Switch Lambda functions from ZIP to Docker image deployment (#7730)

.mypy.ini

@@ -21,7 +21,6 @@ modules =
     azul.health,
     azul.hmac,
     azul.http,
-    azul.infra.lambda_layer,
     azul.lambdas,
     azul.modules,
     azul.oauth2,

Makefile

@@ -69,24 +69,10 @@ requirements_update: check_venv check_docker
 #	been updated. Not using sed because Darwin's sed does not do -i.
 	git restore requirements.trans.txt requirements.dev.trans.txt
 	perl -i -p -e 's/^(?!#)/#/' requirements.trans.txt requirements.dev.trans.txt
-#	Since we're building for the x86_64 Lambda runtime, we should do so on an
-#	image for that architecture, hence the default platform override below. The
-#	override slows down this make target considerably on ARM hosts like Apple
-#	Silicon Macs. And for some reason, pip's --platform=…_x86_64 appears to do
-#	the right thing even on an ARM image, without the override, but I'd rather
-#	not play with fire at this time without a deeper understanding as to why.
 	DOCKER_DEFAULT_PLATFORM=linux/amd64 $(MAKE) docker_deps docker_dev_deps
 	python scripts/manage_requirements.py \
 	       --image=$(azul_image)/deps:$(azul_image_tag) \
 	       --build-image=$(azul_image)/dev-deps:$(azul_image_tag)
-#	Download wheels (source and binary) for the Lambda runtime
-	rm ${azul_chalice_bin}/*
-	pip download \
-	    --platform=manylinux2014_x86_64 \
-	    --only-binary=:all: \
-	    --no-deps \
-	    -r requirements.txt \
-	    --dest=${azul_chalice_bin}
 
 environment.boot: check_python
 	python scripts/generate_environment_boot.py
@@ -205,7 +191,7 @@ clean: check_env
 absolute_sources = $(shell echo $(project_root)/src \
                                 $(project_root)/scripts \
                                 $(project_root)/test \
-                                $(project_root)/lambdas/{layer,indexer,service}/app.py \
+                                $(project_root)/lambdas/{indexer,service}/app.py \
                                 $(project_root)/.flake8/azul_flake8.py \
                                 $(project_root)/environment.py \
                                 $(project_root)/deployments/*/environment.py \

attic/terraform/lambda_layer.tf.json.template.py

@@ -0,0 +1,5 @@
+from azul.infra.terraform import (
+    emit_tf,
+)
+
+emit_tf(None)

environment.py

@@ -202,6 +202,21 @@ def env() -> Mapping[str, str | None]:
         'azul_docker_registry': '{AZUL_AWS_ACCOUNT_ID}.dkr.ecr.'
                                 '{AWS_DEFAULT_REGION}.amazonaws.com/',
 
+        # The platforms to build Lambda container images for, as a list of
+        # Docker platform specifications separated by space. The first platform
+        # in the list also determines the architecture of the deployed Lambda
+        # function. Images will be built for the other platforms listed, but
+        # those images will not be used by the deployment. A multi-platform
+        # image list consisting of the specified platform-specific images will
+        # also be pushed.
+        #
+        # On machines that support cross-platform image builds, this variable
+        # can be overridden locally to build images for additional platforms. On
+        # machines that don't support building the default platform, a different
+        # one can be specified, e.g., 'linux/arm64'.
+        #
+        'azul_lambda_image_platforms': 'linux/amd64',
+
         # The version of Docker used throughout the system.
         #
         # This variable is not intended to be overridden per deployment or
@@ -702,7 +717,12 @@ def env() -> Mapping[str, str | None]:
         # from that directory. The wheels must be compatible with the AWS
         # Lambda platform.
         #
-        'azul_chalice_bin': '{project_root}/bin/wheels/runtime',
+        # No longer actively used. Lambda runtime dependencies are now
+        # installed via pip inside the Docker image build. Our fork of
+        # Chalice still references this variable but handles it being
+        # unset.
+        #
+        'azul_chalice_bin': None,
 
