From 5dce9dfec209279c839b0b3266045bd74827d38a Mon Sep 17 00:00:00 2001
From: Subash Canapathy <subash@amazon.com>
Date: Mon, 26 Apr 2021 22:42:35 -0700
Subject: [PATCH] MWAA Local Runner - First Release

---
 .gitignore                           |    6 +
 README.md                            |  171 ++++-
 VERSION                              |    1 +
 dags/requirements.txt                |    0
 dags/tutorial.py                     |   48 ++
 docker/Dockerfile                    |   39 +
 docker/config/airflow.cfg            | 1011 ++++++++++++++++++++++++++
 docker/config/constraints.txt        |  330 +++++++++
 docker/config/requirements.txt       |  107 +++
 docker/config/webserver_config.py    |   37 +
 docker/docker-compose-local.yml      |   38 +
 docker/docker-compose-resetdb.yml    |   32 +
 docker/docker-compose-sequential.yml |   23 +
 docker/script/bootstrap.sh           |   47 ++
 docker/script/entrypoint.sh          |   93 +++
 docker/script/systemlibs.sh          |   35 +
 mwaa-local-env                       |   86 +++
 17 files changed, 2098 insertions(+), 6 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 VERSION
 create mode 100644 dags/requirements.txt
 create mode 100644 dags/tutorial.py
 create mode 100644 docker/Dockerfile
 create mode 100644 docker/config/airflow.cfg
 create mode 100644 docker/config/constraints.txt
 create mode 100644 docker/config/requirements.txt
 create mode 100644 docker/config/webserver_config.py
 create mode 100644 docker/docker-compose-local.yml
 create mode 100644 docker/docker-compose-resetdb.yml
 create mode 100644 docker/docker-compose-sequential.yml
 create mode 100644 docker/script/bootstrap.sh
 create mode 100644 docker/script/entrypoint.sh
 create mode 100644 docker/script/systemlibs.sh
 create mode 100755 mwaa-local-env

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..5bc639996
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,6 @@
+/git
+*.workspace
+dags/**/*.pyc
+/.idea
+/logs
+/db-data
\ No newline at end of file
diff --git a/README.md b/README.md
index 7f9220474..37da8de4f 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,171 @@
-## My Project
+# About aws-mwaa-local-runner
 
-TODO: Fill this README out!
+This repository provides a command line interface (CLI) utility that replicates an Amazon Managed Workflows for Apache Airflow (MWAA) environment locally.
 
-Be sure to:
+## About the CLI
 
-* Change the title in this README
-* Edit your repository description on GitHub
+The CLI builds a Docker container image locally that’s similar to a MWAA production image. This allows you to run a local Apache Airflow environment to develop and test DAGs, custom plugins, and dependencies before deploying to MWAA.
+
+## What this repo contains
+
+```text
+dags/
+  requirements.txt
+  tutorial.py
+docker/
+  .gitignore
+  mwaa-local-env
+  README.md
+  config/
+    airflow.cfg
+    constraints.txt
+    requirements.txt
+    webserver_config.py
+  script/
+    bootstrap.sh
+    entrypoint.sh
+  docker-compose-dbonly.yml
+  docker-compose-local.yml
+  docker-compose-sequential.yml
+  Dockerfile
+```
+
+## Prerequisites
+
+- **macOS**: [Install Docker Desktop](https://docs.docker.com/desktop/).
+- **Linux/Ubuntu**: [Install Docker Compose](https://docs.docker.com/compose/install/) and [Install Docker Engine](https://docs.docker.com/engine/install/).
+- **Windows**: Windows Subsystem for Linux (WSL) to run the bash based command `mwaa-local-env`. Please follow [Windows Subsystem for Linux Installation (WSL)](https://docs.docker.com/docker-for-windows/wsl/) and [Using Docker in WSL 2](https://code.visualstudio.com/blogs/2020/03/02/docker-in-wsl2), to get started.
+
+## Get started
+
+```bash
+git clone https://github.com/what-is-the-final-repo-name.git
+cd whatever-the-package-dir-is
+```
+
+### Step one: Building the Docker image
+
+Build the Docker container image using the following command:
+
+```bash
+./mwaa-local-env build-image
+```
+
+**Note**: it takes several minutes to build the Docker image locally.
+
+### Step two: Running Apache Airflow
+
+Run Apache Airflow using one of the following database backends.
+
+#### Local runner
+
+Runs a local Apache Airflow environment that is a close representation of MWAA by configuration.
+
+```bash
+./mwaa-local-env start
+```
+
+To stop the local environment, Ctrl+C on the terminal and wait till the local runner and the postgres containers are stopped.
+
+### Step three: Accessing the Airflow UI
+
+By default, the `bootstrap.sh` script creates a username and password for your local Airflow environment.
+
+- Username: `admin`
+- Password: `test`
+
+#### Airflow UI
+
+- Open the Apache Airlfow UI: <http://localhost:8080/>.
+
+### Step four: Add DAGs and supporting files
+
+The following section describes where to add your DAG code and supporting files. We recommend creating a directory structure similar to your MWAA environment.
+
+#### DAGs
+
+1. Add DAG code to the `dags/` folder.
+2. To run the sample code in this repository, see the `tutorial.py` file.
+
+#### Requirements.txt
+
+1. Add Python dependencies to `dags/requirements.txt`.  
+2. To test a requirements.txt without running Apache Airflow, use the following script:
+
+```bash
+./mwaa-local-env test-requirements
+```
+
+Let's say you add `aws-batch==0.6` to your `dags/requirements.txt` file. You should see an output similar to:
+
+```bash
+Installing requirements.txt
+Collecting aws-batch (from -r /usr/local/airflow/dags/requirements.txt (line 1))
+  Downloading https://files.pythonhosted.org/packages/5d/11/3aedc6e150d2df6f3d422d7107ac9eba5b50261cf57ab813bb00d8299a34/aws_batch-0.6.tar.gz
+Collecting awscli (from aws-batch->-r /usr/local/airflow/dags/requirements.txt (line 1))
+  Downloading https://files.pythonhosted.org/packages/07/4a/d054884c2ef4eb3c237e1f4007d3ece5c46e286e4258288f0116724af009/awscli-1.19.21-py2.py3-none-any.whl (3.6MB)
+    100% |████████████████████████████████| 3.6MB 365kB/s 
+...
+...
+...
+Installing collected packages: botocore, docutils, pyasn1, rsa, awscli, aws-batch
+  Running setup.py install for aws-batch ... done
+Successfully installed aws-batch-0.6 awscli-1.19.21 botocore-1.20.21 docutils-0.15.2 pyasn1-0.4.8 rsa-4.7.2
+```
+
+#### Custom plugins
+
+- Create a directory at the root of this repository, and change directories into it. This should be at the same level as `dags/` and `docker`. For example:
+
+```bash
+mkdir plugins
+cd plugins
+```
+
+- Create a file for your custom plugin. For example:
+
+```bash
+virtual_python_plugin.py
+```
+
+- (Optional) Add any Python dependencies to `dags/requirements.txt`.
