From 79a589450e17025c99c2a148c82604da534ae119 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Tue, 19 Dec 2023 15:11:25 +0000
Subject: [PATCH 01/14] CI: add docker images

- fixes #933
---
 .github/workflows/build.yml | 42 +++++++++++++++++++++++++++++++++++++
 scripts/Dockerfile          | 25 ++++++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 scripts/Dockerfile

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ec86d4bba4..9ad9f5ff48 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -95,3 +95,45 @@ jobs:
         branch: gh-pages
         dir: docs/build
         nojekyll: true
+  docker:
+    needs: conda
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - uses: actions/checkout@v4
+    - uses: docker/setup-buildx-action@v3
+    - uses: docker/metadata-action@v5
+      id: meta
+      with:
+        images: tomographicimaging/cil
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+    - name: Get tag
+      id: build-args
+      run: |
+        if ${{ github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags') }}; then
+          echo "args=CIL_TAG=${{ github.ref_name }}" >> $GITHUB_OUTPUT
+        else
+          echo "args=" >> $GITHUB_OUTPUT
+        fi
+    - uses: docker/login-action@v3
+      if: github.ref == 'refs/heads/master'
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Build & push
+      uses: docker/build-push-action@v5
+      with:
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        push: ${{ github.ref == 'refs/heads/master' }}
+        context: "{{defaultContext}}:scripts"
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        build-args: ${{ steps.build-args.outputs.args }}
diff --git a/scripts/Dockerfile b/scripts/Dockerfile
new file mode 100644
index 0000000000..b9b4c8ab73
--- /dev/null
+++ b/scripts/Dockerfile
@@ -0,0 +1,25 @@
+# sources:
+# - https://github.com/jupyter/docker-stacks
+# - https://github.com/TomographicImaging/CIL#installation-of-cil
+# consumers:
+# - https://github.com/stfc/cloud-docker-images
+# TODO: use `ubuntu-22.04` after `python=3.11` is supported, vis.
+# https://github.com/TomographicImaging/CIL/issues/1490
+FROM jupyter/tensorflow-notebook:ubuntu-20.04
+LABEL org.opencontainers.image.source=https://github.com/TomographicImaging/CIL
+LABEL org.opencontainers.image.description="Core Imaging Library"
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+
+ARG CIL_TAG=23.1.0
+# CUDA-specific packages
+ARG CIL_EXTRA_PACKAGES=astra-toolbox tigre
+RUN mamba install -y -c conda-forge -c intel -c ccpi \
+  $CIL_EXTRA_PACKAGES \
+  cil=$CIL_TAG ccpi-regulariser tomophantom "ipywidgets<8" \
+  jupyter-server-proxy \
+  && mamba clean -a -y -f \
+  && fix-permissions "${CONDA_DIR}" \
+  && fix-permissions "/home/${NB_USER}"
+
+# NB: trailing `/` is required
+ENV TENSORBOARD_PROXY_URL=/user-redirect/proxy/6006/

From ec5cf2e8e60dc418c1e2434a7e5409b8bd987f00 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Tue, 19 Dec 2023 15:38:16 +0000
Subject: [PATCH 02/14] fix push

---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9ad9f5ff48..7a7a25cec1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -107,7 +107,7 @@ jobs:
     - uses: docker/metadata-action@v5
       id: meta
       with:
-        images: tomographicimaging/cil
+        images: ghcr.io/${{ github.repository }}
         tags: |
           type=ref,event=branch
           type=ref,event=pr
@@ -116,8 +116,8 @@ jobs:
     - name: Get tag
       id: build-args
       run: |
-        if ${{ github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags') }}; then
-          echo "args=CIL_TAG=${{ github.ref_name }}" >> $GITHUB_OUTPUT
+        if ${{ github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v') }}; then
+          echo "args=CIL_TAG=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
         else
           echo "args=" >> $GITHUB_OUTPUT
         fi

From a8f213b6c4732f78ac47765be0d2478ffa9a3968 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Tue, 19 Dec 2023 17:32:37 +0000
Subject: [PATCH 03/14] CIL_VERSION

