[Triage] Docker build installs ForgeLM with the distro's old pip (jammy python3-pip 22.0.x, never upgraded) under a non-default python3.11, so neither PEP 660 editable install at Dockerfil… (CR-A16-114) #825

Needs triage. Reviewers disagreed on this finding, so it is not counted in the backlog. Decide whether it is a real defect: if yes, set severity and wave; if not, close it with the reason.

CR-A16-114 — Docker build installs ForgeLM with the distro's old pip (jammy python3-pip 22.0.x, never upgraded) under a non-default python3.11, so neither PEP 660 editable install at Dockerfile:52 nor the final i…

severity Medium · confidence disputed · single reviewer · not reproduced (code trace)

What happens. This extends M-A16-035 (the image is never built) with a specific build-time risk. Dockerfile:33-39 installs python3.11, python3.11-venv and the jammy python3-pip, then points /usr/bin/python3 at 3.11. Every later install (Dockerfile:52, 54, 60, 66, 97) runs python3 -m pip, which is jammy's Debian-patched pip 22.0.x from /usr/lib/python3/dist-packages. That pip was packaged for the default python3.10. Nothing upgrades it, and nothing creates a venv, although python3.11-venv is installed. PIP_DISABLE_PIP_VERSION_CHECK=1 (Dockerfile:31) also hides the version warning. On the backend side, the build works. In an offline run, setuptools 84.0.0 (which satisfies the setuptools>=83.0.0 floor at pyproject.toml:14) builds the PEP 660 editable wheel from the 3-file context at Dockerfile:47-48. It needs no import because the version is static at pyproject.toml:19, and LICENSE is not needed. It also builds a full wheel from the .dockerignore-filtered context with all package data. Both emit Metadata-Version 2.4 with only deprecation warnings. On the frontend side, two documented-in-the-wild failure modes of Ubuntu 22.04's pip 22.0.x could not be checked offline: (a) under python3.11, pip's locations code may import distutils.cmd, and jammy may not ship that for 3.11; (b) pip 22.0's build isolation strips only get_purelib()/get_platlib() from sys.path. Modern pip strips site.getsitepackages() instead (pip 26.2.1 build_env/virtual.py:23-26,56-90). Debian's /usr/lib/python3/dist-packages, which holds setuptools 59.6.0, would therefore stay ahead of the isolated setuptools>=83. setuptools 59.6 has no build_editable hook and no PEP 621 support, so Dockerfile:52 would fail ('build backend is missing the build_editable hook'), or Dockerfile:97 would install a distribution c…

Failure scenario. An operator runs docker build -t forgelm . on any host. The RUN at Dockerfile:52 runs jammy pip 22.0.x under python3.11. If that pip imports distutils (hypothesis a) or lets setuptools 59.6 from /usr/lib/python3/dist-packages shadow the isolated setuptools>=83 (hypothesis b), the editable install aborts and the image cannot be built. Alternatively, Dockerfile:97 installs a metadata-less UNKNOWN distribution, and the forgelm console script is missing at Dockerfile:110. If neither holds, the build passes; offline analysis cannot tell which.

Where.

• Dockerfile:66
• Dockerfile:33-39
• Dockerfile:47-48
• Dockerfile:52-55
• Dockerfile:110
• pyproject.toml:14-15
• README.md:182-185

Evidence.

• Dockerfile:36 installs python3-pip (distro pip). No pip install --upgrade pip, no ensurepip and no venv anywhere in Dockerfile:1-113. Offline setuptools 84.0.0 builds succeed. Log: (local review artefact) (sha256 564ab9a30ce780387e0a09c3a79f55a2c23331fb5776ee08b2fc55760c1477eb). The editable wheel forgelm-0.11.1rc1-0.editable-py3-none-any.whl contains only __editable__.forgelm-0.11.1rc1.pth (adds the project root) plus the dist-info. The full wheel contains py.typed, safety_prompts/defa…

Recommended fix. Do not depend on the distro pip. In the base stage, create a venv (python3.11 -m venv /opt/venv && /opt/venv/bin/python -m pip install --upgrade 'pip>=23') and put /opt/venv/bin on PATH. This also removes the need for update-alternatives. At minimum, run python3.11 -m pip install --upgrade pip before Dockerfile:52. Add a docker build job to CI (M-A16-035) so this is settled empirically.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}