+
+**Note**: this step assumes you have a DAG that corresponds to the custom plugin. For examples, see [MWAA Code Examples](https://docs.aws.amazon.com/mwaa/latest/userguide/sample-code.html).
+
+## What's next?
+
+- Learn how to upload the requirements.txt file to your Amazon S3 bucket in [Installing Python dependencies](https://docs.aws.amazon.com/mwaa/latest/userguide/working-dags-dependencies.html).
+- Learn how to upload the DAG code to the dags folder in your Amazon S3 bucket in [Adding or updating DAGs](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-folder.html).
+- Learn more about how to upload the plugins.zip file to your Amazon S3 bucket in [Installing custom plugins](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-import-plugins.html).
+
+## FAQs
+
+The following section contains common questions and answers you may encounter when using your Docker container image.
+
+### Can I test execution role permissions using this repository?
+
+- You can setup the local Airflow's boto with the intended execution role to test your DAGs with AWS operators before uploading to your Amazon S3 bucket. To setup aws connection for Airflow locally see [Airflow | AWS Connection](https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/connections/aws.html)
+To learn more, see [Amazon MWAA Execution Role](https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html).
+
+### How do I add libraries to requirements.txt and test install?
+
+- A `requirements.txt` file is included in the `/dags` folder of your local Docker container image. We recommend adding libraries to this file, and running locally.
+
+### What if a library is not available on PyPi.org?
+
+- If a library is not available in the Python Package Index (PyPi.org), add the `--index-url` flag to the package in your `dags/requirements.txt` file. To learn more, see [Managing Python dependencies in requirements.txt](https://docs.aws.amazon.com/mwaa/latest/userguide/best-practices-dependencies.html).
+
+## Troubleshooting
+
+The following section contains errors you may encounter when using the Docker container image in this repository.
+
+## My environment is not starting - process failed with dag_stats_table already exists
+
+- If you encountered [the following error](https://issues.apache.org/jira/browse/AIRFLOW-3678): `process fails with "dag_stats_table already exists"`, you'll need to reset your database using the following command:
+
+```bash
+./mwaa-local-env reset-db
+```
 
 ## Security
 
@@ -14,4 +174,3 @@ See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more inform
 ## License
 
 This library is licensed under the MIT-0 License. See the LICENSE file.
-
diff --git a/VERSION b/VERSION
new file mode 100644
index 000000000..afaf360d3
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+1.0.0
\ No newline at end of file
diff --git a/dags/requirements.txt b/dags/requirements.txt
new file mode 100644
index 000000000..e69de29bb
diff --git a/dags/tutorial.py b/dags/tutorial.py
new file mode 100644
index 000000000..cead2b618
--- /dev/null
+++ b/dags/tutorial.py
@@ -0,0 +1,48 @@
+"""
+Code that goes along with the Airflow located at:
+http://airflow.readthedocs.org/en/latest/tutorial.html
+"""
+from airflow import DAG
+from airflow.operators.bash_operator import BashOperator
+from datetime import datetime, timedelta
+
+
+default_args = {
+    "owner": "airflow",
+    "depends_on_past": False,
+    "start_date": datetime(2015, 6, 1),
+    "email": ["airflow@airflow.com"],
+    "email_on_failure": False,
+    "email_on_retry": False,
+    "retries": 1,
+    "retry_delay": timedelta(minutes=5),
+    # 'queue': 'bash_queue',
+    # 'pool': 'backfill',
+    # 'priority_weight': 10,
+    # 'end_date': datetime(2016, 1, 1),
+}
+
+dag = DAG("tutorial", default_args=default_args, schedule_interval=timedelta(1))
+
+# t1, t2 and t3 are examples of tasks created by instantiating operators
+t1 = BashOperator(task_id="print_date", bash_command="date", dag=dag)
+
+t2 = BashOperator(task_id="sleep", bash_command="sleep 5", retries=3, dag=dag)
+
+templated_command = """
+    {% for i in range(5) %}
+        echo "{{ ds }}"
+        echo "{{ macros.ds_add(ds, 7)}}"
+        echo "{{ params.my_param }}"
+    {% endfor %}
+"""
+
+t3 = BashOperator(
+    task_id="templated",
+    bash_command=templated_command,
+    params={"my_param": "Parameter I passed in"},
+    dag=dag,
+)
+
+t2.set_upstream(t1)
+t3.set_upstream(t1)
diff --git a/docker/Dockerfile b/docker/Dockerfile
new file mode 100644
index 000000000..502d920e4
--- /dev/null
+++ b/docker/Dockerfile
@@ -0,0 +1,39 @@
+# VERSION 1.10
+# AUTHOR: Subash Canapathy
+# DESCRIPTION: Amazon MWAA Local Dev Environment
+# BUILD: docker build --rm -t amazon/mwaa-local .
+
+FROM amazonlinux
+LABEL maintainer="amazon"
+
+# Airflow
+ARG AIRFLOW_VERSION=1.10.12
+ARG AIRFLOW_USER_HOME=/usr/local/airflow
+ARG AIRFLOW_DEPS=""
+ARG PYTHON_DEPS=""
+ARG SYSTEM_DEPS=""
+ARG INDEX_URL=""
+ENV AIRFLOW_HOME=${AIRFLOW_USER_HOME}
+
+COPY script/bootstrap.sh /bootstrap.sh
+COPY script/systemlibs.sh /systemlibs.sh
+COPY config/constraints.txt /constraints.txt
+COPY config/requirements.txt /requirements.txt
+
+RUN chmod u+x /systemlibs.sh && /systemlibs.sh
+RUN chmod u+x /bootstrap.sh && /bootstrap.sh
+
+# Post bootstrap to avoid expensive docker rebuilds
+COPY script/entrypoint.sh /entrypoint.sh
+COPY config/airflow.cfg ${AIRFLOW_USER_HOME}/airflow.cfg
+COPY config/webserver_config.py ${AIRFLOW_USER_HOME}/webserver_config.py
+
+RUN chown -R airflow: ${AIRFLOW_USER_HOME}
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 8080 5555 8793
+
+USER airflow
+WORKDIR ${AIRFLOW_USER_HOME}
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["local-runner"]
\ No newline at end of file
diff --git a/docker/config/airflow.cfg b/docker/config/airflow.cfg
new file mode 100644
index 000000000..b6d11b55f
--- /dev/null
+++ b/docker/config/airflow.cfg
@@ -0,0 +1,1011 @@
+[core]
+# The folder where your airflow pipelines live, most likely a
+# subfolder in a code repository
+# This path must be absolute
+dags_folder = /usr/local/airflow/dags
+
+# The folder where airflow should store its log files
+# This path must be absolute
+base_log_folder = /usr/local/airflow/logs
+
+# Airflow can store logs remotely in AWS S3, Google Cloud Storage or Elastic Search.
+# Set this to True if you want to enable remote logging.