         # Stop `pip` from nagging us about updates. We update pip regularly like
         # any other dependency. There is nothing special about `pip` that would
@@ -986,15 +1006,6 @@ def env() -> Mapping[str, str | None]:
         #
         'AZUL_ENABLE_BUNDLE_NOTIFICATIONS': '0',
 
-        # A Lambda runtime version to pin to, which overrides the AWS-managed
-        # default. Pin the runtime to python:3.14.v35 to prevent OutOfMemory
-        # errors in the mirror Lambda function.
-        #
-        # FIXME: Remove pinned Lambda runtime version ARN
-        #        https://github.com/DataBiosphere/azul/issues/7730
-        #
-        'azul_lambda_runtime_version': '6e4c2a8804e47c3599d89c0a896af2312961578a5546d2d9a288c0d93e6b1a2d',
-
         # URL of Terra's external credentials manager (ECM) service used by the
         # Azul deployment.
         #

lambdas/Dockerfile

@@ -0,0 +1,21 @@
+ARG azul_docker_registry
+ARG azul_python_image
+FROM ${azul_docker_registry}${azul_python_image}
+
+ARG APP
+
+RUN pip install --no-cache-dir awslambdaric
+
+COPY requirements.txt requirements.trans.txt /tmp/
+RUN pip install --no-cache-dir --no-deps -r /tmp/requirements.txt \
+    && rm /tmp/requirements.txt /tmp/requirements.trans.txt
+
+COPY lambdas/${APP}/.chalice/terraform/deployment.zip /tmp/
+RUN python -m zipfile -e /tmp/deployment.zip /var/task \
+    && rm /tmp/deployment.zip \
+    && find /var/task -name __pycache__ -exec rm -rf {} + \
+    && python -m compileall -q /var/task
+
+WORKDIR /var/task
+
+ENTRYPOINT ["/usr/local/bin/python", "-m", "awslambdaric"]

lambdas/Dockerfile.dockerignore

@@ -0,0 +1,5 @@
+*
+!requirements.txt
+!requirements.trans.txt
+!lambdas/indexer/.chalice/terraform/deployment.zip
+!lambdas/service/.chalice/terraform/deployment.zip

lambdas/Makefile

@@ -1,23 +1,19 @@
 .PHONY: all
-all: layer indexer service
+all: indexer service
 
 include ../common.mk
 
-.PHONY: layer
-layer: check_env
-	$(MAKE) -C layer layer
-
 .PHONY: indexer
 indexer: check_env
-	$(MAKE) -C indexer package
+	$(MAKE) -C indexer docker_push
 
 .PHONY: service
 service: check_env
-	$(MAKE) -C service package
+	$(MAKE) -C service docker_push
 
 .PHONY: clean
 clean: check_env
-	for d in indexer service layer; do $(MAKE) -C $$d clean || ! break; done
+	for d in indexer service; do $(MAKE) -C $$d clean || ! break; done
 
 .PHONY: openapi
 openapi: check_env

lambdas/indexer/Makefile

@@ -2,3 +2,5 @@
 all: package
 
 include ../lambdas.mk
+
+$(eval $(call docker_image_macro,indexer))

