Incompatibility between uvicorn and python images above 3.10

[JoanaPedrosoDiconium]

I am using the image python python3.10.17-alpine3.20, however this notification has some CVEs. When I try to update it to any python image, either python3.11.12-alpine3.20, python3.12.10-alphine3.20 or python3.13.3-alpine3.20 I get the following error on pod start:

Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "uvicorn": executable file not found in $PATH: unknown

Uvicorn version being used is 0.34.1. Is there some known incompatibility between uvicorn and any of those docker images? If so what image could I use that fixes the CVEs and is compatible with uvicorn?

Thank you
Joana

[yosifkit]

Besides the python versions there aren't many differences between them. I am unable to reproduce any problem of uvicorn not being in the path (and the same result for python:3.12.10-alpine3.20 and python:3.13.3-alpine3.20):

$ docker run -it --rm python:3.11.12-alpine3.20 sh
Unable to find image 'python:3.11.12-alpine3.20' locally
3.11.12-alpine3.20: Pulling from library/python
14cc43950863: Pull complete
d713be8cea52: Pull complete
0999d641008f: Pull complete
Digest: sha256:61197ffa686ff0afdff16b6dbbe2c320d31df3d8e54319c743aeecc47159d1f7
Status: Downloaded newer image for python:3.11.12-alpine3.20
/ # pip install uvicorn
Collecting uvicorn
  Downloading uvicorn-0.34.1-py3-none-any.whl.metadata (6.5 kB)
Collecting click>=7.0 (from uvicorn)
  Downloading click-8.1.8-py3-none-any.whl.metadata (2.3 kB)
Collecting h11>=0.8 (from uvicorn)
  Downloading h11-0.14.0-py3-none-any.whl.metadata (8.2 kB)
Downloading uvicorn-0.34.1-py3-none-any.whl (62 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 62.4/62.4 kB 3.2 MB/s eta 0:00:00
Downloading click-8.1.8-py3-none-any.whl (98 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 98.2/98.2 kB 10.6 MB/s eta 0:00:00
Downloading h11-0.14.0-py3-none-any.whl (58 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 58.3/58.3 kB 8.8 MB/s eta 0:00:00
Installing collected packages: h11, click, uvicorn
Successfully installed click-8.1.8 h11-0.14.0 uvicorn-0.34.1
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv

[notice] A new release of pip is available: 24.0 -> 25.0.1
[notice] To update, run: pip install --upgrade pip
/ # uvicorn
Usage: uvicorn [OPTIONS] APP
Try 'uvicorn --help' for help.

Error: Missing argument 'APP'.
/ #

[JoanaPedrosoDiconium]

Hello! Not sure what was happening but I tried to build it again today and now it's not failing for us either, so the issue is fixed.

Thank you for your response!

[JoanaPedrosoDiconium]

Just checked and whilst on build everything is fine, when I try to initiate the container by running an exec command with unvicorn I get an error saying it's not on the PATH even though we have commands to install it (as mentioned, it was working on lower versions of the python image). Is there maybe some package that is needed to install this dependency in particular that is missing from the most recent python images?

[tianon]

I don't think so, I've just tested with docker exec and it still works fine:

$ docker run -it --rm --pull=always --name test python:3.13.3-alpine3.20 sh
3.13.3-alpine3.20: Pulling from library/python
Digest: sha256:cd01a123d91e75ac4fcfef154e746939687823112a055d9a3492c65d6768125c
Status: Image is up to date for python:3.13.3-alpine3.20
/ # pip install uvicorn
Collecting uvicorn
  Downloading uvicorn-0.34.2-py3-none-any.whl.metadata (6.5 kB)
Collecting click>=7.0 (from uvicorn)
  Downloading click-8.1.8-py3-none-any.whl.metadata (2.3 kB)
Collecting h11>=0.8 (from uvicorn)
  Downloading h11-0.14.0-py3-none-any.whl.metadata (8.2 kB)
Downloading uvicorn-0.34.2-py3-none-any.whl (62 kB)
Downloading click-8.1.8-py3-none-any.whl (98 kB)
Downloading h11-0.14.0-py3-none-any.whl (58 kB)
Installing collected packages: h11, click, uvicorn
Successfully installed click-8.1.8 h11-0.14.0 uvicorn-0.34.2
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
/ # uvicorn --version
Running uvicorn 0.34.2 with CPython 3.13.3 on Linux

in a new terminal:

$ docker exec -it test uvicorn --version
Running uvicorn 0.34.2 with CPython 3.13.3 on Linux
$ docker exec -it test sh
/ # uvicorn --version
Running uvicorn 0.34.2 with CPython 3.13.3 on Linux

Maybe the way you're installing it has changed somehow? 3.11+ do come with newer PIP versions out-of-the-box:

$ for v in 3.10 3.11 3.12 3.13; do echo -n "$v: "; docker run --rm "python:$v-alpine3.20" pip --version; done
3.10: pip 23.0.1 from /usr/local/lib/python3.10/site-packages/pip (python 3.10)
3.11: pip 24.0 from /usr/local/lib/python3.11/site-packages/pip (python 3.11)
3.12: pip 25.0.1 from /usr/local/lib/python3.12/site-packages/pip (python 3.12)
3.13: pip 25.0.1 from /usr/local/lib/python3.13/site-packages/pip (python 3.13)

[JoanaPedrosoDiconium]

We want to pickup the versions of the dependencies that are in the pyproject so we install it like this:
RUN pip install --no-cache-dir poetry poetry-plugin-export==1.7.1 && \ pip freeze > pip-freeze-buildtools.txt && \ poetry export --without-hashes -f requirements.txt -o requirements.txt && \ pip uninstall -y -r pip-freeze-buildtools.txt && \ pip install --no-cache-dir -r requirements.txt
I can explore this difference in the PIP package to see if it's having some impact.

[JoanaPedrosoDiconium]

I think this might be related with the fact that in the project we're using python 3.10, so I guess we can't update to latest images because they require python >3.10.