+remote_logging = False
+
+# Logging level
+logging_level = INFO
+
+# Logging level for Flask-appbuilder UI
+fab_logging_level = WARN
+
+# Logging class
+# Specify the class that will specify the logging configuration
+# This class has to be on the python classpath
+# Example: logging_config_class = my.path.default_local_settings.LOGGING_CONFIG
+logging_config_class =
+
+# Flag to enable/disable Colored logs in Console
+# Colour the logs when the controlling terminal is a TTY.
+colored_console_log = True
+
+# Log format for when Colored logs is enabled
+colored_log_format = [%%(blue)s%%(asctime)s%%(reset)s] {{%%(blue)s%%(filename)s:%%(reset)s%%(lineno)d}} %%(log_color)s%%(levelname)s%%(reset)s - %%(log_color)s%%(message)s%%(reset)s
+colored_formatter_class = airflow.utils.log.colored_log.CustomTTYColoredFormatter
+
+# Format of Log line
+log_format = [%%(asctime)s] {{%%(filename)s:%%(lineno)d}} %%(levelname)s - %%(message)s
+simple_log_format = %%(asctime)s %%(levelname)s - %%(message)s
+
+# Log filename format
+# we need to escape the curly braces by adding an additional curly brace
+log_filename_template = {{ ti.dag_id }}/{{ ti.task_id }}/{{ ts }}/{{ try_number }}.log
+log_processor_filename_template = {{ filename }}.log
+dag_processor_manager_log_location = /usr/local/airflow/logs/dag_processor_manager/dag_processor_manager.log
+
+# Name of handler to read task instance logs.
+# Default to use task handler.
+task_log_reader = task
+
+# Hostname by providing a path to a callable, which will resolve the hostname.
+# The format is "package:function".
+#
+# For example, default value "socket:getfqdn" means that result from getfqdn() of "socket"
+# package will be used as hostname.
+#
+# No argument should be required in the function specified.
+# If using IP address as hostname is preferred, use value ``airflow.utils.net:get_host_ip_address``
+hostname_callable = socket:getfqdn
+
+# Default timezone in case supplied date times are naive
+# can be utc (default), system, or any IANA timezone string (e.g. Europe/Amsterdam)
+default_timezone = utc
+
+# The executor class that airflow should use. Choices include
+# SequentialExecutor, LocalExecutor, CeleryExecutor, DaskExecutor, KubernetesExecutor
+executor = SequentialExecutor
+
+# The SqlAlchemy connection string to the metadata database.
+# SqlAlchemy supports many different database engine, more information
+# their website
+# sql_alchemy_conn = sqlite:////tmp/airflow.db
+
+# The encoding for the databases
+sql_engine_encoding = utf-8
+
+# If SqlAlchemy should pool database connections.
+sql_alchemy_pool_enabled = False
+
+# The SqlAlchemy pool size is the maximum number of database connections
+# in the pool. 0 indicates no limit.
+sql_alchemy_pool_size = 5
+
+# The maximum overflow size of the pool.
+# When the number of checked-out connections reaches the size set in pool_size,
+# additional connections will be returned up to this limit.
+# When those additional connections are returned to the pool, they are disconnected and discarded.
+# It follows then that the total number of simultaneous connections the pool will allow
+# is pool_size + max_overflow,
+# and the total number of "sleeping" connections the pool will allow is pool_size.
+# max_overflow can be set to -1 to indicate no overflow limit;
+# no limit will be placed on the total number of concurrent connections. Defaults to 10.
+sql_alchemy_max_overflow = 10
+
+# The SqlAlchemy pool recycle is the number of seconds a connection
+# can be idle in the pool before it is invalidated. This config does
+# not apply to sqlite. If the number of DB connections is ever exceeded,
+# a lower config value will allow the system to recover faster.
+sql_alchemy_pool_recycle = 1800
+
+# Check connection at the start of each connection pool checkout.
+# Typically, this is a simple statement like "SELECT 1".
+# More information here:
+# https://docs.sqlalchemy.org/en/13/core/pooling.html#disconnect-handling-pessimistic
+sql_alchemy_pool_pre_ping = True
+
+# The schema to use for the metadata database.
+# SqlAlchemy supports databases with the concept of multiple schemas.
+sql_alchemy_schema =
+
+# The amount of parallelism as a setting to the executor. This defines
+# the max number of task instances that should run simultaneously
+# on this airflow installation
+parallelism = 32
+
+# The number of task instances allowed to run concurrently by the scheduler
+dag_concurrency = 16
+
+# Are DAGs paused by default at creation
+dags_are_paused_at_creation = True
+
+# The maximum number of active DAG runs per DAG
+max_active_runs_per_dag = 16
+
+# Whether to load the DAG examples that ship with Airflow. It's good to
+# get started, but you probably want to set this to False in a production
+# environment
+load_examples = True
+
+# Whether to load the default connections that ship with Airflow. It's good to
+# get started, but you probably want to set this to False in a production
+# environment
+load_default_connections = True
+
+# Where your Airflow plugins are stored
+plugins_folder = /usr/local/airflow/plugins
+
+# Secret key to save connection passwords in the db
+fernet_key = $FERNET_KEY
+
+# Whether to disable pickling dags
+donot_pickle = False
+
+# How long before timing out a python file import
+dagbag_import_timeout = 30
+
+# How long before timing out a DagFileProcessor, which processes a dag file
+dag_file_processor_timeout = 50
+
+# The class to use for running task instances in a subprocess
+task_runner = StandardTaskRunner
+
+# If set, tasks without a ``run_as_user`` argument will be run with this user
+# Can be used to de-elevate a sudo user running Airflow when executing tasks
+default_impersonation =
+
+# What security module to use (for example kerberos)
+security =
+
+# If set to False enables some unsecure features like Charts and Ad Hoc Queries.
+# In 2.0 will default to True.
+secure_mode = True
+
+# Turn unit test mode on (overwrites many configuration options with test
+# values at runtime)
+unit_test_mode = False
+
+# Whether to enable pickling for xcom (note that this is insecure and allows for
+# RCE exploits). This will be deprecated in Airflow 2.0 (be forced to False).
+enable_xcom_pickling = False
+
+# When a task is killed forcefully, this is the amount of time in seconds that
+# it has to cleanup after it is sent a SIGTERM, before it is SIGKILLED
+killed_task_cleanup_time = 60
+
+# Whether to override params with dag_run.conf. If you pass some key-value pairs
+# through ``airflow dags backfill -c`` or
+# ``airflow dags trigger -c``, the key-value pairs will override the existing ones in params.
+dag_run_conf_overrides_params = False
+
+# Worker initialisation check to validate Metadata Database connection
+worker_precheck = False
+
+# When discovering DAGs, ignore any files that don't contain the strings ``DAG`` and ``airflow``.
+dag_discovery_safe_mode = True
+
+# The number of retries each task is going to have by default. Can be overridden at dag or task level.
+default_task_retries = 0
+
+# Whether to serialise DAGs and persist them in DB.