lambdas/lambdas.mk

@@ -61,3 +61,37 @@ package: check_branch check_python check_aws config environ sources compile
 .PHONY: openapi
 openapi: check_python
 	python $(project_root)/scripts/generate_openapi_document.py
+
+
+docker_repo = $(azul_docker_registry)$(AZUL_DOMAIN_NAME)/azul/lambda
+
+define docker_image_macro
+docker_tag := $$(docker_repo):$$(AZUL_DEPLOYMENT_STAGE)-$1
+
+.PHONY: docker_image
+docker_image: check_docker package
+	set -e; \
+	for platform in $$(azul_lambda_image_platforms); do \
+		docker buildx build \
+			--platform $$$$platform \
+			--build-arg azul_docker_registry=$$(azul_docker_registry) \
+			--build-arg azul_python_image=$$(azul_python_image) \
+			--build-arg APP=$1 \
+			-f $$(project_root)/lambdas/Dockerfile \
+			--tag $$(docker_tag)-$$$${platform//\//-} \
+			--load \
+			$$(project_root); \
+	done
+
+.PHONY: docker_push
+docker_push: docker_image
+	set -e; \
+	tags=""; \
+	for platform in $$(azul_lambda_image_platforms); do \
+		tag=$$(docker_tag)-$$$${platform//\//-}; \
+		docker push $$$$tag; \
+		tags="$$$$tags $$$$tag"; \
+	done; \
+	docker manifest create --amend $$(docker_tag) $$$$tags; \
+	docker manifest push --purge $$(docker_tag)
+endef

lambdas/service/Makefile

@@ -7,3 +7,5 @@ include ../lambdas.mk
 apat_public_key: vendor/resources/apat_public_key.json
 
 package: apat_public_key
+
+$(eval $(call docker_image_macro,service))

requirements.all.txt

@@ -10,9 +10,9 @@ botocore-stubs==1.43.67
 certifi==2026.7.22
 cffi==2.1.1
 chalice==1.32.0+21
-charset-normalizer==3.5.0
+charset-normalizer==3.5.1
 chevron==0.14.0
-click==8.4.2
+click==8.5.0
 coverage==7.15.3
 cryptography==50.0.0
 docker==7.2.0
@@ -28,22 +28,22 @@ gitpython==3.1.57
 google-api-core==2.33.0
 google-api-python-client==2.198.0
 google-auth==2.56.2
-google-auth-httplib2==0.4.1
+google-auth-httplib2==0.4.2
 google-cloud-bigquery==3.42.3
 google-cloud-bigquery-reservation==1.25.0
-google-cloud-core==2.6.1
+google-cloud-core==2.7.0
 google-cloud-storage==3.13.0
 google-crc32c==1.8.0
-google-resumable-media==2.10.1
-googleapis-common-protos==1.75.1
+google-resumable-media==2.10.2
+googleapis-common-protos==1.75.2
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpcio==1.83.0
 grpcio-status==1.83.0
 http-message-signatures==2.0.1
 http_sfv==0.9.9
 httplib2==0.32.0
-idna==3.18
+idna==3.19
 inquirer==3.4.1
 isort==8.0.1
 jinxed==2.1.0
@@ -62,13 +62,13 @@ msgpack==1.2.1
 msgpack-types==0.8.0
 mypy==2.3.0
 mypy-boto3-apigateway==1.43.0
-mypy-boto3-cloudwatch==1.43.54
+mypy-boto3-cloudwatch==1.43.78
 mypy-boto3-dynamodb==1.43.64
-mypy-boto3-ec2==1.43.67
-mypy-boto3-ecr==1.43.0
+mypy-boto3-ec2==1.43.81
+mypy-boto3-ecr==1.43.73
 mypy-boto3-iam==1.43.70
 mypy-boto3-kms==1.43.12
-mypy-boto3-lambda==1.43.60
+mypy-boto3-lambda==1.43.76
 mypy-boto3-opensearch==1.43.41
 mypy-boto3-s3==1.43.66
 mypy-boto3-secretsmanager==1.43.0
@@ -89,8 +89,8 @@ pathable==0.6.0
 pathspec==1.1.1
 pip==26.1.2
 posix_ipc==1.3.2
-proto-plus==1.28.3
-protobuf==7.35.1
+proto-plus==1.28.4
+protobuf==7.36.0
 py-partiql-parser==0.6.3
 pyasn1==0.6.4
 pyasn1_modules==0.4.2
@@ -105,7 +105,7 @@ pyjwt==2.13.0
 pynacl==1.6.2
 pyparsing==3.3.2
 python-dateutil==2.9.0.post0
-python-dotenv==1.2.2
+python-dotenv==1.2.3
 python-dxf==12.1.1
 python-gitlab==8.5.0
 pyyaml==6.0.3
@@ -140,4 +140,4 @@ www-authenticate==0.9.2
 xmltodict==1.0.4
 xmod==1.10.0
 zope.event==6.2
-zope.interface==8.5
+zope.interface==8.6

