feat: add Python pip & pipx to the base image (#121)

README.md

@@ -40,7 +40,7 @@ Choose your platform below. The scripts include both **Safe Mode** (asks for con
 All images support both **AMD64** (x86_64) and **ARM64** (Apple Silicon, etc.) architectures.
 
 All functions support switching between Docker image variants using flags:
-- **No flag** - Base image (Node.js, Git, basic tools)
+- **No flag** - Base image (Node.js, Python with pip & pipx, Git, basic tools)
 - **`--dotnet`** (`-d`) - .NET image (includes .NET 8, 9 & 10 SDKs)
 - **`--dotnet8`** (`-d8`) - .NET 8 image (includes .NET 8 SDK)
 - **`--dotnet9`** (`-d9`) - .NET 9 image (includes .NET 9 SDK)
@@ -669,7 +669,7 @@ This project provides multiple Docker image variants for different development s
 
 | Tag | Flag | Description |
 |-----|------|-------------|
-| `latest` | *(default)* | Base image with Node.js 20, Git, and essential tools |
+| `latest` | *(default)* | Base image with Node.js 20, Python (pip & pipx), Git, and essential tools |
 | `dotnet` | `--dotnet` | .NET 8, 9 & 10 SDKs |
 | `dotnet-8` | `--dotnet8` | .NET 8 SDK only |
 | `dotnet-9` | `--dotnet9` | .NET 9 SDK only |

docker/generated/Dockerfile.default

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-10

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-8

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-9

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-playwright

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-rust

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.golang

@@ -10,19 +10,39 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.java

@@ -10,19 +10,39 @@
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3 \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin, so that dir needs to be on PATH
+# for pipx-installed CLIs (e.g. `pipx install apm`) to be reachable without a per-session
+# `pipx ensurepath`. The entrypoint always runs as appuser with HOME=/home/appuser.
+# Append (not prepend): the entrypoint runs as root and resolves tools like getent/groupadd/
+# node via PATH before dropping to appuser, so a system binary must always win over anything
+# in the user-writable (and possibly bind-mounted) ~/.local/bin — otherwise a planted binary
+# there could execute as root. Appending keeps pipx apps reachable while system paths stay
+# authoritative; pipx app names don't collide with system binaries.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="${PATH}:/home/appuser/.local/bin"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="${PATH:+${PATH}:}/home/appuser/.local/bin" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.