---
 .github/workflows/README.md | 4 ++++
 .github/workflows/build.yml | 2 +-
 scripts/Dockerfile          | 4 ++--
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index bb4e0d915f..c2dbc08417 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -16,6 +16,10 @@ It looks for conda-build dependencies in the channels listed [here](https://gith
 
 An artifact of the resulting tar.bz2 file is made available in the 'Summary' section of the action. It is called `cil-package`. This is used by the **docs** job. It can be found by going to the ‘Actions’ tab, and selecting the appropriate run of `.github/workflows/build.yml`, or by clicking on the tick on the action in the "All checks have passed/failed" section of a PR. When viewing the summary for the run of the action, there is an `Artifact` section at the bottom of the page. Clicking on `cil-package` allows you to download a zip folder containing the tar.bz2 file.
 
+## Building/Pushing the Docker Image: docker job
+
+TODO
+
 ## Building/Publishing Documentation: docs job
 
 This github action builds and optionally publishes the documentation located in [docs/source](https://github.com/TomographicImaging/CIL/tree/master/docs/source). To do this it uses a forked version of the [build-sphinx-action](https://github.com/lauramurgatroyd/build-sphinx-action).
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7a7a25cec1..845350b38f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -117,7 +117,7 @@ jobs:
       id: build-args
       run: |
         if ${{ github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v') }}; then
-          echo "args=CIL_TAG=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+          echo "args=CIL_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
         else
           echo "args=" >> $GITHUB_OUTPUT
         fi
diff --git a/scripts/Dockerfile b/scripts/Dockerfile
index b9b4c8ab73..9a0942340e 100644
--- a/scripts/Dockerfile
+++ b/scripts/Dockerfile
@@ -10,12 +10,12 @@ LABEL org.opencontainers.image.source=https://github.com/TomographicImaging/CIL
 LABEL org.opencontainers.image.description="Core Imaging Library"
 LABEL org.opencontainers.image.licenses="Apache-2.0"
 
-ARG CIL_TAG=23.1.0
+ARG CIL_VERSION=23.1.0
 # CUDA-specific packages
 ARG CIL_EXTRA_PACKAGES=astra-toolbox tigre
 RUN mamba install -y -c conda-forge -c intel -c ccpi \
   $CIL_EXTRA_PACKAGES \
-  cil=$CIL_TAG ccpi-regulariser tomophantom "ipywidgets<8" \
+  cil=$CIL_VERSION ccpi-regulariser tomophantom "ipywidgets<8" \
   jupyter-server-proxy \
   && mamba clean -a -y -f \
   && fix-permissions "${CONDA_DIR}" \

From cb323de3b7bab856de677b5dece5516c750f6809 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Tue, 19 Dec 2023 18:53:25 +0000
Subject: [PATCH 04/14] docker: build local codebase

---
 .github/workflows/build.yml      | 15 ++++-----------
 scripts/Dockerfile => Dockerfile | 16 ++++++++++++++--
 2 files changed, 18 insertions(+), 13 deletions(-)
 rename scripts/Dockerfile => Dockerfile (54%)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 845350b38f..313c38394b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -96,13 +96,16 @@ jobs:
         dir: docs/build
         nojekyll: true
   docker:
-    needs: conda
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     steps:
     - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.ref }} # fix SHA
+        submodules: recursive
     - uses: docker/setup-buildx-action@v3
     - uses: docker/metadata-action@v5
       id: meta
@@ -113,14 +116,6 @@ jobs:
           type=ref,event=pr
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
-    - name: Get tag
-      id: build-args
-      run: |
-        if ${{ github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v') }}; then
-          echo "args=CIL_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
-        else
-          echo "args=" >> $GITHUB_OUTPUT
-        fi
     - uses: docker/login-action@v3
       if: github.ref == 'refs/heads/master'
       with:
@@ -133,7 +128,5 @@ jobs:
         cache-from: type=gha
         cache-to: type=gha,mode=max
         push: ${{ github.ref == 'refs/heads/master' }}
-        context: "{{defaultContext}}:scripts"
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
-        build-args: ${{ steps.build-args.outputs.args }}
diff --git a/scripts/Dockerfile b/Dockerfile
similarity index 54%
rename from scripts/Dockerfile
rename to Dockerfile
index 9a0942340e..d75f65838d 100644
--- a/scripts/Dockerfile
+++ b/Dockerfile
@@ -10,12 +10,16 @@ LABEL org.opencontainers.image.source=https://github.com/TomographicImaging/CIL
 LABEL org.opencontainers.image.description="Core Imaging Library"
 LABEL org.opencontainers.image.licenses="Apache-2.0"
 
