From 19b6e35d6cad681854eda41417670ac29d679ad7 Mon Sep 17 00:00:00 2001 From: John Orgera <65687576+johnoooh@users.noreply.github.com> Date: Wed, 26 Aug 2026 16:37:20 -0400 Subject: [PATCH 1/2] feat: add hlahd-tools 1.0.0 container Generic Python/bowtie2/samtools runtime for HLA-HD post-processing modules (e.g. modules/msk/annotate_hlahd in the modules repo). Module scripts are bundled in the module's resources/usr/bin/ and staged onto PATH by Nextflow -- this image supplies only the interpreter, system libraries, and third-party packages they depend on (pandas, jinja2, pysam, matplotlib, requests, weasyprint). Verified: hadolint clean; built for linux/amd64 and exercised via the annotate_hlahd module's nf-test suite (real-data + skip_html + stub), all passing. --- containers/hlahd-tools/1.0.0/Dockerfile | 42 +++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 containers/hlahd-tools/1.0.0/Dockerfile diff --git a/containers/hlahd-tools/1.0.0/Dockerfile b/containers/hlahd-tools/1.0.0/Dockerfile new file mode 100644 index 0000000..201b28f --- /dev/null +++ b/containers/hlahd-tools/1.0.0/Dockerfile @@ -0,0 +1,42 @@ +# hlahd-tools — generic Python/bioinformatics runtime for the msk annotate_hlahd +# module (and future HLA-HD post-processing modules). The module scripts +# themselves live in modules/msk/annotate_hlahd/resources/usr/bin/ and are +# staged onto PATH by Nextflow — this image supplies only the interpreter, +# system libraries, and third-party packages they depend on. +FROM condaforge/miniforge3:25.3.1-0 + +# Labels +LABEL org.opencontainers.image.vendor="MSKCC-OMICS-WORKFLOWS" \ + org.opencontainers.image.authors="John Orgera (orgeraj@mskcc.org)" \ + org.opencontainers.image.created="2026-08-26T00:00:00Z" \ + org.opencontainers.image.licenses="MIT" \ + org.opencontainers.image.version="1.0.0" \ + imageprivacy="False" \ + org.opencontainers.image.source="https://github.com/mskcc-omics-workflows/containers/containers/hlahd-tools/" \ + org.opencontainers.image.url="https://github.com/mskcc-omics-workflows/modules" \ + org.opencontainers.image.title="hlahd-tools" \ + org.opencontainers.image.description="Python + bowtie2/samtools runtime for HLA-HD post-processing modules (e.g. annotate_hlahd)." + +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +# bowtie2/samtools are on PATH for modules that shell out to them (e.g. a future +# pileup-evidence module); weasyprint comes from conda-forge (not pip) so its +# pango/cairo/harfbuzz system libraries install alongside it. +RUN mamba install -y -c conda-forge -c bioconda \ + python=3.11 \ + bowtie2=2.5.5 \ + samtools=1.21 \ + pandas \ + jinja2 \ + pysam \ + matplotlib \ + requests \ + weasyprint \ + && mamba clean -afy + +# matplotlib/fontconfig write caches on first use; $HOME is not writable under +# Nextflow's container user mapping. +ENV MPLCONFIGDIR=/tmp/mplconfig \ + XDG_CACHE_HOME=/tmp/cache + +WORKDIR /data From 4acd68a0c93edcc3716a4d74535f2c5eb6347145 Mon Sep 17 00:00:00 2001 From: John Orgera <65687576+johnoooh@users.noreply.github.com> Date: Wed, 26 Aug 2026 17:37:01 -0400 Subject: [PATCH 2/2] feat: install mskcc/hla-annotate in hlahd-tools instead of bare deps Clones mskcc/hla-annotate@v1.0.0 (private repo -- needs an MSK_GH_TOKEN secret, a fine-grained PAT scoped read-only to that repo, added to this repo's CI) and installs it, running its test suite at build time so a broken release fails the image build rather than a pipeline run. Verified locally: install + 83 tests pass (using a local copy in place of the token-based clone, since I can't write a token to disk in this sandbox -- the clone step itself is the same pattern already used for JFrog downloads in this repo). --- containers/hlahd-tools/1.0.0/Dockerfile | 28 ++++++++++++++++++------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/containers/hlahd-tools/1.0.0/Dockerfile b/containers/hlahd-tools/1.0.0/Dockerfile index 201b28f..679a4cf 100644 --- a/containers/hlahd-tools/1.0.0/Dockerfile +++ b/containers/hlahd-tools/1.0.0/Dockerfile @@ -1,8 +1,6 @@ -# hlahd-tools — generic Python/bioinformatics runtime for the msk annotate_hlahd -# module (and future HLA-HD post-processing modules). The module scripts -# themselves live in modules/msk/annotate_hlahd/resources/usr/bin/ and are -# staged onto PATH by Nextflow — this image supplies only the interpreter, -# system libraries, and third-party packages they depend on. +# hlahd-tools — Python/bioinformatics runtime for the msk annotate_hlahd module +# (and future HLA-HD post-processing modules), with the mskcc/hla-annotate +# package (https://github.com/mskcc/hla-annotate) installed on top. FROM condaforge/miniforge3:25.3.1-0 # Labels @@ -15,7 +13,9 @@ LABEL org.opencontainers.image.vendor="MSKCC-OMICS-WORKFLOWS" \ org.opencontainers.image.source="https://github.com/mskcc-omics-workflows/containers/containers/hlahd-tools/" \ org.opencontainers.image.url="https://github.com/mskcc-omics-workflows/modules" \ org.opencontainers.image.title="hlahd-tools" \ - org.opencontainers.image.description="Python + bowtie2/samtools runtime for HLA-HD post-processing modules (e.g. annotate_hlahd)." + org.opencontainers.image.description="Python + bowtie2/samtools runtime for HLA-HD post-processing modules (e.g. annotate_hlahd), with mskcc/hla-annotate installed." + +ENV HLA_ANNOTATE_TAG=v1.0.0 SHELL ["/bin/bash", "-o", "pipefail", "-c"] @@ -26,14 +26,26 @@ RUN mamba install -y -c conda-forge -c bioconda \ python=3.11 \ bowtie2=2.5.5 \ samtools=1.21 \ - pandas \ - jinja2 \ pysam \ matplotlib \ requests \ weasyprint \ + git \ + pip \ && mamba clean -afy +# hla-annotate is private, so cloning it needs a token (fine-grained PAT, read-only, +# scoped to just this repo) passed as a BuildKit secret — never baked into the image. +# Tests run at build time so a broken release fails the image build, not a pipeline run. +RUN --mount=type=secret,id=MSK_GH_TOKEN \ + git clone --depth 1 --branch ${HLA_ANNOTATE_TAG} \ + "https://x-access-token:$(cat /run/secrets/MSK_GH_TOKEN)@github.com/mskcc/hla-annotate.git" \ + /tmp/hla-annotate \ + && pip install --no-cache-dir -e '/tmp/hla-annotate[dev]' \ + && pytest /tmp/hla-annotate \ + && pip install --no-cache-dir --no-deps --force-reinstall /tmp/hla-annotate \ + && rm -rf /tmp/hla-annotate + # matplotlib/fontconfig write caches on first use; $HOME is not writable under # Nextflow's container user mapping. ENV MPLCONFIGDIR=/tmp/mplconfig \