Build multi-platform Docker images (amd64 + arm64)

.github/workflows/python-app.yml

@@ -61,6 +61,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:

Dockerfile

@@ -37,7 +37,10 @@ COPY . /build
 RUN uv build --wheel
 
 # Runtime stage - install and run the package
-FROM python:3.14.1-alpine AS runtime
+# Use a glibc-based image so NumPy/SciPy can be installed from prebuilt
+# wheels on both amd64 and arm64. Alpine/musl often falls back to source
+# builds, which is memory-intensive under buildx/QEMU.
+FROM python:3.14.1-slim AS runtime
 
 # So that STDOUT/STDERR is printed
 ENV PYTHONUNBUFFERED="1"
@@ -47,28 +50,20 @@ ENV PYTHONUNBUFFERED="1"
 ENV OTAVA_HOME /srv/otava
 WORKDIR ${OTAVA_HOME}
 
-RUN addgroup -g 8192 otava && \
-    adduser -u 8192 -G otava -s /bin/false -D -H otava && \
+RUN groupadd --gid 8192 otava && \
+    useradd --uid 8192 --gid otava --shell /usr/sbin/nologin --no-create-home otava && \
     chown otava:otava ${OTAVA_HOME}
 
 
 # Copy uv from builder stage and the wheel
 COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
 COPY --from=builder /build/dist/*.whl /tmp/
 
-# Install build dependencies, install the wheel, then remove build tools
-RUN apk add --no-cache --virtual .build-deps \
-    gcc \
-    g++ \
-    musl-dev \
-    python3-dev \
-    libffi-dev \
-    openblas-dev \
-    gfortran \
-    && apk add --no-cache libstdc++ openblas \
-    && uv pip install --system --no-cache /tmp/apache_otava-*.whl \
+# Install the wheel and remove temporary artifacts.
+# With the slim runtime image this should resolve binary dependencies from
+# prebuilt wheels instead of compiling NumPy/SciPy from source.
+RUN uv pip install --system --no-cache /tmp/apache_otava-*.whl \
     && rm /tmp/apache_otava-*.whl \
-    && apk del .build-deps \
     && rm /usr/local/bin/uv
 
 # Switch to otava user

docs/RELEASE.md

@@ -411,23 +411,17 @@ twine upload --verbose  apache_otava-$RELEASE_VERSION-py3-none-any.whl apache_ot
 
 ### Publish Docker Image
 
-Build the image:
+Ensure you have a multi-platform builder set up:
 
 ```bash
-uv run tox -e docker-build
+docker buildx create --name multiplatform --use || docker buildx use multiplatform
 ```
 
-Tag the image:
+Log in to Dockerhub and build and push the multi-platform image:
 
 ```bash
-docker tag apache/otava:latest apache/otava:$RELEASE_VERSION-incubating
-```
-
-Push the image to Dockerhub:
-
-```bash
-docker push apache/otava:$RELEASE_VERSION-incubating
-docker push apache/otava:latest
+docker login
+RELEASE_VERSION=$RELEASE_VERSION-incubating uv run tox -e docker-push
 ```
 
 ### Remove old release candidates from dist.apache.org

pyproject.toml

@@ -38,7 +38,12 @@ classifiers = [
 ]
 dependencies = [
     "dateparser>=1.0.0",
-    "numpy==2.2.0.*",
+
+    # NumPy 2.2.x supports Python 3.10–3.13, while Python 3.14 requires a
+    # newer NumPy release to get prebuilt wheels on all supported platforms.
+    "numpy==2.2.0.*; python_version < '3.14'",
+    "numpy>=2.3.2,<2.4; python_version >= '3.14'",
+
     "python-dateutil>=2.9.0",
     "ruamel.yaml==0.18.16",
     "requests>=2.32.5",

tox.ini

@@ -67,8 +67,8 @@ commands =
     pre-commit run --all-files --hook-stage pre-push insert-license
 
 # docker-build and docker-push environments; docker-push requires
-# RELEASE_VERSION (x.y.z), DOCKER_REGISTRY, DOCKER_REGISTRY_CREDS_USR and
-# DOCKER_REGISTR_CREDS_PSW to be set
+# RELEASE_VERSION (e.g. 0.7.0-incubating) to be set.
+# Log in to Dockerhub (docker login) before running docker-push.
 [testenv:docker-{build,push}]
 skip_install = true
 allowlist_externals =
@@ -77,21 +77,13 @@ allowlist_externals =
 passenv =
     SSH_AUTH_SOCK
     RELEASE_VERSION
-    DOCKER_REGISTRY
-    DOCKER_REGISTRY_CREDS_USR
-    DOCKER_REGISTRY_CREDS_PSW
 setenv =
     DOCKER_BUILDKIT=1
     DOCKER_PROJECT=apache/otava
     UV_OPTS = -v
 commands =
-    docker buildx build --tag {env:DOCKER_PROJECT}:latest .
-    push: docker image tag {env:DOCKER_PROJECT}:latest {env:DOCKER_PROJECT}:{env:RELEASE_VERSION}
-    push: docker image tag {env:DOCKER_PROJECT}:{env:RELEASE_VERSION} {env:DOCKER_REGISTRY}/{env:DOCKER_PROJECT}:{env:RELEASE_VERSION}
-    push: docker image tag {env:DOCKER_PROJECT}:latest {env:DOCKER_REGISTRY}/{env:DOCKER_PROJECT}:latest
-    push: docker login -u {env:DOCKER_REGISTRY_CREDS_USR} -p {env:DOCKER_REGISTRY_CREDS_PSW} {env:DOCKER_REGISTRY}
-    push: docker image push {env:DOCKER_REGISTRY}/{env:DOCKER_PROJECT}:{env:RELEASE_VERSION}
-    push: docker image push {env:DOCKER_REGISTRY}/{env:DOCKER_PROJECT}:latest
+    build: docker buildx build --platform linux/amd64,linux/arm64 --tag {env:DOCKER_PROJECT}:latest .
+    push: docker buildx build --platform linux/amd64,linux/arm64 --tag {env:DOCKER_PROJECT}:{env:RELEASE_VERSION} --tag {env:DOCKER_PROJECT}:latest --push .
 
 [pytest]
 # Ensure we do not include BUILD_DIR by explicitly specifying where to search for tests