Repository: astronomer/astro-provider-venv (language: python)

Issue:
Need support for astro runtime python versions 
Closing. Not an issue
Need support for astro runtime python versions 
Closing. Not an issue
Need support for astro runtime python versions 
Closing. Not an issue
Buildkit should update permissions on /home/astro/.cache after PYENV directive
After building with PYENV directive the /home/astro/.cache directory is owned by root with 755 permissions.  This causes permissions errors in tasks where python modules need to use the cache (i.e. for ML model caching).   
Dockerfile:
```
# syntax=quay.io/astronomer/airflow-extensions:latest
FROM quay.io/astronomer/astro-runtime:7.4.2-base
PYENV 3.9 dbt
```
```
% astro dev bash
Execing into the scheduler container

astro@292f4169dd21:/usr/local/airflow$ ls -la ~
total 40
drwxr-xr-x 1 astro astro 4096 Apr  6 17:50 .
drwxr-xr-x 1 root  root  4096 Mar 31 22:56 ..
-rw-r--r-- 1 astro astro  220 Mar 27  2022 .bash_logout
-rw-r--r-- 1 astro astro 3526 Mar 27  2022 .bashrc
drwxr-xr-x 3 root  root  4096 Apr  6 17:50 .cache
-rw-r--r-- 1 astro astro  807 Mar 27  2022 .profile
drwxr-xr-x 1 astro astro 4096 Apr  6 17:50 .venv
```

Two examples below of wandb package and snowflake package that need to write to ~/.cache directory.
```
astro@d57625a65032:~/.cache$ find ~/.cache/snowflake/
/home/astro/.cache/snowflake/
/home/astro/.cache/snowflake/ocsp_cache8j1e6ubn
/home/astro/.cache/snowflake/ocsp_cache5oj6_nny
/home/astro/.cache/snowflake/ocsp_response_validation_cache.lock
/home/astro/.cache/snowflake/ocsp_cache.lock
/home/astro/.cache/snowflake/ocsp_cache4oalvt2h
/home/astro/.cache/snowflake/ocsp_cache32xogmrb
/home/astro/.cache/snowflake/ocsp_response_cache.json
/home/astro/.cache/snowflake/ocsp_response_validation_cache
/home/astro/.cache/snowflake/ocsp_cache

astro@d57625a65032:~/.cache$ find ~/.cache/wandb/
/home/astro/.cache/wandb/
/home/astro/.cache/wandb/artifacts
/home/astro/.cache/wandb/artifacts/obj
/home/astro/.cache/wandb/artifacts/obj/md5
/home/astro/.cache/wandb/artifacts/obj/md5/d8
/home/astro/.cache/wandb/artifacts/obj/md5/d8/0a1445172ffb07a28629a32edfbb40
/home/astro/.cache/wandb/artifacts/obj/md5/86
/home/astro/.cache/wandb/artifacts/obj/md5/86/08691e36d311da97c534342e4a6b05
/home/astro/.cache/wandb/artifacts/obj/md5/cc
/home/astro/.cache/wandb/artifacts/obj/md5/cc/cc118c978a83585fa05fb850602c16
/home/astro/.cache/wandb/artifacts/obj/md5/ff
/home/astro/.cache/wandb/artifacts/obj/md5/ff/54d2f93db5b716b141433af0bc2940
/home/astro/.cache/wandb/artifacts/obj/md5/e8
/home/astro/.cache/wandb/artifacts/obj/md5/e8/09c855add0e34ddca8c08eab8ad615
/home/astro/.cache/wandb/artifacts/obj/md5/88
/home/astro/.cache/wandb/artifacts/obj/md5/88/005a74f6ac0faccaf8c819c9a114f7
```
fixes #13



Discussion / hints:




I can't find it in the Docker docs but I seem to remember that mounts always inherit the owner/perms of the underlying directory regardless of where and how it is mounted in the container.  This is for security reasons to ensure that users can't override OS permissions by mounting into a container.  Something like that.