-ARG CIL_VERSION=23.1.0
 # CUDA-specific packages
 ARG CIL_EXTRA_PACKAGES=astra-toolbox tigre
+# build & runtime dependencies
+# TODO: sync with scripts/requirements-test.yml
+# TODO: sync with scripts/create_local_env_for_cil_development.sh
 RUN mamba install -y -c conda-forge -c intel -c ccpi \
   $CIL_EXTRA_PACKAGES \
-  cil=$CIL_VERSION ccpi-regulariser tomophantom "ipywidgets<8" \
+  _openmp_mutex ccpi-regulariser cmake dxchange h5py libgcc-ng libstdcxx-ng numba numpy pillow pip pywavelets setuptools tomophantom tqdm \
+  python-wget scikit-image packaging \
+  "cil-data>=21.3.0" "ipp>=2021.10" "ipp-devel>=2021.10" "ipp-include>=2021.10" "ipywidgets<8" "matplotlib>=3.3.0" "olefile>=0.46" "scipy>=1.4.0" \
   jupyter-server-proxy \
   && mamba clean -a -y -f \
   && fix-permissions "${CONDA_DIR}" \
@@ -23,3 +27,11 @@ RUN mamba install -y -c conda-forge -c intel -c ccpi \
 
 # NB: trailing `/` is required
 ENV TENSORBOARD_PROXY_URL=/user-redirect/proxy/6006/
+
+# build & install CIL
+COPY --chown="${NB_USER}" . src
+RUN mkdir build && cd build \
+  && cmake ../src -DCMAKE_BUILD_TYPE="Release" -DCONDA_BUILD=ON -DCMAKE_INSTALL_PREFIX="${CONDA_DIR}" \
+  && cmake --build . --target install \
+  && cd .. && rm -rf src build \
+  && fix-permissions "${CONDA_DIR}"

From adea9bfdf600e69d42cab174a4b709f9b4e92540 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Tue, 19 Dec 2023 19:41:53 +0000
Subject: [PATCH 05/14] CI: fix docker build

---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 313c38394b..b38b3d996a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -127,6 +127,7 @@ jobs:
       with:
         cache-from: type=gha
         cache-to: type=gha,mode=max
+        context: .
         push: ${{ github.ref == 'refs/heads/master' }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}

From ca37f499cf06b6160b1a9c74a7dab03dfb1be6cc Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Tue, 19 Dec 2023 20:29:09 +0000
Subject: [PATCH 06/14] document docker

---
 .github/workflows/README.md | 16 ++++++++++++----
 README.md                   | 22 +++++++++++++++++++++-
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index c2dbc08417..4558e1fe95 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -16,10 +16,6 @@ It looks for conda-build dependencies in the channels listed [here](https://gith
 
 An artifact of the resulting tar.bz2 file is made available in the 'Summary' section of the action. It is called `cil-package`. This is used by the **docs** job. It can be found by going to the ‘Actions’ tab, and selecting the appropriate run of `.github/workflows/build.yml`, or by clicking on the tick on the action in the "All checks have passed/failed" section of a PR. When viewing the summary for the run of the action, there is an `Artifact` section at the bottom of the page. Clicking on `cil-package` allows you to download a zip folder containing the tar.bz2 file.
 
