Dockerfile: use pinned Python dependencies

Dockerfile

@@ -66,14 +66,15 @@ apt-get -y install \
   aria2
 
 # Install Python packages
-# NumPy is needed for OpenCV, gsutil for level1-csd, landsatlinks for level1-landsat (requires gdal/requests/tqdm)
-#==1.26.4  # test latest version
-#==1.14.1 # test latest version
-RUN pip3 install --break-system-packages --no-cache-dir \
-    numpy \
-    gsutil \
-    scipy \
-    git+https://github.com/ernstste/landsatlinks.git
+RUN --mount=type=bind,source=requirements.txt,target=requirements.txt \
+# Abort build with an error if GDAL versions do not match.
+[ "$(grep gdal requirements.txt | awk -F= '{print $3}')" = \
+    "$(gdal-config --version)" ] || \
+ (echo -n "\n\n" && \
+  echo "Image and requirements.txt use different GDAL versions." && \
+  echo -n "\n\n" && \
+  exit 1) && \
+pip3 install --break-system-packages --no-cache-dir -r requirements.txt
 
 # Install R packages.
 # Ccache size set from "ccache -s -v" after built from an empty cache.

pyproject.toml

@@ -0,0 +1,39 @@
+# Upgrade all dependencies in requirements.txt by:
+# docker run -v ./:/files --rm -it $(grep "FROM ghcr" Dockerfile | awk '{print $2}') bash
+# $ apt-get update
+# $ apt-get install -y --no-install-recommends python3-pip git
+# $ pip3 install uv --break-system-packages
+# $ cd /files
+# $ uv pip compile -U pyproject.toml -o requirements.txt --group force
+[project]
+name = "force-base-image-installation"
+version = "0.1.0"
+description = "Installation project for force-base-image-installation"
+requires-python = ">=3.12"
+dependencies = [
+  # Required by level1-csd.
+  "gsutil",
+  # Required by level1-landsat.
+  "landsatlinks @ git+https://github.com/ernstste/landsatlinks.git",
+  # Required by OpenCV.
+  "numpy",
+  "scipy",
+]
+
+# The force dependency group is an internal technicality that avoids
+# reinstalling Python packages we already have from Ubuntu packages.
+# When updating:
+#   GDAL version: update "gdal==<version>" below and run "uv pip compile" as
+#                 described at the top of this file.
+#   Ubuntu version: update the other package versions below and run
+#                   "uv pip compile" as described at the top of this file.
+[dependency-groups]
+force = [
+  # GDAL version must match the FROM line in Dockerfile.
+  "gdal==3.11.3",
+  # Some python3-packages from Ubuntu are installed, keep those versions.
+  "cryptography==41.0.7",
+  "numpy==1.26.4",
+  "pyparsing==3.1.1",
+  "six==1.16.0",
+]

requirements.txt

@@ -0,0 +1,144 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile pyproject.toml -o requirements.txt --group force
+aiohappyeyeballs==2.6.1
+    # via aiohttp
+aiohttp==3.13.3
+    # via google-auth
+aiosignal==1.4.0
+    # via aiohttp
+argcomplete==3.6.3
+    # via gsutil
+attrs==25.4.0
+    # via aiohttp
+boto==2.49.0
+    # via gcs-oauth2-boto-plugin
+cachetools==5.5.2
+    # via google-auth
+certifi==2026.1.4
+    # via requests
+cffi==2.0.0
+    # via cryptography
+charset-normalizer==3.4.4
+    # via requests
+crcmod==1.7
+    # via gsutil
+cryptography==41.0.7
+    # via
+    #   force-base-image-installation (pyproject.toml:force)
+    #   pyopenssl
+fasteners==0.20
+    # via
+    #   google-apitools
+    #   gsutil
+frozenlist==1.8.0
+    # via
+    #   aiohttp
+    #   aiosignal
+gcs-oauth2-boto-plugin==3.2
+    # via gsutil
+gdal==3.11.3
+    # via
+    #   force-base-image-installation (pyproject.toml:force)
+    #   landsatlinks
+google-apitools==0.5.35
+    # via gsutil
+google-auth==2.17.0
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   google-auth-httplib2
+    #   gsutil
+google-auth-httplib2==0.3.0
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   gsutil
+google-reauth==0.1.1
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   gsutil
+gsutil==5.34
+    # via force-base-image-installation (pyproject.toml)
+httplib2==0.20.4
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   google-apitools
+    #   google-auth-httplib2
+    #   gsutil
+    #   oauth2client
+idna==3.11
+    # via
+    #   requests
+    #   yarl
+landsatlinks @ git+https://github.com/ernstste/landsatlinks.git@ae253e52751caa78f2423542d8873c6b0f79e196
+    # via force-base-image-installation (pyproject.toml)
+monotonic==1.6
+    # via gsutil
+multidict==6.7.1
+    # via
+    #   aiohttp
+    #   yarl
+numpy==1.26.4
+    # via
+    #   force-base-image-installation (pyproject.toml)
+    #   force-base-image-installation (pyproject.toml:force)
+    #   scipy
+oauth2client==4.1.3
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   google-apitools
+propcache==0.4.1
+    # via
+    #   aiohttp
+    #   yarl
+pyasn1==0.6.2
+    # via
+    #   oauth2client
+    #   pyasn1-modules
+    #   rsa
+pyasn1-modules==0.4.2
+    # via
+    #   google-auth
+    #   oauth2client
+pycparser==3.0
+    # via cffi
+pyopenssl==24.2.1
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   gsutil
+pyparsing==3.1.1
+    # via
+    #   force-base-image-installation (pyproject.toml:force)
+    #   httplib2
+pyu2f==0.1.5
+    # via google-reauth
+requests==2.32.5
+    # via
+    #   google-auth
+    #   landsatlinks
+retry-decorator==1.1.1
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   gsutil
+rsa==4.7.2
+    # via
+    #   gcs-oauth2-boto-plugin
+    #   google-auth
+    #   oauth2client
+scipy==1.17.1
+    # via force-base-image-installation (pyproject.toml)
+six==1.16.0
+    # via
+    #   force-base-image-installation (pyproject.toml:force)
+    #   gcs-oauth2-boto-plugin
+    #   google-apitools
+    #   google-auth
+    #   gsutil
+    #   oauth2client
+    #   pyu2f
+tqdm==4.67.3
+    # via landsatlinks
+typing-extensions==4.15.0
+    # via aiosignal
+urllib3==2.6.3
+    # via requests
+yarl==1.22.0
+    # via aiohttp