+# If set to True, Webserver reads from DB instead of parsing DAG files
+# More details: https://airflow.apache.org/docs/stable/dag-serialization.html
+store_serialized_dags = True
+
+# Updating serialized DAG can not be faster than a minimum interval to reduce database write rate.
+min_serialized_dag_update_interval = 30
+
+# Whether to persist DAG files code in DB.
+# If set to True, Webserver reads file contents from DB instead of
+# trying to access files in a DAG folder. Defaults to same as the
+# ``store_serialized_dags`` setting.
+store_dag_code = %(store_serialized_dags)s
+
+# Maximum number of Rendered Task Instance Fields (Template Fields) per task to store
+# in the Database.
+# When Dag Serialization is enabled (``store_serialized_dags=True``), all the template_fields
+# for each of Task Instance are stored in the Database.
+# Keeping this number small may cause an error when you try to view ``Rendered`` tab in
+# TaskInstance view for older tasks.
+max_num_rendered_ti_fields_per_task = 30
+
+# On each dagrun check against defined SLAs
+check_slas = True
+
+[secrets]
+# Full class name of secrets backend to enable (will precede env vars and metastore in search path)
+# Example: backend = airflow.contrib.secrets.aws_systems_manager.SystemsManagerParameterStoreBackend
+backend =
+
+# The backend_kwargs param is loaded into a dictionary and passed to __init__ of secrets backend class.
+# See documentation for the secrets backend you are using. JSON is expected.
+# Example for AWS Systems Manager ParameterStore:
+# ``{{"connections_prefix": "/airflow/connections", "profile_name": "default"}}``
+backend_kwargs =
+
+[cli]
+# In what way should the cli access the API. The LocalClient will use the
+# database directly, while the json_client will use the api running on the
+# webserver
+api_client = airflow.api.client.local_client
+
+# If you set web_server_url_prefix, do NOT forget to append it here, ex:
+# ``endpoint_url = http://localhost:8080/myroot``
+# So api will look like: ``http://localhost:8080/myroot/api/experimental/...``
+endpoint_url = http://localhost:8080
+
+[debug]
+# Used only with DebugExecutor. If set to True DAG will fail with first
+# failed task. Helpful for debugging purposes.
+fail_fast = False
+
+[api]
+# How to authenticate users of the API
+auth_backend = airflow.api.auth.backend.deny_all
+
+[lineage]
+# what lineage backend to use
+backend =
+
+[atlas]
+sasl_enabled = False
+host =
+port = 21000
+username =
+password =
+
+[operators]
+# The default owner assigned to each new operator, unless
+# provided explicitly or passed via ``default_args``
+default_owner = airflow
+default_cpus = 1
+default_ram = 512
+default_disk = 512
+default_gpus = 0
+
+[hive]
+# Default mapreduce queue for HiveOperator tasks
+default_hive_mapred_queue =
+
+[webserver]
+# The base url of your website as airflow cannot guess what domain or
+# cname you are using. This is used in automated emails that
+# airflow sends to point links to the right web server
+base_url = http://localhost:8080
+
+# Default timezone to display all dates in the RBAC UI, can be UTC, system, or
+# any IANA timezone string (e.g. Europe/Amsterdam). If left empty the
+# default value of core/default_timezone will be used
+# Example: default_ui_timezone = America/New_York
+default_ui_timezone = UTC
+
+# The ip specified when starting the web server
+web_server_host = 0.0.0.0
+
+# The port on which to run the web server
+web_server_port = 8080
+
+# Paths to the SSL certificate and key for the web server. When both are
+# provided SSL will be enabled. This does not change the web server port.
+web_server_ssl_cert =
+
+# Paths to the SSL certificate and key for the web server. When both are
+# provided SSL will be enabled. This does not change the web server port.
+web_server_ssl_key =
+
+# Number of seconds the webserver waits before killing gunicorn master that doesn't respond
+web_server_master_timeout = 300
+
+# Number of seconds the gunicorn webserver waits before timing out on a worker
+web_server_worker_timeout = 120
+
+# Number of workers to refresh at a time. When set to 0, worker refresh is
+# disabled. When nonzero, airflow periodically refreshes webserver workers by
+# bringing up new ones and killing old ones.
+worker_refresh_batch_size = 1
+
+# Number of seconds to wait before refreshing a batch of workers.
+worker_refresh_interval = 30
+
+# Secret key used to run your flask app
+# It should be as random as possible
+secret_key = $SECRET_KEY
+
+# Number of workers to run the Gunicorn web server
+workers = 4
+
+# The worker class gunicorn should use. Choices include
+# sync (default), eventlet, gevent
+worker_class = sync
+
+# Log files for the gunicorn webserver. '-' means log to stderr.
+access_logfile = -
+
+# Log files for the gunicorn webserver. '-' means log to stderr.
+error_logfile = -
+
+# Expose the configuration file in the web server
+expose_config = False
+
+# Expose hostname in the web server
+expose_hostname = False
+
+# Expose stacktrace in the web server
+expose_stacktrace = False
+
+# Set to true to turn on authentication:
+# https://airflow.apache.org/security.html#web-authentication
+authenticate = False
+
+# Filter the list of dags by owner name (requires authentication to be enabled)
+filter_by_owner = False
+
+# Filtering mode. Choices include user (default) and ldapgroup.
+# Ldap group filtering requires using the ldap backend
+#
+# Note that the ldap server needs the "memberOf" overlay to be set up
+# in order to user the ldapgroup mode.
+owner_mode = user
+
+# Default DAG view. Valid values are:
+# tree, graph, duration, gantt, landing_times
+dag_default_view = tree
+
+# "Default DAG orientation. Valid values are:"
+# LR (Left->Right), TB (Top->Bottom), RL (Right->Left), BT (Bottom->Top)
+dag_orientation = LR
+
+# Puts the webserver in demonstration mode; blurs the names of Operators for
+# privacy.
+demo_mode = False
+
+# The amount of time (in secs) webserver will wait for initial handshake
+# while fetching logs from other worker machine
+log_fetch_timeout_sec = 5
+
+# Time interval (in secs) to wait before next log fetching.
+log_fetch_delay_sec = 2
+
+# Distance away from page bottom to enable auto tailing.
+log_auto_tailing_offset = 30
+
+# Animation speed for auto tailing log display.
+log_animation_speed = 1000
+
+# By default, the webserver shows paused DAGs. Flip this to hide paused
+# DAGs by default
+hide_paused_dags_by_default = False
+
+# Consistent page size across all listing views in the UI
+page_size = 100
+
+# Use FAB-based webserver with RBAC feature
+rbac = True
+
+# Define the color of navigation bar
+navbar_color = #007A87
+
+# Default dagrun to show in UI
+default_dag_run_display_number = 25
+
+# Set secure flag on session cookie
+cookie_secure = False
+
+# Set samesite policy on session cookie
+cookie_samesite = Lax
+
+# Default setting for wrap toggle on DAG code and TI log views.
+default_wrap = False
+
+# Allow the UI to be rendered in a frame
+x_frame_enabled = False
+
+# Send anonymous user activity to your analytics tool
+# choose from google_analytics, segment, or metarouter
+# analytics_tool =
+
+# Unique ID of your account in the analytics tool
+# analytics_id =
+
+# Update FAB permissions and sync security manager roles
+# on webserver startup
+update_fab_perms = True
+
+# Minutes of non-activity before logged out from UI
+# 0 means never get forcibly logged out
+force_log_out_after = 0
+
+# The UI cookie lifetime in days
+session_lifetime_days = 1
+
+[email]
+email_backend = airflow.utils.email.send_email_smtp
+
+[smtp]
+
+# If you want airflow to send emails on retries, failure, and you want to use
+# the airflow.utils.email.send_email_smtp function, you have to configure an
+# smtp server here
+smtp_host = localhost
+smtp_starttls = True
+smtp_ssl = False
+# Example: smtp_user = airflow
+# smtp_user =
+# Example: smtp_password = airflow
+# smtp_password =
+smtp_port = 25
+smtp_mail_from = airflow@example.com
+
+[sentry]
+
+# Sentry (https://docs.sentry.io) integration
+sentry_dsn =
+
+[celery]
+
+# This section only applies if you are using the CeleryExecutor in
+# ``[core]`` section above
+# The app name that will be used by celery
+celery_app_name = airflow.executors.celery_executor
+
+# The concurrency that will be used when starting workers with the
+# ``airflow celery worker`` command. This defines the number of task instances that
+# a worker will take, so size up your workers based on the resources on
+# your worker box and the nature of your tasks
+worker_concurrency = 16
+
+# The maximum and minimum concurrency that will be used when starting workers with the
+# ``airflow celery worker`` command (always keep minimum processes, but grow
+# to maximum if necessary). Note the value should be max_concurrency,min_concurrency
+# Pick these numbers based on resources on worker box and the nature of the task.
+# If autoscale option is available, worker_concurrency will be ignored.
+# http://docs.celeryproject.org/en/latest/reference/celery.bin.worker.html#cmdoption-celery-worker-autoscale
+# Example: worker_autoscale = 16,12
+# worker_autoscale =
+
+# When you start an airflow worker, airflow starts a tiny web server
+# subprocess to serve the workers local log files to the airflow main
+# web server, who then builds pages and sends them to users. This defines
+# the port on which the logs are served. It needs to be unused, and open
+# visible from the main web server to connect into the workers.
+worker_log_server_port = 8793
+
+# The Celery broker URL. Celery supports RabbitMQ, Redis and experimentally
+# a sqlalchemy database. Refer to the Celery documentation for more
+# information.
+# http://docs.celeryproject.org/en/latest/userguide/configuration.html#broker-settings
+broker_url = sqla+mysql://airflow:airflow@localhost:3306/airflow
+
+# The Celery result_backend. When a job finishes, it needs to update the
+# metadata of the job. Therefore it will post a message on a message bus,
+# or insert it into a database (depending of the backend)
+# This status is used by the scheduler to update the state of the task
+# The use of a database is highly recommended
+# http://docs.celeryproject.org/en/latest/userguide/configuration.html#task-result-backend-settings
+result_backend = db+mysql://airflow:airflow@localhost:3306/airflow
+
+# Celery Flower is a sweet UI for Celery. Airflow has a shortcut to start
+# it ``airflow flower``. This defines the IP that Celery Flower runs on
+flower_host = 0.0.0.0
+
+# The root URL for Flower
+# Example: flower_url_prefix = /flower
+flower_url_prefix =
+
+# This defines the port that Celery Flower runs on
+flower_port = 5555
+
+# Securing Flower with Basic Authentication
+# Accepts user:password pairs separated by a comma
+# Example: flower_basic_auth = user1:password1,user2:password2
+flower_basic_auth =
+
+# Default queue that tasks get assigned to and that worker listen on.
+default_queue = default
+
+# How many processes CeleryExecutor uses to sync task state.
+# 0 means to use max(1, number of cores - 1) processes.
+sync_parallelism = 0
+
+# Import path for celery configuration options
+celery_config_options = celery_config.CUSTOM_CELERY_CONFIG
+
+# In case of using SSL
+ssl_active = False
+ssl_key =
+ssl_cert =
+ssl_cacert =
+
+# Celery Pool implementation.
+# Choices include: prefork (default), eventlet, gevent or solo.
+# See:
+# https://docs.celeryproject.org/en/latest/userguide/workers.html#concurrency
+# https://docs.celeryproject.org/en/latest/userguide/concurrency/eventlet.html
+pool = prefork
+
+# The number of seconds to wait before timing out ``send_task_to_executor`` or
+# ``fetch_celery_task_state`` operations.
+operation_timeout = 2
+
+[celery_broker_transport_options]
+
+# This section is for specifying options which can be passed to the
+# underlying celery broker transport. See:
+# http://docs.celeryproject.org/en/latest/userguide/configuration.html#std:setting-broker_transport_options
+# The visibility timeout defines the number of seconds to wait for the worker
+# to acknowledge the task before the message is redelivered to another worker.
+# Make sure to increase the visibility timeout to match the time of the longest
+# ETA you're planning to use.
+# visibility_timeout is only supported for Redis and SQS celery brokers.
+# See:
+# http://docs.celeryproject.org/en/master/userguide/configuration.html#std:setting-broker_transport_options
+# Example: visibility_timeout = 21600
+# visibility_timeout =
+
+# Without this flag, SQS requests will be rejected and task execution will fail.
+is_secure = True
+
+[dask]
+
+# This section only applies if you are using the DaskExecutor in
+# [core] section above
+# The IP address and port of the Dask cluster's scheduler.
+cluster_address = 127.0.0.1:8786
+
+# TLS/ SSL settings to access a secured Dask scheduler.
+tls_ca =
+tls_cert =
+tls_key =
+
+[scheduler]
+# Task instances listen for external kill signal (when you clear tasks
+# from the CLI or the UI), this defines the frequency at which they should
+# listen (in seconds).
+job_heartbeat_sec = 5
+
+# The scheduler constantly tries to trigger new tasks (look at the
+# scheduler section in the docs for more information). This defines
+# how often the scheduler should run (in seconds).
+scheduler_heartbeat_sec = 5
+
+# After how much time should the scheduler terminate in seconds
+# -1 indicates to run continuously (see also num_runs)
+run_duration = -1
+
+# The number of times to try to schedule each DAG file
+# -1 indicates unlimited number
+num_runs = -1
+
+# The number of seconds to wait between consecutive DAG file processing
+processor_poll_interval = 1
+
+# after how much time (seconds) a new DAGs should be picked up from the filesystem
+min_file_process_interval = 0
+
+# How often (in seconds) to scan the DAGs directory for new files. Default to 5 minutes.
