@@ -1 +0,0 @@
-output

@@ -2,29 +2,53 @@
 # installed.
 FROM ${DEBIAN_BASE_IMAGE}
 
-# Install Python build dependencies
+# Install Python build dependencies (based on Debian Build-Depends)
 RUN apt-get update && apt-get install -yq \
-    build-essential \
-    wget \
-    pkg-config \
+    autoconf \
+    blt-dev \
+    bzip2 \
+    debhelper \
+    dpkg-dev \
+    gcc \
+    libbluetooth-dev \
     libbz2-dev \
+    libdb-dev \
+    libexpat1-dev \
+    libffi-dev \
     libgdbm-dev \
+    libgpm2 \
     liblzma-dev \
-    libncurses5-dev \
+    libmpdec-dev \
+    libncursesw5-dev \
     libreadline-dev \
     libsqlite3-dev \
     libssl-dev \
+    locales \
+    lsb-release \
+    mime-support \
+    net-tools \
+    netbase \
+    python3 \
+    quilt \
+    sharutils \
+    time \
+    tk-dev \
+    wget \
+    xauth \
+    xvfb \
     zlib1g-dev
 
+
 # Setup locale. This prevents Python 3 IO encoding issues.
 ENV LANG C.UTF-8
 
 # Add build scripts
 ADD scripts /scripts
 
-# Build the Python 3.5 interpreter
+# Build the Python interpreters
 RUN /scripts/build-python-3.5.sh
+RUN /scripts/build-python-3.6.sh
 
 # Tar the interpreters. Tarring is needed because docker cp doesn't handle
 # links correctly.
-RUN tar czf /interpreters.tar.gz /opt
+RUN tar czf /interpreters.tar.gz /opt/python?.?
@@ -8,12 +8,13 @@ dependencies in the final container.
 
 ## Building
 
-Use make:
+Use:
 
-    make build
+    docker build --tag=google/python/interpreter-builder .
 
-The interpreters will be outputted to `output/interpreters.tar.gz`, this is
-suitable to be added directly to a Docker container:
+The interpreters will be stored in the image at `/interpreters.tar.gz`.  This is
+suitable to be extracted from this image and added directly to another Docker
+image via:
 
     ADD interpreters.tar.gz /
 

@@ -1,21 +1,128 @@
 #!/bin/bash
 
-set -e
+set -euo pipefail
+set -x
 
 # Get the source
 mkdir -p /opt/sources
 cd /opt/sources
-wget -nv https://www.python.org/ftp/python/3.5.2/Python-3.5.2.tgz
-tar xzf Python-3.5.2.tgz
+wget --no-verbose https://www.python.org/ftp/python/3.5.3/Python-3.5.3.tgz
+# SHA-256 generated via `shasum -a 256 [file]`
+shasum --check <<EOF
+d8890b84d773cd7059e597dbefa510340de8336ec9b9e9032bf030f19291565a  Python-3.5.3.tgz
+EOF
+tar xzf Python-3.5.3.tgz
 