requirements.dev.trans.txt

@@ -2,11 +2,11 @@ annotated-types==0.8.0
 ast_serialize==0.8.0
 blessed==1.48.0
 botocore-stubs==1.43.67
-click==8.4.2
+click==8.5.0
 editor==1.8.0
 et_xmlfile==2.0.0
 gitdb==4.0.12
-google-auth-httplib2==0.4.1
+google-auth-httplib2==0.4.2
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 httplib2==0.32.0
@@ -17,13 +17,13 @@ lazy-object-proxy==1.12.0
 librt==0.15.0
 mccabe==0.7.0
 mypy-boto3-apigateway==1.43.0
-mypy-boto3-cloudwatch==1.43.54
+mypy-boto3-cloudwatch==1.43.78
 mypy-boto3-dynamodb==1.43.64
-mypy-boto3-ec2==1.43.67
-mypy-boto3-ecr==1.43.0
+mypy-boto3-ec2==1.43.81
+mypy-boto3-ecr==1.43.73
 mypy-boto3-iam==1.43.70
 mypy-boto3-kms==1.43.12
-mypy-boto3-lambda==1.43.60
+mypy-boto3-lambda==1.43.76
 mypy-boto3-opensearch==1.43.41
 mypy-boto3-s3==1.43.66
 mypy-boto3-secretsmanager==1.43.0
@@ -45,7 +45,7 @@ pydantic_core==2.46.4
 pyflakes==3.4.0
 pynacl==1.6.2
 pyparsing==3.3.2
-python-dotenv==1.2.2
+python-dotenv==1.2.3
 readchar==4.2.2
 requests-toolbelt==1.0.0
 rfc3339-validator==0.1.4
@@ -60,4 +60,4 @@ www-authenticate==0.9.2
 xmltodict==1.0.4
 xmod==1.10.0
 zope.event==6.2
-zope.interface==8.5
+zope.interface==8.6

requirements.trans.txt

@@ -1,20 +1,20 @@
 certifi==2026.7.22
 cffi==2.1.1
-charset-normalizer==3.5.0
+charset-normalizer==3.5.1
 events==0.5
-google-cloud-core==2.6.1
+google-cloud-core==2.7.0
 google-crc32c==1.8.0
-google-resumable-media==2.10.1
-googleapis-common-protos==1.75.1
+google-resumable-media==2.10.2
+googleapis-common-protos==1.75.2
 grpcio==1.83.0
 grpcio-status==1.83.0
-idna==3.18
+idna==3.19
 jsonschema-specifications==2025.9.1
 markupsafe==3.0.3
 orderedmultidict==1.0.2
 packaging==26.3
-proto-plus==1.28.3
-protobuf==7.35.1
+proto-plus==1.28.4
+protobuf==7.36.0
 pyasn1==0.6.4
 pyasn1_modules==0.4.2
 pycparser==3.0

scripts/manage_images.py

@@ -132,15 +132,11 @@ def copy_multi_platform_image(src: TagImageRef,
 def make_platform_tag(tag, platform: Platform):
     assert not is_platform_tag(tag), R(
         'Input already looks like a platform tag', tag)
-    return tag + platform_tag_suffix(platform)
+    return tag + platform.tag_suffix
 
 
 def is_platform_tag(tag):
-    return any(tag.endswith(platform_tag_suffix(p)) for p in platforms)
-
-
-def platform_tag_suffix(platform):
-    return '-' + str(platform).replace('/', '-')
+    return any(tag.endswith(p.tag_suffix) for p in platforms)
 
 
 def delete_unused_images(repository):