Fix patch:
diff --git a/buildkit/internal/transform/transforms.go b/buildkit/internal/transform/transforms.go
index 68ce38c..1914965 100644
--- a/buildkit/internal/transform/transforms.go
+++ b/buildkit/internal/transform/transforms.go
@@ -26,11 +26,11 @@ RUN /sbin/ldconfig /usr/local/lib
 RUN ln -s /usr/local/include/python{{.PythonMajorMinor}} /usr/local/include/python{{.PythonMajorMinor}}m
 USER astro
 `
-	virtualEnvTemplate = `RUN mkdir -p /home/astro/.venv/{{.Name}}
-{{if .RequirementsFile}}COPY {{.RequirementsFile}} /home/astro/.venv/{{.Name}}/requirements.txt{{end}}
+	virtualEnvTemplate = `RUN mkdir -p /home/astro/.cache/pip /home/astro/.venv/{{.Name}}
+{{if .RequirementsFile}}COPY --chown={{.AstroUid}}:0 {{.RequirementsFile}} /home/astro/.venv/{{.Name}}/requirements.txt{{end}}
 RUN /usr/local/bin/python{{.PythonMajorMinor}} -m venv /home/astro/.venv/{{.Name}}
 ENV ASTRO_PYENV_{{.Name}} /home/astro/.venv/{{.Name}}/bin/python
-{{if .RequirementsFile}}RUN --mount=type=cache,target=/home/astro/.cache/pip /home/astro/.venv/{{.Name}}/bin/pip --cache-dir=/home/astro/.cache/pip install -r /home/astro/.venv/{{.Name}}/requirements.txt{{end}}
+{{if .RequirementsFile}}RUN --mount=type=cache,uid={{.AstroUid}},gid=0,target=/home/astro/.cache/pip /home/astro/.venv/{{.Name}}/bin/pip --cache-dir=/home/astro/.cache/pip install -r /home/astro/.venv/{{.Name}}/requirements.txt{{end}}
 `
 	fromCommand       = "FROM"
 	argCommand        = "ARG"
@@ -38,6 +38,8 @@ ENV ASTRO_PYENV_{{.Name}} /home/astro/.venv/{{.Name}}/bin/python
 	astroRuntimeImage = "quay.io/astronomer/astro-runtime"
 
 	defaultImageFlavour = "slim-bullseye"
+	// Sadly for the `RUN --mount,uid=$uid` we need to use a numeric ID.
+	defaultAstroUid = 50000
 )
 
 var (
@@ -229,9 +231,18 @@ func (r *Transformer) addVirtualEnvironment(venv *virtualEnv) (*parser.Node, err
 		return nil, err
 	}
 	buf := &bytes.Buffer{}
-	if err := tpl.Execute(buf, venv); err != nil {
+	params := struct {
+		*virtualEnv
+		AstroUid int
+	}{
+		venv,
+		defaultAstroUid,
+	}
+
+	if err := tpl.Execute(buf, params); err != nil {
 		return nil, err
 	}
+
 	parsedNodes, err := parser.Parse(buf)
 	if err != nil {
 		return nil, err


Test patch:
diff --git a/buildkit/internal/transform/transforms_test.go b/buildkit/internal/transform/transforms_test.go
index 699942f..25cbefa 100644
--- a/buildkit/internal/transform/transforms_test.go
+++ b/buildkit/internal/transform/transforms_test.go
@@ -31,11 +31,11 @@ RUN /sbin/ldconfig /usr/local/lib
 
 RUN ln -s /usr/local/include/python3.8 /usr/local/include/python3.8m
 USER astro
-RUN mkdir -p /home/astro/.venv/venv1
-COPY reqs/venv1.txt /home/astro/.venv/venv1/requirements.txt
+RUN mkdir -p /home/astro/.cache/pip /home/astro/.venv/venv1
+COPY --chown=50000:0 reqs/venv1.txt /home/astro/.venv/venv1/requirements.txt
 RUN /usr/local/bin/python3.8 -m venv /home/astro/.venv/venv1
 ENV ASTRO_PYENV_venv1 /home/astro/.venv/venv1/bin/python
-RUN --mount=type=cache,target=/home/astro/.cache/pip /home/astro/.venv/venv1/bin/pip --cache-dir=/home/astro/.cache/pip install -r /home/astro/.venv/venv1/requirements.txt
+RUN --mount=type=cache,uid=50000,gid=0,target=/home/astro/.cache/pip /home/astro/.venv/venv1/bin/pip --cache-dir=/home/astro/.cache/pip install -r /home/astro/.venv/venv1/requirements.txt
 COPY foo bar
 USER root
 COPY --link --from=python:3.10-slim-bullseye /usr/local/bin/*3.10* /usr/local/bin/
@@ -47,7 +47,7 @@ RUN /sbin/ldconfig /usr/local/lib
 
 RUN ln -s /usr/local/include/python3.10 /usr/local/include/python3.10m
 USER astro
-RUN mkdir -p /home/astro/.venv/venv2
+RUN mkdir -p /home/astro/.cache/pip /home/astro/.venv/venv2
 
 RUN /usr/local/bin/python3.10 -m venv /home/astro/.venv/venv2
 ENV ASTRO_PYENV_venv2 /home/astro/.venv/venv2/bin/python