feat: add Python pip & pipx to the base image (#121)

README.md

@@ -40,7 +40,7 @@ Choose your platform below. The scripts include both **Safe Mode** (asks for con
 All images support both **AMD64** (x86_64) and **ARM64** (Apple Silicon, etc.) architectures.
 
 All functions support switching between Docker image variants using flags:
-- **No flag** - Base image (Node.js, Git, basic tools)
+- **No flag** - Base image (Node.js, Python with pip & pipx, Git, basic tools)
 - **`--dotnet`** (`-d`) - .NET image (includes .NET 8, 9 & 10 SDKs)
 - **`--dotnet8`** (`-d8`) - .NET 8 image (includes .NET 8 SDK)
 - **`--dotnet9`** (`-d9`) - .NET 9 image (includes .NET 9 SDK)
@@ -669,7 +669,7 @@ This project provides multiple Docker image variants for different development s
 
 | Tag | Flag | Description |
 |-----|------|-------------|
-| `latest` | *(default)* | Base image with Node.js 20, Git, and essential tools |
+| `latest` | *(default)* | Base image with Node.js 20, Python (pip & pipx), Git, and essential tools |
 | `dotnet` | `--dotnet` | .NET 8, 9 & 10 SDKs |
 | `dotnet-8` | `--dotnet8` | .NET 8 SDK only |
 | `dotnet-9` | `--dotnet9` | .NET 9 SDK only |

docker/generated/Dockerfile.default

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-10

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-8

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-9

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-playwright

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.dotnet-rust

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.golang

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.java

@@ -10,19 +10,33 @@
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.playwright

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.

docker/generated/Dockerfile.rust

@@ -10,19 +10,33 @@ FROM node:20-slim
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install git, curl, gpg, gosu, nano, xdg-utils, zsh, and related utilities for the entrypoint script and testing.
+# Python tooling (pip + venv + pipx) ships here so every image can install pip-distributed
+# CLIs; Debian 12 enforces PEP 668, so `pipx install <tool>` is the supported path.
 RUN apt-get update && apt-get install -y \
   apt-transport-https \
   curl \
   git \
   gosu \
   gpg \
   nano \
+  pipx \
+  python3-pip \
+  python3-venv \
   software-properties-common \
   wget \
   xdg-utils \
   zsh \
   && rm -rf /var/lib/apt/lists/*
 
+# pipx installs apps into the runtime user's ~/.local/bin. The entrypoint always runs as
+# appuser with HOME=/home/appuser, so put that dir on PATH up front and pipx-installed CLIs
+# (e.g. `pipx install apm`) are reachable without a per-session `pipx ensurepath`.
+# ENV covers the exec'd command and non-login shells; the profile.d drop-in re-adds it for
+# login shells, which otherwise reset PATH via /etc/profile (Debian zsh sources it too).
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+RUN echo 'case ":${PATH}:" in *:/home/appuser/.local/bin:*) ;; *) PATH="/home/appuser/.local/bin:${PATH}" ;; esac' \
+  > /etc/profile.d/copilot-local-bin.sh
+
 # --- snippet: docker-cli ---
 # Install Docker CLI to support brokered Docker socket scenarios.
 # Only the CLI is installed; the daemon is the host's, mediated by copilot_here's broker.