From 1873c49a7b498b904b3406574241757e52610a94 Mon Sep 17 00:00:00 2001
From: Jerry Zhao <ch3nzhao@gmail.com>
Date: Tue, 14 Jul 2026 13:07:20 +0000
Subject: [PATCH] Add Python 2 tooling to ubuntu-dev

---
 README.md             |  4 ++--
 ubuntu-dev/Dockerfile | 50 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 85b5d20..ac0e660 100644
--- a/README.md
+++ b/README.md
@@ -8,8 +8,8 @@ Docker images for EloqData development.
 
 A lightweight Ubuntu 24.04 development image containing the build toolchain and libraries that
 EloqData projects need, installed entirely via `apt` (compilers, CMake/Ninja, common C/C++ dev
-libraries, Python 3, Node.js, Go, the JDK, and the Google Cloud CLI). It runs as a non-root user
-`eloq` with passwordless `sudo`.
+libraries, Python 3, Python 2.7 for legacy MongoDB 4.0 build tooling, Node.js, Go, the JDK, and
+the Google Cloud CLI). It runs as a non-root user `eloq` with passwordless `sudo`.
 
 Pull it (Docker automatically selects `amd64` or `arm64` for your machine):
 
diff --git a/ubuntu-dev/Dockerfile b/ubuntu-dev/Dockerfile
index fb2a8a3..2defdf6 100644
--- a/ubuntu-dev/Dockerfile
+++ b/ubuntu-dev/Dockerfile
@@ -1,7 +1,8 @@
 FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
-ENV PATH=/home/eloq/.local/bin:$PATH
+ENV PYTHON2_HOME=/opt/eloq/python2
+ENV PATH=$PYTHON2_HOME/bin:/home/eloq/.local/bin:$PATH
 
 # Force IPv4 for apt to avoid flaky IPv6 mirrors.
 RUN echo 'Acquire::ForceIPv4 "true";' > /etc/apt/apt.conf.d/99force-ipv4
@@ -64,6 +65,53 @@ RUN python3 -m venv /opt/eloq/test-venv \
     && chown -R root:sudo /opt/eloq && chmod -R g+rwX /opt/eloq
 ENV ELOQ_TEST_VENV=/opt/eloq/test-venv
 
+# Python 2.7.18 + the MongoDB 4.0 build/resmoke dependencies used by EloqDoc.
+# Python 2 cannot reliably build against Ubuntu 24.04's OpenSSL 3, so build a
+# private OpenSSL 1.1 runtime for the Python 2 ssl module.
+RUN set -eux; \
+    mkdir -p /tmp/python2-build; \
+    cd /tmp/python2-build; \
+    curl -fsSLO https://www.openssl.org/source/openssl-1.1.1w.tar.gz; \
+    tar -xzf openssl-1.1.1w.tar.gz; \
+    cd openssl-1.1.1w; \
+    ./config --prefix=/opt/eloq/openssl-1.1 --openssldir=/opt/eloq/openssl-1.1 shared zlib; \
+    make -j"$(nproc)"; \
+    make install_sw; \
+    cd /tmp/python2-build; \
+    curl -fsSLO https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tgz; \
+    tar -xzf Python-2.7.18.tgz; \
+    cd Python-2.7.18; \
+    ./configure \
+      --prefix="$PYTHON2_HOME" \
+      --enable-shared \
+      --enable-unicode=ucs4 \
+      --with-system-ffi \
+      CPPFLAGS="-I/opt/eloq/openssl-1.1/include" \
+      LDFLAGS="-Wl,-rpath,/opt/eloq/openssl-1.1/lib -L/opt/eloq/openssl-1.1/lib"; \
+    make -j"$(nproc)"; \
+    make install; \
+    echo "$PYTHON2_HOME/lib" > /etc/ld.so.conf.d/python2.conf; \
+    echo "/opt/eloq/openssl-1.1/lib" > /etc/ld.so.conf.d/openssl-1.1.conf; \
+    ldconfig; \
+    curl -fsSL https://bootstrap.pypa.io/pip/2.7/get-pip.py -o /tmp/get-pip.py; \
+    python2 /tmp/get-pip.py 'pip<21' 'setuptools<45' 'wheel<0.38'; \
+    python2 -m pip install --no-cache-dir \
+      'Cheetah3==3.0.0' \
+      'Jinja2==2.10' \
+      'MarkupSafe<2.0' \
+      'PyYAML==3.11' \
+      'mock==2.0.0' \
+      'pymongo>=3.0,<4' \
+      'regex==2021.11.10' \
+      'requests>=2.16.1,<2.28' \
+      'subprocess32>=3.2.7' \
+      'typing==3.6.1' \
+      'unittest-xml-reporting==2.1.0'; \
+    ln -sf "$PYTHON2_HOME/bin/python2.7" /usr/local/bin/python2; \
+    ln -sf "$PYTHON2_HOME/bin/pip2.7" /usr/local/bin/pip2; \
+    chown -R root:sudo /opt/eloq && chmod -R g+rwX /opt/eloq; \
+    rm -rf /tmp/python2-build /tmp/get-pip.py /root/.cache
+
 # Non-root user with passwordless sudo (no password is baked into the image).
 RUN useradd -rm -s /bin/bash -g sudo eloq \
     && echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers \