python: ship nsjail so shimmy's --sandbox works

shimmy provides the --sandbox (nsjail) feature and its own runtime image
builds nsjail from source into /usr/sbin/nsjail. This base image copies
only the shimmy binary (`COPY --from=shimmy /shimmy`), not nsjail or its
shared libraries, so any evaluation function that sets SANDBOX_ENABLED=true
has shimmy fail at startup (os.Stat("/usr/sbin/nsjail") -> not found).

Add a nsjail-builder stage that builds nsjail 3.4 from source on the same
python:<ver>-slim-bookworm image used at runtime, so the glibc / libstdc++
/ libprotobuf ABIs match (a binary copied from shimmy's ubuntu:24.04 image
would link against a newer glibc than bookworm provides). Copy the binary
in and install its three runtime libs (libcap2, libnl-route-3-200,
libprotobuf32). A build-time `ldd` check fails the build if a lib is
missing.

nsjail is dormant unless a function opts into --sandbox, so behaviour is
unchanged for every existing image consumer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RYbUtnGroazAj1fNjXQmV7

Author: m-messer

python/Dockerfile

@@ -15,6 +15,21 @@ RUN apt-get update && apt-get install -y \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
+# Build nsjail from source, on the same Debian release as the runtime image so
+# the glibc / libstdc++ / libprotobuf ABIs match. shimmy ships the --sandbox
+# feature but not the nsjail binary, so without this SANDBOX_ENABLED=true makes
+# shimmy fail at startup (missing /usr/sbin/nsjail). Mirrors shimmy's own
+# nsjail-builder stage. Dormant unless a function opts into --sandbox.
+FROM python:${PYTHON_VERSION}-slim-${DEBIAN_VERSION} AS nsjail-builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        autoconf bison flex g++ gcc git libtool make pkg-config \
+        libcap-dev libnl-route-3-dev libprotobuf-dev protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
+ARG NSJAIL_VERSION=3.4
+RUN git clone --branch "${NSJAIL_VERSION}" --recurse-submodules --depth=1 \
+        https://github.com/google/nsjail.git /nsjail-src \
+    && make -C /nsjail-src -j"$(nproc)"
+
 FROM base AS lambda-rie
 
 # Install the AWS Lambda Runtime Interface Emulator
@@ -27,22 +42,32 @@ RUN case $(uname -m) in \
 
 FROM base
 
-# Install git so we can install python packages from git repositories
+# git: install python packages from git repositories.
+# libcap2 / libnl-route-3-200 / libprotobuf32: nsjail's runtime shared libraries.
 RUN apt-get update && apt-get install -y \
     git \
+    libcap2 \
+    libnl-route-3-200 \
+    libprotobuf32 \
     && rm -rf /var/lib/apt/lists/*
 
 ENV LOG_FORMAT="production"
 
 # add shimmy
 COPY --from=shimmy /shimmy /usr/local/bin/shimmy
 
+# add nsjail (used by shimmy's --sandbox / SANDBOX_ENABLED)
+COPY --from=nsjail-builder /nsjail-src/nsjail /usr/sbin/nsjail
+
 # add aws-lambda-rie
 COPY --from=lambda-rie /usr/local/bin/aws-lambda-rie /usr/local/bin/aws-lambda-rie
 
 # Copy the entrypoint script
 COPY ./entrypoint.sh /entrypoint.sh
 
+# fail the build if nsjail is missing a shared library
+RUN ! ldd /usr/sbin/nsjail | grep -q 'not found'
+
 ENTRYPOINT [ "/entrypoint.sh" ]
 
 CMD [ "shimmy" ]