Switch Lambda functions from ZIP to Docker image deployment (#7730) by hannes-ucsc · Pull Request #8244 · DataBiosphere/azul

hannes-ucsc · 2026-08-20T01:13:31Z

Supersedes #8137

Linked issues: #7730

Checklist

Author

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all linked issues}
This PR partially resolves each of the linked issues _{or does not have the partial label}

Author (reindex)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}

Author (mirror)

This PR is labeled mirror:dev _{or the changes introduced by it will not require mirroring of dev}
This PR is labeled mirror:anvildev _{or the changes introduced by it will not require mirroring of anvildev}
This PR is labeled mirror:anvilprod _{or the changes introduced by it will not require mirroring of anvilprod}
This PR is labeled mirror:prod _{or the changes introduced by it will not require mirroring of prod}
This PR is labeled mirror:partial and its description documents the specific mirroring procedure for dev, anvildev, anvilprod and prod _{or requires a full mirroring or carries none of the labels mirror:dev, mirror:anvildev, mirror:anvilprod and mirror:prod}

Author (API changes)

This PR and its linked issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any linked issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues linked to this PR}

Author (before every review)

Rebased PR branch on develop, squashed fixups from prior reviews
Ran make requirements_update _{or this PR does not modify Dockerfile, environment, requirements*.txt, common.mk, Makefile or environment.boot}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}
PR is awaiting requested review from a peer
Status of PR is Review requested
PR is assigned to only the peer and the author

Peer reviewer (after approval)

Note that after requesting changes, the PR must be assigned to only the author.

Actually approved the PR
PR is not a draft
PR is awaiting requested review from system administrator
Status of PR is Review requested
PR is assigned to only the system administrator and the author

System administrator (after approval)

Actually approved the PR
Labeled linked issues as demo or no demo
Commented on linked issues about demo expectations _{or all linked issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Status of PR is Approved
PR is assigned to only the operator and the author

Operator

Checked reindex:… labels and r commit title tag
Checked mirror:… labels
Checked that demo expectations are clear _{or all linked issues are labeled no demo}
Squashed PR branch and rebased onto develop
Sanity-checked history
Pushed PR branch to GitHub

Operator (deploy `.shared` and `.gitlab` components)

Ran _select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Ran _select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Checked the items in the next section _{or this PR is labeled deploy:gitlab}
PR is assigned to only the system administrator and the author _{or this PR is not labeled deploy:gitlab}

System administrator (post-deploy of `.gitlab` component)

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator and the author

Operator (deploy runner image)

Ran _select dev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}
Ran _select anvildev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}

Operator (sandbox build)

Operator (merge the branch)

All status checks passed and the PR is mergeable
The title of the merge commit starts with the title of this PR
Added PR # reference to merge commit title
Collected commit title tags in merge commit title _{but only included p if the PR is also labeled partial}
Pushed merge commit to GitHub
Status of PR is Merged lower
Status of blocked issues is Triage _{or no issues are blocked on the linked issues}

Operator (main build)

Operator (reindex)

Operator (mirroring)

Started mirroring in dev _{or this PR is not labelled mirror:dev}
Started mirroring in anvildev _{or this PR is not labelled mirror:anvildev}
Checked for, triaged and possibly requeued messages in mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Checked for, triaged and possibly requeued messages in mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}
Emptied mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Emptied mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}

Operator

Propagated the upgrade and API labels to the next promotion PRs _{or this PR carries neither of these labels}
Propagated the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2026-08-20T01:26:25Z

Codecov Report

❌ Patch coverage is 26.08696% with 34 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.69%. Comparing base (ea8ab9e) to head (be48a12).