+dag_dir_list_interval = 30
+
+# How often should stats be printed to the logs. Setting to 0 will disable printing stats
+print_stats_interval = 30
+
+# If the last scheduler heartbeat happened more than scheduler_health_check_threshold
+# ago (in seconds), scheduler is considered unhealthy.
+# This is used by the health check in the "/health" endpoint
+scheduler_health_check_threshold = 30
+
+child_process_log_directory = /usr/local/airflow/logs/scheduler
+
+# Local task jobs periodically heartbeat to the DB. If the job has
+# not heartbeat in this many seconds, the scheduler will mark the
+# associated task instance as failed and will re-schedule the task.
+scheduler_zombie_task_threshold = 300
+
+# Turn off scheduler catchup by setting this to False.
+# Default behavior is unchanged and
+# Command Line Backfills still work, but the scheduler
+# will not do scheduler catchup if this is False,
+# however it can be set on a per DAG basis in the
+# DAG definition (catchup)
+catchup_by_default = True
+
+# This changes the batch size of queries in the scheduling main loop.
+# If this is too high, SQL query performance may be impacted by one
+# or more of the following:
+# - reversion to full table scan
+# - complexity of query predicate
+# - excessive locking
+# Additionally, you may hit the maximum allowable query length for your db.
+# Set this to 0 for no limit (not advised)
+max_tis_per_query = 512
+
+# Statsd (https://github.com/etsy/statsd) integration settings
+statsd_on = True
+statsd_host = localhost
+statsd_port = 8125
+statsd_prefix = airflow
+
+# If you want to avoid send all the available metrics to StatsD,
+# you can configure an allow list of prefixes to send only the metrics that
+# start with the elements of the list (e.g: scheduler,executor,dagrun)
+statsd_allow_list =
+
+# The scheduler can run multiple threads in parallel to schedule dags.
+# This defines how many threads will run.
+max_threads = 2
+authenticate = False
+
+# Turn off scheduler use of cron intervals by setting this to False.
+# DAGs submitted manually in the web UI or with trigger_dag will still run.
+use_job_schedule = True
+
+# Allow externally triggered DagRuns for Execution Dates in the future
+# Only has effect if schedule_interval is set to None in DAG
+allow_trigger_in_future = False
+
+[ldap]
+# set this to ldaps://<your.ldap.server>:<port>
+uri =
+user_filter = objectClass=*
+user_name_attr = uid
+group_member_attr = memberOf
+superuser_filter =
+data_profiler_filter =
+bind_user = cn=Manager,dc=example,dc=com
+bind_password = insecure
+basedn = dc=example,dc=com
+cacert = /etc/ca/ldap_ca.crt
+search_scope = LEVEL
+
+# This setting allows the use of LDAP servers that either return a
+# broken schema, or do not return a schema.
+ignore_malformed_schema = False
+
+[mesos]
+# Mesos master address which MesosExecutor will connect to.
+master = localhost:5050
+
+# The framework name which Airflow scheduler will register itself as on mesos
+framework_name = Airflow
+
+# Number of cpu cores required for running one task instance using
+# 'airflow run <dag_id> <task_id> <execution_date> --local -p <pickle_id>'
+# command on a mesos slave
+task_cpu = 1
+
+# Memory in MB required for running one task instance using
+# 'airflow run <dag_id> <task_id> <execution_date> --local -p <pickle_id>'
+# command on a mesos slave
+task_memory = 256
+
+# Enable framework checkpointing for mesos
+# See http://mesos.apache.org/documentation/latest/slave-recovery/
+checkpoint = False
+
+# Failover timeout in milliseconds.
+# When checkpointing is enabled and this option is set, Mesos waits
+# until the configured timeout for
+# the MesosExecutor framework to re-register after a failover. Mesos
+# shuts down running tasks if the
+# MesosExecutor framework fails to re-register within this timeframe.
+# Example: failover_timeout = 604800
+# failover_timeout =
+
+# Enable framework authentication for mesos
+# See http://mesos.apache.org/documentation/latest/configuration/
+authenticate = False
+
+# Mesos credentials, if authentication is enabled
+# Example: default_principal = admin
+# default_principal =
+# Example: default_secret = admin
+# default_secret =
+
+# Optional Docker Image to run on slave before running the command
+# This image should be accessible from mesos slave i.e mesos slave
+# should be able to pull this docker image before executing the command.
+# Example: docker_image_slave = puckel/docker-airflow
+# docker_image_slave =
+
+[kerberos]
+ccache = /tmp/airflow_krb5_ccache
+
+# gets augmented with fqdn
+principal = airflow
+reinit_frequency = 3600
+kinit_path = kinit
+keytab = airflow.keytab
+
+[github_enterprise]
+api_rev = v3
+
+[admin]
+# UI to hide sensitive variable fields when set to True
+hide_sensitive_variable_fields = True
+
+[elasticsearch]
+# Elasticsearch host
+host =
+
+# Format of the log_id, which is used to query for a given tasks logs
+log_id_template = {{dag_id}}-{{task_id}}-{{execution_date}}-{{try_number}}
+
+# Used to mark the end of a log stream for a task
+end_of_log_mark = end_of_log
+
+# Qualified URL for an elasticsearch frontend (like Kibana) with a template argument for log_id
+# Code will construct log_id using the log_id template from the argument above.
+# NOTE: The code will prefix the https:// automatically, don't include that here.
+frontend =
+
+# Write the task logs to the stdout of the worker, rather than the default files
+write_stdout = False
+
+# Instead of the default log formatter, write the log lines as JSON
+json_format = False
+
+# Log fields to also attach to the json output, if enabled
+json_fields = asctime, filename, lineno, levelname, message
+
+[elasticsearch_configs]
+use_ssl = False
+verify_certs = True
+
+[kubernetes]
+# The repository, tag and imagePullPolicy of the Kubernetes Image for the Worker to Run
+worker_container_repository =
+worker_container_tag =
+worker_container_image_pull_policy = IfNotPresent
+
+# If True, all worker pods will be deleted upon termination
+delete_worker_pods = True
+
+# If False (and delete_worker_pods is True),
+# failed worker pods will not be deleted so users can investigate them.
+delete_worker_pods_on_failure = False
+
+# Number of Kubernetes Worker Pod creation calls per scheduler loop
+worker_pods_creation_batch_size = 1
+
+# The Kubernetes namespace where airflow workers should be created. Defaults to ``default``
+namespace = default
+
+# The name of the Kubernetes ConfigMap containing the Airflow Configuration (this file)
+# Example: airflow_configmap = airflow-configmap
+airflow_configmap =
+
+# The name of the Kubernetes ConfigMap containing ``airflow_local_settings.py`` file.
+#
+# For example:
+#
+# ``airflow_local_settings_configmap = "airflow-configmap"`` if you have the following ConfigMap.
+#
+# ``airflow-configmap.yaml``:
+#
+# .. code-block:: yaml
+#
+#   ---
+#   apiVersion: v1
+#   kind: ConfigMap
+#   metadata:
+#     name: airflow-configmap
+#   data:
+#     airflow_local_settings.py: |
+#         def pod_mutation_hook(pod):
+#             ...