-## Building/Pushing the Docker Image: docker job
-
-TODO
-
 ## Building/Publishing Documentation: docs job
 
 This github action builds and optionally publishes the documentation located in [docs/source](https://github.com/TomographicImaging/CIL/tree/master/docs/source). To do this it uses a forked version of the [build-sphinx-action](https://github.com/lauramurgatroyd/build-sphinx-action).
@@ -61,3 +57,15 @@ To get the action to work I first had to:
 2. [Set the source](https://github.com/TomographicImaging/CIL/settings/pages) for our github pages to be the gh-pages branch.
 
 I followed the examples on the [sphinx build action page](https://github.com/marketplace/actions/sphinx-build), specifically this [example workflow](https://github.com/ammaraskar/sphinx-action-test/blob/master/.github/workflows/default.yml)
+
+## Building/Pushing the Docker Image: docker job
+
+This builds a docker image using the `Dockerfile` at the root of this repository.
+
+The image is also pushed to `ghcr.io/tomographicimaging/cil:TAG` (https://github.com/TomographicImaging/CIL/pkgs/container/cil), where `TAG` is given by:
+
+git ref | docker tag(s)
+--|--
+`master` branch | `master`
+`vM.m.p` tag | `M.m.p`, `M.m`, `latest`
+anything else | not pushed (only built)
diff --git a/README.md b/README.md
index 6ab479dcbf..85b8acb4a8 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,17 @@ CIL's [optimised FDK/FBP](https://github.com/TomographicImaging/CIL/discussions/
 1. the Intel [Integrated Performance Primitives](https://www.intel.com/content/www/us/en/developer/tools/oneapi/ipp.html#gs.gxwq5p) Library ([license](https://www.intel.com/content/dam/develop/external/us/en/documents/pdf/intel-simplified-software-license-version-august-2021.pdf)) which can be installed via conda from the `intel` [channel](https://anaconda.org/intel/ipp).
 2. [TIGRE](https://github.com/CERN/TIGRE), which can be installed via conda from the `ccpi` channel.
 
+## Docker
+
+Finally, CIL can be run via a Jupyter Notebook enabled Docker container:
+
+```sh
+docker run --rm --gpus all -p 8888:8888 -it ghcr.io/tomographicimaging/cil:latest
+```
+
+GPU support requires [`nvidia-container-toolkit`](https://github.com/NVIDIA/nvidia-container-toolkit) and an NVIDIA GPU.
+Omit the `--gpus all` to run without GPU support.
+
 # Getting Started with CIL
 
 ## CIL on binder
@@ -74,7 +85,7 @@ git clone --recurse-submodule git@github.com:TomographicImaging/CIL.git
 The use of `--recurse-submodule` is necessary if the user wants the examples data to be fetched (they are needed by the unit tests). We have moved such data, previously hosted in this repo at `Wrappers/Python/data` to the [CIL-data](https://github.com/TomographicImaging/CIL-Data) repository and linked it to this one as submodule. If the data is not available it can be fetched in an already cloned repository as
 
 ```sh
-git submodule update --init
+git submodule update --init --recursive
 ```
 
 ## Build dependencies
@@ -123,6 +134,15 @@ cmake .. -DCMAKE_INSTALL_PREFIX=<install_directory> -DIPP_LIBRARY=<path_to_ipp_l
 
 The user will then need to add the path `<install_directory>/lib` to the environment variable `PATH` or `LD_LIBRARY_PATH`, depending on system OS.
 