 # Build
-cd Python-3.5.2
-# Use /opt/python{X}.{Y} for the prefix.
-./configure --prefix=/opt/python3.5 --with-lto
-# Explicitly build the profile-guided-optimized interpreter
+cd Python-3.5.3
+
+# Explanation of flags:
+#
+# Noteworthy Debian options we _don't_ use:
+#
+# --enable-shared
+#   This is complicated to get right, and we don't expect our
+#   customers to embed Python in a native code application.  There is
+#   also a noteworthy interaction with 'make altinstall'
+#   (https://bugs.python.org/issue27685)
+# --without-ensurepip
+#   Debian unbundles pip for their own reasons
+# CFLAGS=-fdebug-prefix-map
+#   Unnecessary in our build environment
+#
+#
+# Flags that we _do_ use:
+# (Debian) means it was taken from Debian build rules.
+#
+# --enable-ipv6
+#   (Debian) Ensure support is compiled in instead of relying on autodetection
+# --enable-loadable-sqlite-extensions
+#   (Debian)
+# --enable-optimizations
+#   Performance optimization (Enables PGO and may or may not enable
+#   LTO based on complex logic and bugs)
+# --prefix
+#   Avoid possible collisions with Debian or others
+# --with-computed-gotos
+#   (Debian) Performance optimization
+# --with-dbmliborder=bdb:gdbm
+#   (Debian) Python default is "ndbm:gdbm:bdb", I have no idea why one
+#   would prefer one over the other.
+# --with-fpectl
+#   (Debian) Floating point exception control
+# --with-system-expat
+#   (Debian) for compatibility with other Debian packages
+# --with-system-ffi
+#   (Debian) for compatibility with other Debian packages
+# --with-system-libmpdec
+#   (Debian) for compatibility with other Debian packages
+# AR=
+#   (Debian) No-op
+# CC=
+#   (Debian) No-op
+# CFLAGS=-fstack-protector-strong
+#   (Debian) Security hardening
+# CFLAGS=-g
+#   (Debian) More debug info
+# CFLAGS=-Wformat -Werror=format-security
+#   (Debian) Security hardening
+# CPPFLAGS=-D_FORTIFY_SOURCE=2
+#   (Debian) Security hardening
+# CPPFLAGS=-Wdate-time
+#   (Debian) Warnings about non-reproducible builds
+# CXX=
+#   (Debian) No-op
+# LDFLAGS=-Wl,-z,relro:
+#   (Debian) Security hardening
+# RANLIB=
+#   (Debian) No-op
+#
+#
+# LTO (Link time optimization)
+#
+# Currently disabled, due to unresolved compile problems.  There is a
+# --with-lto flag, but Debian doesn't use it.  Instead, they pass lto
+# related flags in EXTRA_CFLAGS (to make, rather than configure).
+# Specifically EXTRA_CFLAGS="-g -flto -fuse-linker-plugin
+# -ffat-lto-objects"
+
+mkdir build-static
+cd build-static
+
+../configure \
+  --enable-ipv6 \
+  --enable-loadable-sqlite-extensions \
+  --enable-optimizations \
+  --prefix=/opt/python3.5 \
+  --with-dbmliborder=bdb:gdbm \
+  --with-computed-gotos \
+  --with-fpectl \
+  --with-system-expat \
+  --with-system-ffi \
+  --with-system-libmpdec \
+  AR="x86_64-linux-gnu-gcc-ar" \
+  CC="x86_64-linux-gnu-gcc" \
+  CFLAGS="\
+    -fstack-protector-strong \
+    -g \
+    -Wformat -Werror=format-security \
+  " \
+  CPPFLAGS="\
+    -D_FORTIFY_SOURCE=2 \
+    -Wdate-time \
+  " \
+  CXX="x86_64-linux-gnu-g++" \
+  LDFLAGS="-Wl,-z,relro" \
+  RANLIB="x86_64-linux-gnu-gcc-ranlib" \
+
+# Due to https://bugs.python.org/issue29243, "make altinstall"
+# rebuilds everything from scratch, twice.  This is a workaround.
+sed -i 's/^all:.*$/all: build_all/' Makefile
+
 make profile-opt
 make altinstall
 
