Hey there! I have a question related to building docker images with pants in the CI. We use

pants package

inside a Gitlab CI job, which runs fine until it hits this error

ProcessExecutionFailure: Process 'Building dockerfile_parser.pex from <resource://pants.backend.docker.subsystems/dockerfile.lock>' failed with exit code 1.
stdout:
stderr:
There was 1 error downloading required artifacts:
1. dockerfile 3.2 from <https://files.pythonhosted.org/packages/0e/de/00149a416148c609c71c8a94e5e4df14a9f62bf2fa41aeda021b76388623/dockerfile-3.2.0-cp36-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.whl>

Our CI does not have access to the internet. This works well with other utilities by setting

[python-repos]
indexes = ["https://<our-internal-pypi-mirror>/pip-cache/simple"]

but somehow this

dockerfile_parser.pex

that gets generated during the packaging of a Docker image is unaware of this. Any help to solve the problem is appreciated!

Note the

resource://...

- this is a lockfile pre-generated and shipped with Pants. Naturally it points at PyPI. To use a custom lock, see: https://www.pantsbuild.org/docs/reference-dockerfile-parser#install_from_resolve. You'll need to create a new named resolve (aka lockfile, see: https://www.pantsbuild.org/docs/python-lockfiles#multiple-lockfiles) that has the same requirements as the embedded resource lock. Those are (for Pants 2.16.0) `dockerfile==3.2.0`: https://github.com/pantsbuild/pants/blob/016d98d727d42ee4ab75dcc9cb4f73d5a4f65b10/src/python/pants/backend/docker/subsystems/dockerfile.lock#L66-L68

So I already tried adding a

dockerfile-parser.lock

specified via the

install_from_resolve

, but then the lockfile does not contain any actual entry. I tried now adding a

requirements

entry to the

[dockerfile-parser]

entry in the

pants.toml

with a requirements file pointing to

dockerfile:3.2.0

, but no luck 😕

def a few things needed to make it work https://www.pantsbuild.org/docs/python-lockfiles#lockfiles-for-tools . Is it not possible to submit the requirements directly in the toml to avoid having to go through this other file? Seems like it should be. Like to do:

[dockerfile-parser]
install_from_resolve = "dockerfile_resolve"
requirements = ["dockerfile==3.2.0"]

yeah, I was just using the same structure we have for other tools, forgot a step haha