+## Building with Docker
+
+In the repository root, simply update submodules and run `docker build`:
+
+```sh
+git submodule update --init --recursive
+docker build . -t ghcr.io/tomographicimaging/cil
+```
+
 # References
 
 [1] Jørgensen JS et al. 2021 [Core Imaging Library Part I: a versatile python framework for tomographic imaging](https://doi.org/10.1098/rsta.2020.0192). Phil. Trans. R. Soc. A 20200192. [**Code.**](https://github.com/TomographicImaging/Paper-2021-RSTA-CIL-Part-I) [Pre-print](https://arxiv.org/abs/2102.04560)

From 618868ed6415c8e72e4a76d2c49659f1d5c45a92 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Tue, 19 Dec 2023 21:05:49 +0000
Subject: [PATCH 07/14] update changelog

---
 CHANGELOG.md | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b79bfe6b40..d8b927e5cb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,9 +1,9 @@
 * x.x.x
-  - Added a weight argument to the L1Norm function 
+  - Added a weight argument to the L1Norm function
   - Allow reduction methods on the DataContainer class to accept axis argument as string which matches values in dimension_labels
-  - Added the functions `set_norms` and `get_norms` to the `BlockOperator` class 
+  - Added the functions `set_norms` and `get_norms` to the `BlockOperator` class
   - Internal variable name change in BlockOperator to aid understanding
-  - Fixed formatting errors in the L2NormSquared and LeastSquares documentation 
+  - Fixed formatting errors in the L2NormSquared and LeastSquares documentation
   - Bug fix for BlockDataContainer as iterator
   - Dropped support for IPP versions older than 2021.10 due to header changes
   - Fix build include directories
@@ -11,12 +11,12 @@
   - ZeroOperator no longer relies on the default of allocate
   - Bug fix in SIRF TotalVariation unit tests with warm_start
   - Allow show2D to be used with 3D `DataContainer` instances
-  - Update documentation for symmetrised gradient 
+  - Update documentation for symmetrised gradient
   - Added documentation for CompositionOperator and SumOperator
   - Updated FISTA and ISTA algorithms to allow input functions to be None
   - Bug fix in the adjoint of the Diagonal Operator for complex values
-
-
+  - Update conda build action to v2 for 2.5x quicker builds
+  - Add docker image & push to [`ghcr.io/tomographicimaging/cil`](https://github.com/TomographicImaging/CIL/pkgs/container/cil)
 
 * 23.1.0
   - Fix bug in IndicatorBox proximal_conjugate
@@ -120,11 +120,11 @@
     - Update to version 0.1.1 of lauramurgatroyd/build-sphinx-action for building the documentation - ensures docs are always built from cil master
 
 * 21.4.1
- - Removed prints from unittests and cleanup of unittest code.
- - CMake:
-   - install script re-allows selection of non default install directory ([#1246](https://github.com/TomographicImaging/CIL/issues/1246))
- - TIFF writer uses logging
- - Added unittests for TIFF functionality
+  - Removed prints from unittests and cleanup of unittest code.
+  - CMake:
+    - install script re-allows selection of non default install directory ([#1246](https://github.com/TomographicImaging/CIL/issues/1246))
+  - TIFF writer uses logging
+  - Added unittests for TIFF functionality
 
 * 21.4.0
   - PEP 440 compliant version
@@ -231,7 +231,7 @@
   - introduction of Algorithm class
   - unit test expanded and moved to test directory
   - unified build system on Jenkins based on CCPi-VirtualMachine repo
- - switched to calendar versioning YY.0M.
+  - switched to calendar versioning YY.0M.
 
 * 0.10.0
 

From 611766ce25e1bd49b60b9beac75e71fbfca48773 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Thu, 21 Dec 2023 19:23:34 +0000
Subject: [PATCH 08/14] docker: use scripts for dependencies

---
 Dockerfile | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index d75f65838d..01e2944b87 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,20 +8,19 @@
 FROM jupyter/tensorflow-notebook:ubuntu-20.04
 LABEL org.opencontainers.image.source=https://github.com/TomographicImaging/CIL
 LABEL org.opencontainers.image.description="Core Imaging Library"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
+# tigre: BSD-3-Clause, astra-toolbox: GPL-3.0
+LABEL org.opencontainers.image.licenses="Apache-2.0 AND BSD-3-Clause AND GPL-3.0"
 