 # Clean-up sources
-rm /opt/sources/Python-3.5.2.tgz
-rm -r /opt/sources/Python-3.5.2
+cd /opt
+rm /opt/sources/Python-3.5.3.tgz
+rm -r /opt/sources/Python-3.5.3
@@ -0,0 +1,128 @@
+#!/bin/bash
+
+set -euo pipefail
+set -x
+
+# Get the source
+mkdir -p /opt/sources
+cd /opt/sources
+wget --no-verbose https://www.python.org/ftp/python/3.6.1/Python-3.6.1.tgz
+# SHA-256 generated via `shasum -a 256 [file]`
+shasum --check <<EOF
+aa50b0143df7c89ce91be020fe41382613a817354b33acdc6641b44f8ced3828  Python-3.6.1.tgz
+EOF
+tar xzf Python-3.6.1.tgz
+
+# Build
+cd Python-3.6.1
+
+# Explanation of flags:
+#
+# Noteworthy Debian options we _don't_ use:
+#
+# --enable-shared
+#   This is complicated to get right, and we don't expect our
+#   customers to embed Python in a native code application.  There is
+#   also a noteworthy interaction with 'make altinstall'
+#   (https://bugs.python.org/issue27685)
+# --without-ensurepip
+#   Debian unbundles pip for their own reasons
+# CFLAGS=-fdebug-prefix-map
+#   Unnecessary in our build environment
+#
+#
+# Flags that we _do_ use:
+# (Debian) means it was taken from Debian build rules.
+#
+# --enable-ipv6
+#   (Debian) Ensure support is compiled in instead of relying on autodetection
+# --enable-loadable-sqlite-extensions
+#   (Debian)
+# --enable-optimizations
+#   Performance optimization (Enables PGO and may or may not enable
+#   LTO based on complex logic and bugs)
+# --prefix
+#   Avoid possible collisions with Debian or others
+# --with-computed-gotos
+#   (Debian) Performance optimization
+# --with-dbmliborder=bdb:gdbm
+#   (Debian) Python default is "ndbm:gdbm:bdb", I have no idea why one
+#   would prefer one over the other.
+# --with-fpectl
+#   (Debian) Floating point exception control
+# --with-system-expat
+#   (Debian) for compatibility with other Debian packages
+# --with-system-ffi
+#   (Debian) for compatibility with other Debian packages
+# --with-system-libmpdec
+#   (Debian) for compatibility with other Debian packages
+# AR=
+#   (Debian) No-op
+# CC=
+#   (Debian) No-op
+# CFLAGS=-fstack-protector-strong
+#   (Debian) Security hardening
+# CFLAGS=-g
+#   (Debian) More debug info
+# CFLAGS=-Wformat -Werror=format-security
+#   (Debian) Security hardening
+# CPPFLAGS=-D_FORTIFY_SOURCE=2
+#   (Debian) Security hardening
+# CPPFLAGS=-Wdate-time
+#   (Debian) Warnings about non-reproducible builds
+# CXX=
+#   (Debian) No-op
+# LDFLAGS=-Wl,-z,relro:
+#   (Debian) Security hardening
+# RANLIB=
+#   (Debian) No-op
+#
+#
+# LTO (Link time optimization)
+#
+# Currently disabled, due to unresolved compile problems.  There is a
+# --with-lto flag, but Debian doesn't use it.  Instead, they pass lto
+# related flags in EXTRA_CFLAGS (to make, rather than configure).
+# Specifically EXTRA_CFLAGS="-g -flto -fuse-linker-plugin
+# -ffat-lto-objects"
+
+mkdir build-static
+cd build-static
+
+../configure \
+  --enable-ipv6 \
+  --enable-loadable-sqlite-extensions \
+  --enable-optimizations \
+  --prefix=/opt/python3.6 \
+  --with-dbmliborder=bdb:gdbm \
+  --with-computed-gotos \
+  --with-fpectl \
+  --with-system-expat \
+  --with-system-ffi \
+  --with-system-libmpdec \
+  AR="x86_64-linux-gnu-gcc-ar" \
+  CC="x86_64-linux-gnu-gcc" \
+  CFLAGS="\
+    -fstack-protector-strong \
+    -g \
+    -Wformat -Werror=format-security \
+  " \
+  CPPFLAGS="\
+    -D_FORTIFY_SOURCE=2 \
+    -Wdate-time \
+  " \
+  CXX="x86_64-linux-gnu-g++" \
+  LDFLAGS="-Wl,-z,relro" \
+  RANLIB="x86_64-linux-gnu-gcc-ranlib" \
+
+# Due to https://bugs.python.org/issue29243, "make altinstall"
+# rebuilds everything from scratch, twice.  This is a workaround.
+sed -i 's/^all:.*$/all: build_all/' Makefile
+
+make profile-opt
+make altinstall
+
+# Clean-up sources
+cd /opt
+rm /opt/sources/Python-3.6.1.tgz
+rm -r /opt/sources/Python-3.6.1