; \
-    done
+# Per-ABI build tooling plus a per-ABI wheelhouse of every package the release
+# flow installs at build time:
+#
+#   * build tooling  - nuitka/auditwheel etc. baked in, so the entrypoint does
+#     not have to re-resolve them from PyPI on every container start
+#     (ORISYS_UPDATE_BUILD_TOOLS=1 opts back in to that).
+#   * wheelhouse     - `build/wheel/build.py --target pypi-linux` force-enables
+#     verification, which creates a throwaway venv and pip-installs the built
+#     wheel plus its declared runtime deps. Runtime deps are deliberately NOT
+#     installed into the image interpreter (users get them from the wheel
+#     metadata), so without a wheelhouse every build re-downloaded
+#     numpy/scipy/opencv/numba — roughly 200 MB, three times over, once per ABI.
+#     The entrypoint points pip at the wheelhouse with
+#     PIP_NO_INDEX/PIP_FIND_LINKS, which keeps the venv isolated and still
+#     exercises real dependency resolution, just without the network.
+#
+# --only-binary=:all: makes a missing wheel a loud image-build failure instead of
+# a slow source build inside the container.
+RUN set -eux; \
+    for TAG in cp310-cp310 cp311-cp311 cp312-cp312; do \
+        PYBIN="/opt/python/${TAG}/bin"; \
+        echo "=== build tooling for ${TAG} ==="; \
+        "${PYBIN}/python" -m pip install --upgrade pip setuptools wheel; \
+        "${PYBIN}/python" -m pip install \
+            "nuitka>=2.0" \
+            ordered-set \
+            zstandard \
+            auditwheel; \
+        echo "=== wheelhouse for ${TAG} ==="; \
+        "${PYBIN}/python" -m pip download \
+            --only-binary=:all: \
+            --dest "${ORISYS_WHEELHOUSE_ROOT}/${TAG}" \
+            pip \
+            setuptools \
+            wheel \
+            auditwheel \
+            numpy \
+            scipy \
+            opencv-python \
+            numba; \
+    done; \
+    du -sh "${ORISYS_WHEELHOUSE_ROOT}"/*
 
 WORKDIR /src
 ENTRYPOINT ["/bin/bash", "/src/build/wheel/docker/entrypoint.sh"]

build/wheel/docker/entrypoint.sh

@@ -6,12 +6,18 @@ set -euo pipefail
 TARGET="${ORISYS_BUILD_TARGET:-pypi-linux}"
 # Comma-separated manylinux tags, e.g. "cp310-cp310,cp311-cp311,cp312-cp312"
 PYTHON_TAGS="${ORISYS_PYTHON_TAGS:-cp310-cp310,cp311-cp311,cp312-cp312}"
+WHEELHOUSE_ROOT="${ORISYS_WHEELHOUSE_ROOT:-/opt/orisys-wheelhouse}"
+# The image already bakes in pip/setuptools/wheel/nuitka/auditwheel. Re-resolving
+# them from PyPI on every container start costs a network round-trip per ABI and
+# lets the running container drift from the image it was built from.
+UPDATE_BUILD_TOOLS="${ORISYS_UPDATE_BUILD_TOOLS:-0}"
 
 cd /src
 
 echo "=== manylinux entrypoint ==="
 echo "Target: ${TARGET}"
 echo "Python tags: ${PYTHON_TAGS}"
+echo "Wheelhouse root: ${WHEELHOUSE_ROOT}"
 uname -a
 
 IFS=',' read -r -a TAG_ARRAY <<< "${PYTHON_TAGS}"
@@ -40,7 +46,27 @@ for tag in "${TAG_ARRAY[@]}"; do
   export PATH="${PYBIN}:${PATH}"
   export PYTHONPATH="/src/src${PYTHONPATH:+:${PYTHONPATH}}"
 
-  "${PYBIN}/python" -m pip install -q --upgrade pip setuptools wheel auditwheel
+  # Point pip at the per-ABI wheelhouse baked into the image. The pypi-linux
+  # target force-enables verification, which creates a throwaway venv and
+  # pip-installs the built wheel plus its declared runtime deps; serving those
+  # from the wheelhouse keeps the venv isolated (no --system-site-packages) while
+  # removing a ~200 MB download per ABI. PIP_* is inherited by every pip
+  # subprocess, including that venv.
+  wheelhouse="${WHEELHOUSE_ROOT}/${tag}"
+  if [[ -d "${wheelhouse}" ]]; then
+    export PIP_NO_INDEX=1
+    export PIP_FIND_LINKS="${wheelhouse}"
+    echo "[info] pip is offline, installing from ${wheelhouse}"
+  else
+    echo "[warn] no wheelhouse at ${wheelhouse}; pip will use the network." >&2
+    echo "[warn] rebuild the image without -SkipImageBuild to bake it in." >&2
+    unset PIP_NO_INDEX PIP_FIND_LINKS || true
+  fi
+
+  if [[ "${UPDATE_BUILD_TOOLS}" == "1" ]]; then
+    echo "[info] refreshing build tooling (ORISYS_UPDATE_BUILD_TOOLS=1)"
+    "${PYBIN}/python" -m pip install -q --upgrade pip setuptools wheel auditwheel
+  fi
 
   if "${PYBIN}/python" build/wheel/build.py --target "${TARGET}"; then
     BUILT+=("${tag}")
@@ -48,6 +74,8 @@ for tag in "${TAG_ARRAY[@]}"; do
     echo "[ERROR] Build failed for ${tag}" >&2
     FAILED=1
   fi
+
+  unset PIP_NO_INDEX PIP_FIND_LINKS || true
 done
 
 echo ""