 # CUDA-specific packages
-ARG CIL_EXTRA_PACKAGES=astra-toolbox tigre
+ARG CIL_EXTRA_PACKAGES=tigre astra-toolbox
 # build & runtime dependencies
-# TODO: sync with scripts/requirements-test.yml
-# TODO: sync with scripts/create_local_env_for_cil_development.sh
-RUN mamba install -y -c conda-forge -c intel -c ccpi \
-  $CIL_EXTRA_PACKAGES \
-  _openmp_mutex ccpi-regulariser cmake dxchange h5py libgcc-ng libstdcxx-ng numba numpy pillow pip pywavelets setuptools tomophantom tqdm \
-  python-wget scikit-image packaging \
-  "cil-data>=21.3.0" "ipp>=2021.10" "ipp-devel>=2021.10" "ipp-include>=2021.10" "ipywidgets<8" "matplotlib>=3.3.0" "olefile>=0.46" "scipy>=1.4.0" \
-  jupyter-server-proxy \
+# TODO: sync scripts/create_local_env_for_cil_development.sh, scripts/requirements-test.yml, recipe/meta.yaml (e.g. missing libstdcxx-ng numpy _openmp_mutex pip)?
+COPY --chown="${NB_USER}" scripts/requirements-test.yml environment.yml
+RUN sed -ri '/tigre|astra-toolbox/d' environment.yml \
+  && for pkg in jupyter-server-proxy $CIL_EXTRA_PACKAGES; do echo "  - $pkg" >> environment.yml; done \
+  && mamba env update -n base \
   && mamba clean -a -y -f \
+  && rm environment.yml \
   && fix-permissions "${CONDA_DIR}" \
   && fix-permissions "/home/${NB_USER}"
 

From 3cbfdfcd0e75b7712845f7c49e19719b5bbc389b Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Thu, 21 Dec 2023 19:23:55 +0000
Subject: [PATCH 09/14] scripts: bump test dependencies

---
 scripts/requirements-test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/requirements-test.yml b/scripts/requirements-test.yml
index 22e07c990c..bc74782f38 100644
--- a/scripts/requirements-test.yml
+++ b/scripts/requirements-test.yml
@@ -22,8 +22,8 @@ channels:
 dependencies:
   - python
   - cil-data
-  - tigre=2.2
-  - ccpi-regulariser=21.0.0
+  - tigre=2.4
+  - ccpi-regulariser=22.0.0
   - tomophantom=2.0.0
   - astra-toolbox >=1.9.9.dev5,<2.1
   - cvxpy

From 2b1d5472994e38663203b9dfe21e66c8afb6db3a Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Thu, 21 Dec 2023 20:01:26 +0000
Subject: [PATCH 10/14] fix channel priorities

---
 Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 01e2944b87..0ab1e34903 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,8 +16,11 @@ ARG CIL_EXTRA_PACKAGES=tigre astra-toolbox
 # build & runtime dependencies
 # TODO: sync scripts/create_local_env_for_cil_development.sh, scripts/requirements-test.yml, recipe/meta.yaml (e.g. missing libstdcxx-ng numpy _openmp_mutex pip)?
 COPY --chown="${NB_USER}" scripts/requirements-test.yml environment.yml
+# channel_priority: https://stackoverflow.com/q/58555389
 RUN sed -ri '/tigre|astra-toolbox/d' environment.yml \
   && for pkg in jupyter-server-proxy $CIL_EXTRA_PACKAGES; do echo "  - $pkg" >> environment.yml; done \
+  && conda config --env --set channel_priority strict \
+  && for ch in defaults ccpi intel conda-forge; do conda config --env --add channels $ch; done \
   && mamba env update -n base \
   && mamba clean -a -y -f \
   && rm environment.yml \

From a8044351bd6b6ae194aa4fcc185c9710b4d138e0 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Thu, 21 Dec 2023 20:06:51 +0000
Subject: [PATCH 11/14] scripts: drop astra-toolbox channel, pin python=3.10 &
 numpy=1.24