Files with missing lines	Patch %	Lines
src/azul/docker.py	24.13%	22 Missing ⚠️
src/azul/infra/terraform.py	11.11%	8 Missing ⚠️
src/azul/logging.py	40.00%	3 Missing ⚠️
src/azul/__init__.py	66.66%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #8244      +/-   ##
===========================================
+ Coverage    84.43%   84.69%   +0.25%     
===========================================
  Files          169      168       -1     
  Lines        24925    24856      -69     
===========================================
+ Hits         21046    21052       +6     
+ Misses        3879     3804      -75

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coveralls · 2026-08-20T01:27:08Z

coverage: 84.773% (+0.3%) from 84.516% — issues/hannes-ucsc/7730-docker-lambda into develop

hannes-ucsc · 2026-08-20T22:16:28Z

I opted for a more descriptive title to better reflect what this actually does. Whether this actually fixes the OOM remains to be seen but we'll be in a much better position to upgrade Python to a version in which the underlying leak is fixed.

hannes-ucsc · 2026-08-27T02:42:01Z

) Add a dedicated ECR repository for Lambda images in the shared TF component, and a Dockerfile that builds Lambda container images from the mirrored Python slim image with awslambdaric installed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

) Add a lambda_image macro to lambdas.mk that builds platform-specific images (arm64 + amd64) via docker buildx, pushes them to ECR, and creates a manifest list. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add `azul_lambda_image_platforms` environment variable to control which platforms are built, defaulting to amd64 first (determining Lambda architecture) with arm64 second. Make targets now iterate dynamically over this variable. Add `lambda_image_platforms` and `lambda_architecture` config properties with Docker-to-Lambda arch mapping for use in Terraform. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Patch Chalice-generated TF config to use `package_type = "Image"` with `image_uri` and `architectures` instead of ZIP-based `filename`, `source_code_hash`, `runtime`, and `handler` - Remove Lambda layer assignment and runtime management config (both are baked into the Docker image now) - Add `replace_triggered_by` lifecycle rule on Lambda aliases to handle the ZIP-to-Image transition - Move image URI generation and architecture mapping from `azul.config` to `azul.docker` (as module-level functions) - Add `Platform.tag_suffix` property and inline `platform_tag_suffix()` in `manage_images.py` Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove create_before_destroy from Lambda permissions. It was added when aliases were introduced, ostensibly to ensure old permissions aren't deleted before new ones are created during alias replacement. But aliases are updated in place (only function_version changes), never replaced, so the permissions are never replaced either and CBD never triggers. Worse, during the Zip-to-Image migration, the function replacement cascades into the permission (whose function_name references the function ARN), and CBD on the permission propagates back to the function, causing a 409 "already exists" error. Remove replace_triggered_by from aliases and suppress the Lambda layer resource, neither of which is needed for image-based Lambda functions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

No longer needed now that Lambda functions use Docker images instead of the AWS-managed Python runtime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When a Lambda function is replaced (e.g., Zip to Image migration), AWS cascade-deletes the function's aliases. Terraform doesn't know about the cascade and tries to update the now-gone alias, resulting in a 404. Add replace_triggered_by on the alias referencing the function's package_type so the alias is also replaced when the function is replaced. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The .pyc files from chalice package have vendor/ relative paths as co_filename, causing truncated tracebacks in the container. Strip them and recompile in the image so tracebacks resolve to /var/task/ sources. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

awslambdaric's StandardLogSink delimits CloudWatch log events by newline. Multi-line log records (e.g., with tracebacks from exc_info) were split into separate CloudWatch events. A custom formatter now replaces newlines with carriage returns within each record, appending a single newline at the end as the event delimiter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