+#     airflow.cfg: |
+#         ...
+# Example: airflow_local_settings_configmap = airflow-configmap
+airflow_local_settings_configmap =
+
+# For docker image already contains DAGs, this is set to ``True``, and the worker will
+# search for dags in dags_folder,
+# otherwise use git sync or dags volume claim to mount DAGs
+dags_in_image = False
+
+# For either git sync or volume mounted DAGs, the worker will look in this subpath for DAGs
+dags_volume_subpath =
+
+# For DAGs mounted via a volume claim (mutually exclusive with git-sync and host path)
+dags_volume_claim =
+
+# For volume mounted logs, the worker will look in this subpath for logs
+logs_volume_subpath =
+
+# A shared volume claim for the logs
+logs_volume_claim =
+
+# For DAGs mounted via a hostPath volume (mutually exclusive with volume claim and git-sync)
+# Useful in local environment, discouraged in production
+dags_volume_host =
+
+# A hostPath volume for the logs
+# Useful in local environment, discouraged in production
+logs_volume_host =
+
+# A list of configMapsRefs to envFrom. If more than one configMap is
+# specified, provide a comma separated list: configmap_a,configmap_b
+env_from_configmap_ref =
+
+# A list of secretRefs to envFrom. If more than one secret is
+# specified, provide a comma separated list: secret_a,secret_b
+env_from_secret_ref =
+
+# Git credentials and repository for DAGs mounted via Git (mutually exclusive with volume claim)
+git_repo =
+git_branch =
+git_subpath =
+
+# The specific rev or hash the git_sync init container will checkout
+# This becomes GIT_SYNC_REV environment variable in the git_sync init container for worker pods
+git_sync_rev =
+
+# Use git_user and git_password for user authentication or git_ssh_key_secret_name
+# and git_ssh_key_secret_key for SSH authentication
+git_user =
+git_password =
+git_sync_root = /git
+git_sync_dest = repo
+
+# Mount point of the volume if git-sync is being used.
+# i.e. {AIRFLOW_HOME}/dags
+git_dags_folder_mount_point =
+
+# To get Git-sync SSH authentication set up follow this format
+#
+# ``airflow-secrets.yaml``:
+#
+# .. code-block:: yaml
+#
+#   ---
+#   apiVersion: v1
+#   kind: Secret
+#   metadata:
+#     name: airflow-secrets
+#   data:
+#     # key needs to be gitSshKey
+#     gitSshKey: <base64_encoded_data>
+# Example: git_ssh_key_secret_name = airflow-secrets
+git_ssh_key_secret_name =
+
+# To get Git-sync SSH authentication set up follow this format
+#
+# ``airflow-configmap.yaml``:
+#
+# .. code-block:: yaml
+#
+#   ---
+#   apiVersion: v1
+#   kind: ConfigMap
+#   metadata:
+#     name: airflow-configmap
+#   data:
+#     known_hosts: |
+#         github.com ssh-rsa <...>
+#     airflow.cfg: |
+#         ...
+# Example: git_ssh_known_hosts_configmap_name = airflow-configmap
+git_ssh_known_hosts_configmap_name =
+
+# To give the git_sync init container credentials via a secret, create a secret
+# with two fields: GIT_SYNC_USERNAME and GIT_SYNC_PASSWORD (example below) and
+# add ``git_sync_credentials_secret = <secret_name>`` to your airflow config under the
+# ``kubernetes`` section
+#
+# Secret Example:
+#
+# .. code-block:: yaml
+#
+#   ---
+#   apiVersion: v1
+#   kind: Secret
+#   metadata:
+#     name: git-credentials
+#   data:
+#     GIT_SYNC_USERNAME: <base64_encoded_git_username>
+#     GIT_SYNC_PASSWORD: <base64_encoded_git_password>
+git_sync_credentials_secret =
+
+# For cloning DAGs from git repositories into volumes: https://github.com/kubernetes/git-sync
+git_sync_container_repository = k8s.gcr.io/git-sync
+git_sync_container_tag = v3.1.1
+git_sync_init_container_name = git-sync-clone
+git_sync_run_as_user = 65533
+
+# The name of the Kubernetes service account to be associated with airflow workers, if any.
+# Service accounts are required for workers that require access to secrets or cluster resources.
+# See the Kubernetes RBAC documentation for more:
+# https://kubernetes.io/docs/admin/authorization/rbac/
+worker_service_account_name =
+
+# Any image pull secrets to be given to worker pods, If more than one secret is
+# required, provide a comma separated list: secret_a,secret_b
+image_pull_secrets =
+
+# GCP Service Account Keys to be provided to tasks run on Kubernetes Executors
+# Should be supplied in the format: key-name-1:key-path-1,key-name-2:key-path-2
+gcp_service_account_keys =
+
+# Use the service account kubernetes gives to pods to connect to kubernetes cluster.
+# It's intended for clients that expect to be running inside a pod running on kubernetes.
+# It will raise an exception if called from a process not running in a kubernetes environment.
+in_cluster = True
+
+# When running with in_cluster=False change the default cluster_context or config_file
+# options to Kubernetes client. Leave blank these to use default behaviour like ``kubectl`` has.
+# cluster_context =
+# config_file =
+
+# Affinity configuration as a single line formatted JSON object.
+# See the affinity model for top-level key names (e.g. ``nodeAffinity``, etc.):
+# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.12/#affinity-v1-core
+affinity =
+
+# A list of toleration objects as a single line formatted JSON array
+# See:
+# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.12/#toleration-v1-core
+tolerations =
+
+# Keyword parameters to pass while calling a kubernetes client core_v1_api methods
+# from Kubernetes Executor provided as a single line formatted JSON dictionary string.
+# List of supported params are similar for all core_v1_apis, hence a single config
+# variable for all apis.
+# See:
+# https://raw.githubusercontent.com/kubernetes-client/python/master/kubernetes/client/apis/core_v1_api.py
+# Note that if no _request_timeout is specified, the kubernetes client will wait indefinitely
+# for kubernetes api responses, which will cause the scheduler to hang.
+# The timeout is specified as [connect timeout, read timeout]
+kube_client_request_args =
+
+# Specifies the uid to run the first process of the worker pods containers as
+run_as_user =
+
+# Specifies a gid to associate with all containers in the worker pods
+# if using a git_ssh_key_secret_name use an fs_group
+# that allows for the key to be read, e.g. 65533
+fs_group =
+
+[kubernetes_node_selectors]
+
+# The Key-value pairs to be given to worker pods.
+# The worker pods will be scheduled to the nodes of the specified key-value pairs.
+# Should be supplied in the format: key = value
+
+[kubernetes_annotations]
+
+# The Key-value annotations pairs to be given to worker pods.