---
 Dockerfile                    | 3 ++-
 scripts/requirements-test.yml | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 0ab1e34903..809106bd7b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,8 @@ LABEL org.opencontainers.image.licenses="Apache-2.0 AND BSD-3-Clause AND GPL-3.0
 # CUDA-specific packages
 ARG CIL_EXTRA_PACKAGES=tigre astra-toolbox
 # build & runtime dependencies
-# TODO: sync scripts/create_local_env_for_cil_development.sh, scripts/requirements-test.yml, recipe/meta.yaml (e.g. missing libstdcxx-ng numpy _openmp_mutex pip)?
+# TODO: sync scripts/create_local_env_for_cil_development.sh, scripts/requirements-test.yml, recipe/meta.yaml (e.g. missing libstdcxx-ng _openmp_mutex pip)?
+# vis. https://github.com/TomographicImaging/CIL/pull/1590
 COPY --chown="${NB_USER}" scripts/requirements-test.yml environment.yml
 # channel_priority: https://stackoverflow.com/q/58555389
 RUN sed -ri '/tigre|astra-toolbox/d' environment.yml \
diff --git a/scripts/requirements-test.yml b/scripts/requirements-test.yml
index bc74782f38..1e104492b4 100644
--- a/scripts/requirements-test.yml
+++ b/scripts/requirements-test.yml
@@ -17,10 +17,11 @@ channels:
   - conda-forge
   - intel
   - ccpi
-  - astra-toolbox
   - defaults
 dependencies:
-  - python
+  # base (vis. recipe/conda_build_config.yaml)
+  - python=3.10
+  - numpy=1.24
   - cil-data
   - tigre=2.4
   - ccpi-regulariser=22.0.0

From 1fcbd3665db59029f36f59055ac62f58a2efc7b0 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Thu, 21 Dec 2023 20:11:21 +0000
Subject: [PATCH 12/14] CI: fix docker push on tags

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b38b3d996a..58e16416e6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -117,7 +117,7 @@ jobs:
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
     - uses: docker/login-action@v3
-      if: github.ref == 'refs/heads/master'
+      if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -128,6 +128,6 @@ jobs:
         cache-from: type=gha
         cache-to: type=gha,mode=max
         context: .
-        push: ${{ github.ref == 'refs/heads/master' }}
+        push: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags') }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}

From 17eb401dbe7da3d02b2e90b59fa9bca303f47236 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Fri, 22 Dec 2023 12:44:34 +0000
Subject: [PATCH 13/14] docker: fix labels

---
 .github/workflows/build.yml | 3 ++-
 Dockerfile                  | 1 -
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 58e16416e6..d6c4c8a643 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -113,9 +113,10 @@ jobs:
         images: ghcr.io/${{ github.repository }}
         tags: |
           type=ref,event=branch
-          type=ref,event=pr
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
+        labels: |
+          org.opencontainers.image.licenses=Apache-2.0 AND BSD-3-Clause AND GPL-3.0
     - uses: docker/login-action@v3
       if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')
       with:
diff --git a/Dockerfile b/Dockerfile
index 809106bd7b..991df43b35 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,6 @@
 # https://github.com/TomographicImaging/CIL/issues/1490
 FROM jupyter/tensorflow-notebook:ubuntu-20.04
 LABEL org.opencontainers.image.source=https://github.com/TomographicImaging/CIL
-LABEL org.opencontainers.image.description="Core Imaging Library"
 # tigre: BSD-3-Clause, astra-toolbox: GPL-3.0
 LABEL org.opencontainers.image.licenses="Apache-2.0 AND BSD-3-Clause AND GPL-3.0"
 

From d70e75b7650fc87bc29dea6e4f62823e7cbb2c49 Mon Sep 17 00:00:00 2001
From: Casper da Costa-Luis <casper.dcl@physics.org>
Date: Fri, 22 Dec 2023 12:45:39 +0000
Subject: [PATCH 14/14] drop redundant name

---
 .github/workflows/build.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d6c4c8a643..93d4c63ae8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -123,8 +123,7 @@ jobs:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-    - name: Build & push
-      uses: docker/build-push-action@v5
+    - uses: docker/build-push-action@v5
       with:
         cache-from: type=gha
         cache-to: type=gha,mode=max