Distroless python sdk

buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy

@@ -576,6 +576,10 @@ class BeamModulePlugin implements Plugin<Project> {
       return project.containerArchitectures() != [project.nativeArchitecture()]
     }
 
+    project.ext.containerBuildTarget = {
+      return project.findProperty('container-build-target')
+    }
+
     /** ***********************************************************************************************/
     // Define and export a map dependencies shared across multiple sub-projects.
     //

sdks/python/container/Dockerfile

@@ -103,9 +103,24 @@ RUN if [ "$pull_licenses" = "true" ] ; then \
       python /tmp/license_scripts/pull_licenses_py.py ; \
     fi
 
-FROM beam
+FROM beam as base
 ARG pull_licenses
 COPY --from=third_party_licenses /opt/apache/beam/third_party_licenses /opt/apache/beam/third_party_licenses
 RUN if [ "$pull_licenses" != "true" ] ; then \
       rm -rf /opt/apache/beam/third_party_licenses ; \
     fi
+
+ARG TARGETARCH
+FROM gcr.io/distroless/python3-debian12:latest-${TARGETARCH} as distroless
+ARG py_version
+COPY --from=base /usr/local/include /usr/local/include
+COPY --from=base /usr/local/bin /usr/local/bin
+COPY --from=base /usr/local/lib /usr/local/lib
+# Python standard library modules:
+COPY --from=base /usr/lib/python${py_version} /usr/lib/python${py_version}
+# Contains the boot entrypoint:
+COPY --from=base /opt /opt
+ENV PATH "$PATH:/usr/local/bin"
+
+# Despite the ENTRYPOINT set above, need to reset since deriving the layer from a different image:
+ENTRYPOINT ["/opt/apache/beam/boot"]

sdks/python/container/common.gradle

@@ -71,10 +71,16 @@ def copyLauncherDependencies = tasks.register("copyLauncherDependencies", Copy)
 }
 
 def pushContainers = project.rootProject.hasProperty(["isRelease"]) || project.rootProject.hasProperty("push-containers")
+var baseTarget = 'base'
+var buildTarget = project.containerBuildTarget() ?: baseTarget
+var imageName = project.docker_image_default_repo_prefix + "python${project.ext.pythonVersion}_sdk"
+if (buildTarget != baseTarget) {
+  imageName += "_${buildTarget}"
+}
 
 docker {
   name containerImageName(
-          name: project.docker_image_default_repo_prefix + "python${project.ext.pythonVersion}_sdk",
+          name: imageName,
           root: project.rootProject.hasProperty(["docker-repository-root"]) ?
                   project.rootProject["docker-repository-root"] :
                   project.docker_image_default_repo_root,
@@ -90,6 +96,7 @@ docker {
   platform(*project.containerPlatforms())
   load project.useBuildx() && !pushContainers
   push pushContainers
+  target buildTarget
 }
 
 dockerPrepare.dependsOn copyLauncherDependencies

sdks/python/test-suites/dataflow/build.gradle

@@ -60,6 +60,12 @@ task validatesContainerTests {
   }
 }
 
+task validateDistrolessContainerTests {
+  getVersionsAsList('distroless_python_versions').each {
+    dependsOn.add(":sdks:python:test-suites:dataflow:py${getVersionSuffix(it)}:validatesDistrolessContainer")
+  }
+}
+
 task examplesPostCommit {
   getVersionsAsList('dataflow_examples_postcommit_py_versions').each {
     dependsOn.add(":sdks:python:test-suites:dataflow:py${getVersionSuffix(it)}:examples")

sdks/python/test-suites/dataflow/common.gradle

@@ -380,6 +380,50 @@ task validatesContainer() {
   }
 }
 
+task validatesDistrolessContainer() {
+  def pyversion = "${project.ext.pythonVersion.replace('.', '')}"
+  dependsOn 'initializeForDataflowJob'
+  def pyProject = project(":sdks:python:container:py${pyversion}")
+  pyProject.ext['container-build-target'] = 'distroless'
+  rootProject.ext['docker-repository-root'] = "us.gcr.io/apache-beam-testing/${System.getenv('USER')}"
+  rootProject.ext['docker-tag'] = System.currentTimeMillis()
+  rootProject.ext['push-containers'] = true
+  dependsOn ":sdks:python:container:py${pyversion}:docker"
+
+  // TODO(damondouglas): the following is duplicate from container/common.gradle; attempts to single source via ext failed
+  var baseTarget = 'base'
+  var buildTarget = project.containerBuildTarget() ?: baseTarget
+  var imageName = project.docker_image_default_repo_prefix + "python${project.ext.pythonVersion}_sdk"
+  if (buildTarget != baseTarget) {
+    imageName += "_${buildTarget}"
+  }
+  var imageURI = containerImageName(
+          name: imageName,
+          root: project.rootProject["docker-repository-root"],
+          tag: project.rootProject["docker-tag"])
+
+  var testTarget = "apache_beam/examples/wordcount_it_test.py::WordCountIT::test_wordcount_it"
+
+  def argMap = [
+          "output": "gs://temp-storage-for-end-to-end-tests/py-it-cloud/output",
+          "project": "apache-beam-testing",
+          "region": "us-central1",
+          "runner": "TestDataflowRunner",
+          "sdk_container_image": imageURI,
+          "sdk_location": "container",
+          "staging_location": "gs://temp-storage-for-end-to-end-tests/staging-it",
+          "temp_location": "gs://temp-storage-for-end-to-end-tests/temp-it",
+  ]
+  def cmdArgs = mapToArgString(argMap)
+  doLast {
+    exec {
+      workingDir = "${rootDir}/sdks/python"
+      executable 'sh'
+      args '-c', ". ${envdir}/bin/activate && pytest ${testTarget} --test-pipeline-options=\"${cmdArgs}\""
+    }
+  }
+}
+
 task validatesContainerARM() {
   def pyversion = "${project.ext.pythonVersion.replace('.', '')}"
   dependsOn 'initializeForDataflowJob'

sdks/python/test-suites/gradle.properties

@@ -54,3 +54,6 @@ prism_examples_postcommit_py_versions=3.9,3.12
 
 # cross language postcommit python test suites
 cross_language_validates_py_versions=3.9,3.12
+
+# Python versions to support distroless variants
+distroless_python_versions=3.9,3.10,3.11,3.12