Repository navigation
fix(docker): keep -nogil GIL-free after SQLAlchemy cext (#1398) - #1656
Merged
Merged
Conversation
…build Isolate DISABLE_SQLALCHEMY_CEXT to Dockerfile.nogil, add freetds/krb5 for cp314t pymssql, consume hosted SQL extras wheels, and gate publish on internal demo manifest timing (#1398).
Record that mariadb/oracledb/psycopg2-binary/pymssql free-threaded wheels are for the -nogil image rebuild only, not general install, including the two system packages needed to rebuild them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DISABLE_SQLALCHEMY_CEXT=1+--no-binary sqlalchemytoDockerfile.nogilso the GIL image (latest/1.7.4.post12, digestsha256:ab8f5dad3e336…) keeps stock cext.-nogilwithfreetds-dev+libkrb5-devfor cp314tpymssql; consume hosted SQL extras wheels (mariadb,oracledb,psycopg2-binary,pymssql) so the next nogil build skips source compile.FastFilter.filter_batchviapy.detach(benefits both images).--demotiming compare (scan_manifest.duration_minutes) and do not publish-nogilif it does not beat GIL.Closes #1398
Evidence (this host)
import sqlalchemy: GIL False; 0sqlalchemy/**/*.so--version/ smoke: no SQLAlchemy GILRuntimeWarningdocker-archive, grype 0.117.0): pass — Medium/Low CPython only (/tmp/grype-nogil-1398.txt)0.03min vs nogil0.02min (26 findings). Publish gate eligible; corpus is small (0.01 min resolution).linux_x86_64wheels uploaded towheelhouse-x86-64-v1-2026-07-29; SHA256SUMS = 58 wheels. Site index: chore(wheelhouse): PEP 503 simple/ for cp314t SQL extras data-boar-site#86What we did not do
PYTHON_GIL=0/-Xgil=0:latest/ Hub1.7.4.post12-nogilimage (operator review)Test plan
./scripts/check-all.shtests/test_docker_image_hardening.pybuild-nogil-local.shAC (GIL after SA, zero.so, smoke,--demo)./scripts/grype-image-gate.sh docker-archive:/tmp/data_boar-1.7.4.post12-nogil.tar-nogilpublish