With Docker image deployment, runtime dependencies are installed directly in the image via pip. The Lambda layer that previously provided shared dependencies to ZIP-based functions is no longer needed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Lambda dependencies are now installed via pip inside the Docker image build, so the checked-in wheels and the azul_chalice_bin machinery are no longer needed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The GitLab executor image configures per-registry credential helpers via credHelpers rather than the global credsStore. Handle that case when resolving Lambda image digests during Terraform template rendering. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hannes-ucsc self-assigned this Aug 20, 2026

hannes-ucsc added deploy:gitlab [process] PR requires deploying `gitlab` component deploy:shared [process] PR requires deploying `shared` component labels Aug 20, 2026

hannes-ucsc mentioned this pull request Aug 20, 2026

Fix: OutOfMemory error in mirror Lambda function (#7730) #8137

Closed

hannes-ucsc force-pushed the issues/hannes-ucsc/7730-docker-lambda branch from 9586689 to b586401 Compare August 20, 2026 19:27

hannes-ucsc changed the title ~~OutOfMemory error in mirror Lambda function (#7730)~~ Switch Lambda functions from ZIP to Docker image deployment (#7730) Aug 20, 2026

hannes-ucsc linked an issue Aug 20, 2026 that may be closed by this pull request

OutOfMemory error in mirror Lambda function #7730

Open

hannes-ucsc added the reqs [process] PR includes commit requiring ``make requirements`` label Aug 21, 2026

hannes-ucsc force-pushed the issues/hannes-ucsc/7730-docker-lambda branch 4 times, most recently from c708c7d to c17306d Compare August 27, 2026 02:24

hannes-ucsc added the sandbox [process] Resolution is being verified in sandbox deployment label Aug 27, 2026

hannes-ucsc force-pushed the issues/hannes-ucsc/7730-docker-lambda branch 2 times, most recently from 10a8bc2 to cb7ceff Compare August 27, 2026 15:22

hannes-ucsc and others added 11 commits August 27, 2026 11:22

[R] Remove Lambda runtime version pinning (#7730)

8a51253

No longer needed now that Lambda functions use Docker images instead of the AWS-managed Python runtime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Grant GitLab CI permission to push Lambda images to ECR (#7730)

5f6a74e

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hannes-ucsc and others added 3 commits August 27, 2026 11:22

[R] Remove pre-downloaded runtime wheels (#7730)

7ff0394

Lambda dependencies are now installed via pip inside the Docker image build, so the checked-in wheels and the azul_chalice_bin machinery are no longer needed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

[R] Ran make requirements_update

be48a12

hannes-ucsc force-pushed the issues/hannes-ucsc/7730-docker-lambda branch from cb7ceff to be48a12 Compare August 27, 2026 19:04

hannes-ucsc merged commit 2adefba into develop Aug 28, 2026
10 checks passed

hannes-ucsc deleted the issues/hannes-ucsc/7730-docker-lambda branch August 28, 2026 15:30

Navigation Menu

Uh oh!

Switch Lambda functions from ZIP to Docker image deployment (#7730) - #8244

Switch Lambda functions from ZIP to Docker image deployment (#7730)#8244
hannes-ucsc merged 14 commits into
developfrom
issues/hannes-ucsc/7730-docker-lambda

hannes-ucsc commented Aug 20, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 20, 2026 •

edited

Loading

Uh oh!

coveralls commented Aug 20, 2026 •

edited

Loading

Uh oh!

hannes-ucsc commented Aug 20, 2026

Uh oh!

hannes-ucsc commented Aug 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

hannes-ucsc commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Author

Author (partiality)

Author (reindex)

Author (mirror)

Author (API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator

Operator (deploy .shared and .gitlab components)

System administrator (post-deploy of .gitlab component)

Operator (deploy runner image)

Operator (sandbox build)

Operator (merge the branch)

Operator (main build)

Operator (reindex)

Operator (mirroring)

Operator

Shorthand for review comments

Uh oh!

codecov Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coveralls commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hannes-ucsc commented Aug 20, 2026

Uh oh!

hannes-ucsc commented Aug 27, 2026

Security design review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hannes-ucsc commented Aug 20, 2026 •

edited

Loading

Operator (deploy `.shared` and `.gitlab` components)

System administrator (post-deploy of `.gitlab` component)

codecov Bot commented Aug 20, 2026 •

edited

Loading

coveralls commented Aug 20, 2026 •

edited

Loading