gnn-preprocessing.def

# CPU / Joern / light Python — for CPG extraction and related preprocess steps.
#
# Build (run from repo root so %files resolves):
#   apptainer build gnn-preprocessing.sif gnn-preprocessing.def
#
# Run from repo root (CWD is visible in the container at the same path):
#   apptainer exec gnn-preprocessing.sif bash -lc 'export PYTHONPATH="${PWD}/src" && python -m graph.cpgtools.preprocess.parse --help'

Bootstrap: docker
From: ubuntu:22.04

# Staged pip inputs live under /root, not /tmp: Apptainer bind-mounts /dev/shm over /tmp during %post.
%files
    gnn-requirements-preprocess.txt /root/gnn-pip/requirements.txt

%post
    # Apptainer runs %post with /bin/sh; this image needs bash (pipefail, source, sdkman).
    /bin/bash <<'CHEETAH_GNN_PREPOST'
    set -euo pipefail
    export DEBIAN_FRONTEND=noninteractive

    mkdir -p /root/apt-tmp
    export TMPDIR=/root/apt-tmp
    # Apptainer %post: /var (and often /root subpaths) are overlay — apt's partial→final .deb rename
    # hits EBUSY. /tmp is tmpfs here; _apt cannot read /root (0700), so archives must not live under /root.
    mkdir -p /tmp/apt-archives/partial
    cat >/etc/apt/apt.conf.d/99cheetah-apptainer.conf <<'EOF'
Dir::Cache::archives "/tmp/apt-archives";
APT::Sandbox::User "root";
EOF

    # --- versions (keep in sync with gnn-training.def where shared) ---
    readonly PYTHON_VERSION=3.11.9
    readonly JAVA_VERSION=17.0.9-tem
    readonly JOERN_VERSION=v4.0.49
    readonly TZ=Europe/Berlin

    ln -snf "/usr/share/zoneinfo/${TZ}" /etc/localtime && echo "${TZ}" > /etc/timezone

    apt-get update
    apt-get install -y --no-install-recommends \
        ca-certificates curl git locales time unzip wget zip

    mkdir -p /usr/share/man/man1
    apt-get install -y --no-install-recommends \
        build-essential gfortran libbz2-dev libc6-dev libffi-dev libgdbm-dev \
        libgraphviz-dev libncursesw5-dev libpq-dev libreadline-dev libsqlite3-dev \
        libssl-dev tar tk-dev wget zlib1g-dev \
        gradle p7zip-full software-properties-common

    # --- Python (source build) ---
    cd /
    wget -q "https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tar.xz"
    tar -xf "Python-${PYTHON_VERSION}.tar.xz"
    cd "Python-${PYTHON_VERSION}"
    ./configure --enable-optimizations
    make -j "$(nproc)"
    make install
    ln -sf /usr/local/bin/python3 /usr/bin/python
    ln -sf /usr/local/bin/pip3 /usr/bin/pip
    cd /
    rm -rf "Python-${PYTHON_VERSION}" "Python-${PYTHON_VERSION}.tar.xz"

    pip install --no-cache-dir --upgrade pip setuptools wheel

    # --- Java / sbt (Joern) ---
    curl -sS "https://get.sdkman.io" | bash
    set +u
    # shellcheck disable=SC1091
    source /root/.sdkman/bin/sdkman-init.sh
    # sdkman-install.sh uses $1/$2/$3 without defaults; nounset breaks it.
    # yes | sdk: sdk closes stdin when done; yes then gets SIGPIPE (exit 141). With pipefail,
    # that would fail the whole %post — turn pipefail off for these pipelines only.
    set +o pipefail
    yes | sdk install java "${JAVA_VERSION}"
    yes | sdk install sbt
    set -o pipefail
    set -u

    # --- Joern ---
    mkdir -p /tmp/joern-build
    cd /tmp/joern-build
    curl -fsSL -o joern-install.sh \
        "https://github.com/joernio/joern/releases/download/${JOERN_VERSION}/joern-install.sh"
    chmod u+x joern-install.sh
    ./joern-install.sh --version="${JOERN_VERSION}" --install-dir=/opt/joern
    cd /
    rm -rf /tmp/joern-build

    # --- Python venv (preprocess-only deps, baked into SIF) ---
    python -m venv /opt/gnn-preprocess-venv
    # shellcheck disable=SC1091
    source /opt/gnn-preprocess-venv/bin/activate
    pip install --no-cache-dir -r /root/gnn-pip/requirements.txt
    deactivate || true
    rm -rf /root/gnn-pip
    rm -rf /root/apt-tmp /tmp/apt-archives

    apt-get clean
    rm -rf /var/lib/apt/lists/*
CHEETAH_GNN_PREPOST

%environment
    export TZ=Europe/Berlin
    export JAVA_OPTS="-Xmx20G"
    export LC_ALL=C.UTF-8
    export PYTHONDONTWRITEBYTECODE=1
    export PYTHONUNBUFFERED=1
    export JOERN_HOME=/opt/joern
    export PATH="/opt/gnn-preprocess-venv/bin:${PATH}:/opt/joern/joern-cli"

%runscript
    exec "$@"