faster linux build

build/wheel/docker/Dockerfile.manylinux

@@ -4,23 +4,51 @@
 FROM quay.io/pypa/manylinux_2_28_x86_64:latest
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
-    PIP_ROOT_USER_ACTION=ignore
+    PIP_ROOT_USER_ACTION=ignore \
+    ORISYS_WHEELHOUSE_ROOT=/opt/orisys-wheelhouse
 
-# Only install compile/repair tooling here. Runtime deps (numpy/scipy/opencv/numba)
-# are declared in the wheel metadata and installed by pip when users install orisys.
-# Nuitka is configured with --nofollow-import-to for those packages.
-RUN for PYBIN in \
-        /opt/python/cp310-cp310/bin \
-        /opt/python/cp311-cp311/bin \
-        /opt/python/cp312-cp312/bin; do \
-      echo "=== Installing build tooling into ${PYBIN} ===" && \
-      "${PYBIN}/python" -m pip install --upgrade pip setuptools wheel && \
-      "${PYBIN}/python" -m pip install \
-          "nuitka>=2.0" \
-          ordered-set \
-          zstandard \
-          auditwheel; \
-    done
+# Per-ABI build tooling plus a per-ABI wheelhouse of every package the release
+# flow installs at build time:
+#
+#   * build tooling  - nuitka/auditwheel etc. baked in, so the entrypoint does
+#     not have to re-resolve them from PyPI on every container start
+#     (ORISYS_UPDATE_BUILD_TOOLS=1 opts back in to that).
+#   * wheelhouse     - `build/wheel/build.py --target pypi-linux` force-enables
+#     verification, which creates a throwaway venv and pip-installs the built
+#     wheel plus its declared runtime deps. Runtime deps are deliberately NOT
+#     installed into the image interpreter (users get them from the wheel
+#     metadata), so without a wheelhouse every build re-downloaded
+#     numpy/scipy/opencv/numba — roughly 200 MB, three times over, once per ABI.
+#     The entrypoint points pip at the wheelhouse with
+#     PIP_NO_INDEX/PIP_FIND_LINKS, which keeps the venv isolated and still
+#     exercises real dependency resolution, just without the network.
+#
+# --only-binary=:all: makes a missing wheel a loud image-build failure instead of
+# a slow source build inside the container.
+RUN set -eux; \
+    for TAG in cp310-cp310 cp311-cp311 cp312-cp312; do \
+        PYBIN="/opt/python/${TAG}/bin"; \
+        echo "=== build tooling for ${TAG} ==="; \
+        "${PYBIN}/python" -m pip install --upgrade pip setuptools wheel; \
+        "${PYBIN}/python" -m pip install \
+            "nuitka>=2.0" \
+            ordered-set \
+            zstandard \
+            auditwheel; \
+        echo "=== wheelhouse for ${TAG} ==="; \
+        "${PYBIN}/python" -m pip download \
+            --only-binary=:all: \
+            --dest "${ORISYS_WHEELHOUSE_ROOT}/${TAG}" \
+            pip \
+            setuptools \
+            wheel \
+            auditwheel \
+            numpy \
+            scipy \
+            opencv-python \
+            numba; \
+    done; \
+    du -sh "${ORISYS_WHEELHOUSE_ROOT}"/*
 
 WORKDIR /src
 ENTRYPOINT ["/bin/bash", "/src/build/wheel/docker/entrypoint.sh"]