pycairo build fails in devcontainer: missing pkg-config and libcairo2-dev

[hskang-amelia]

Summary

Building eclipse-score/tooling (and likely any other repo whose Python/pip dependency graph pulls in pycairo, e.g. via rules_python's pip.parse) inside this devcontainer image fails while pip builds pycairo from source, because the image is missing pkg-config and the cairo development headers.

Reproduction

1. Run the devcontainer image: ghcr.io/eclipse-score/devcontainer:latest
2. In eclipse-score/tooling, run bazel build //...
3. The build fails resolving the pycairo pip dependency (surfaces as a rules_python pip.parse repository-rule failure, e.g. pip_rules_score_312_pycairo)

Error

Did not find pkg-config by name 'pkg-config'
Found pkg-config: NO
Did not find CMake 'cmake'
Found CMake: NO
Run-time dependency cairo found: NO

../cairo/meson.build:31:12: ERROR: Dependency lookup for cairo with method 'pkg-config' failed: Pkg-config for machine host machine not found. Giving up.

Root cause

pycairo==1.29.0 has no prebuilt wheel for this environment's Python/platform combination, so pip builds it from source via its meson build backend. That build requires pkg-config and libcairo2-dev (cairo's dev headers + pkg-config file) to locate the cairo library at build time. Neither package is installed in the devcontainer image.

Suggested fix

Add pkg-config and libcairo2-dev to the devcontainer image's apt package list (Dockerfile).

Workaround used locally

Running the following as root inside the container before the build unblocks it:

apt-get update && apt-get install -y pkg-config libcairo2-dev

[lurtz]

Could this also be considered a leak from bazel? IIRC bazel should be able to build all without using libraries or headers from the host.

I am fine with the proposed fix, since I favor bundling the dependencies in the devcontainer instead of downloading and building a lot via bazel. For the same reason the devcontainer has the LLVM toolchain included. bazel builds are broken otherwise.

FYI @nradakovic @AlexanderLanin

[hskang-amelia]

Small nuance: this isn’t a hermeticity leak in a Bazel build action — those are sandboxed. It’s pip.parse‘s pip/meson call running inside a repository rule, which by design already has host/network access at fetch time. So it’s less “the sandbox is leaking” and more “this step was never inside the hermetic guarantee.” Doesn’t change the fix though — bundling pkg-config/libcairo2-dev in the devcontainer is still right.