+# Should be supplied in the format: key = value
+
+[kubernetes_environment_variables]
+
+# The scheduler sets the following environment variables into your workers. You may define as
+# many environment variables as needed and the kubernetes launcher will set them in the launched workers.
+# Environment variables in this section are defined as follows
+# ``<environment_variable_key> = <environment_variable_value>``
+#
+# For example if you wanted to set an environment variable with value `prod` and key
+# ``ENVIRONMENT`` you would follow the following format:
+# ENVIRONMENT = prod
+#
+# Additionally you may override worker airflow settings with the ``AIRFLOW__<SECTION>__<KEY>``
+# formatting as supported by airflow normally.
+
+[kubernetes_secrets]
+
+# The scheduler mounts the following secrets into your workers as they are launched by the
+# scheduler. You may define as many secrets as needed and the kubernetes launcher will parse the
+# defined secrets and mount them as secret environment variables in the launched workers.
+# Secrets in this section are defined as follows
+# ``<environment_variable_mount> = <kubernetes_secret_object>=<kubernetes_secret_key>``
+#
+# For example if you wanted to mount a kubernetes secret key named ``postgres_password`` from the
+# kubernetes secret object ``airflow-secret`` as the environment variable ``POSTGRES_PASSWORD`` into
+# your workers you would follow the following format:
+# ``POSTGRES_PASSWORD = airflow-secret=postgres_credentials``
+#
+# Additionally you may override worker airflow settings with the ``AIRFLOW__<SECTION>__<KEY>``
+# formatting as supported by airflow normally.
+
+[kubernetes_labels]
+
+# The Key-value pairs to be given to worker pods.
+# The worker pods will be given these static labels, as well as some additional dynamic labels
+# to identify the task.
+# Should be supplied in the format: ``key = value``
diff --git a/docker/config/constraints.txt b/docker/config/constraints.txt
new file mode 100644
index 000000000..9574a37d0
--- /dev/null
+++ b/docker/config/constraints.txt
@@ -0,0 +1,330 @@
+# downloaded from https://raw.githubusercontent.com/apache/airflow/constraints-1.10.12/constraints-3.7.txt
+# Editable install with no version control (apache-airflow==1.10.12)
+Babel==2.8.0
+Flask-Admin==1.5.4
+Flask-AppBuilder==2.3.4
+Flask-Babel==1.0.0
+Flask-Bcrypt==0.7.1
+Flask-Caching==1.3.3
+Flask-JWT-Extended==3.24.1
+Flask-Login==0.4.1
+Flask-OpenID==1.2.5
+Flask-SQLAlchemy==2.4.4
+Flask-WTF==0.14.3
+Flask==1.1.2
+JPype1==0.7.1
+JayDeBeApi==1.2.3
+Jinja2==2.11.2
+Mako==1.1.3
+Markdown==2.6.11
+MarkupSafe==1.1.1
+PyHive==0.6.3
+PyJWT==1.7.1
+PyNaCl==1.4.0
+PySmbClient==0.1.5
+PyYAML==5.3.1
+Pygments==2.6.1
+SQLAlchemy-JSONField==0.9.0
+SQLAlchemy-Utils==0.36.8
+SQLAlchemy==1.3.18
+Sphinx==3.2.1
+Unidecode==1.1.1
+WTForms==2.3.3
+Werkzeug==0.16.1
+adal==1.2.4
+alabaster==0.7.12
+alembic==1.4.2
+amqp==2.6.1
+analytics-python==1.2.9
+ansiwrap==0.8.4
+apipkg==1.5
+apispec==1.3.3
+appdirs==1.4.4
+argcomplete==1.12.0
+asn1crypto==1.4.0
+astroid==2.4.2
+async-generator==1.10
+atlasclient==1.0.0
+attrs==19.3.0
+aws-sam-translator==1.26.0
+aws-xray-sdk==2.6.0
+azure-common==1.1.25
+azure-cosmos==3.2.0
+azure-datalake-store==0.0.49
+azure-mgmt-containerinstance==1.5.0
+azure-mgmt-resource==10.2.0
+azure-nspkg==3.0.2
+azure-storage-blob==2.1.0
+azure-storage-common==2.1.0
+azure-storage==0.36.0
+backcall==0.2.0
+bcrypt==3.2.0
+beautifulsoup4==4.7.1
+billiard==3.6.3.0
+black==19.10b0
+blinker==1.4
+boto3==1.14.43
+boto==2.49.0
+botocore==1.17.43
+cached-property==1.5.1
+cachetools==4.1.1
+cassandra-driver==3.20.2
+cattrs==1.0.0
+celery==4.4.7
+certifi==2020.6.20
+cffi==1.14.2
+cfgv==3.2.0
+cfn-lint==0.35.0
+cgroupspy==0.1.6
+chardet==3.0.4
+click==6.7
+cloudant==0.5.10
+colorama==0.4.3
+colorlog==4.0.2
+configparser==3.5.3
+coverage==5.2.1
+croniter==0.3.34
+cryptography==3.0
+cx-Oracle==8.0.0
+datadog==0.38.0
+decorator==4.4.2
+defusedxml==0.6.0
+dill==0.3.2
+distlib==0.3.1
+dnspython==1.16.0
+docker-pycreds==0.4.0
+docker==3.7.3
+docopt==0.6.2
+docutils==0.16
+ecdsa==0.15
+elasticsearch-dsl==5.4.0
+elasticsearch==5.5.3
+email-validator==1.1.1
+entrypoints==0.3
+execnet==1.7.1
+fastavro==0.24.1
+filelock==3.0.12
+flake8-colors==0.1.6
+flake8==3.8.3
+flaky==3.7.0
+flask-swagger==0.2.14
+flower==0.9.5
+freezegun==0.3.15
+fsspec==0.8.0
+funcsigs==1.0.2
+future-fstrings==1.2.0
+future==0.18.2
+gcsfs==0.6.2
+google-api-core==1.22.1
+google-api-python-client==1.10.0
+google-auth-httplib2==0.0.4
+google-auth-oauthlib==0.4.1
+google-auth==1.20.1
+google-cloud-bigquery==1.26.1
+google-cloud-bigtable==1.4.0
+google-cloud-container==1.0.1
+google-cloud-core==1.4.1
+google-cloud-dlp==1.0.0
+google-cloud-language==1.3.0
+google-cloud-secret-manager==1.0.0
+google-cloud-spanner==1.17.1
+google-cloud-speech==1.3.2
+google-cloud-storage==1.30.0
+google-cloud-texttospeech==1.0.1
+google-cloud-translate==1.7.0
+google-cloud-videointelligence==1.15.0
+google-cloud-vision==1.0.0
+google-crc32c==0.1.0
+google-resumable-media==0.7.1
+googleapis-common-protos==1.52.0
+graphviz==0.14.1
+grpc-google-iam-v1==0.12.3
+grpcio-gcp==0.2.2
+grpcio==1.31.0
+gunicorn==20.0.4
+hdfs==2.5.8
+hmsclient==0.1.1
+httplib2==0.18.1
+humanize==2.6.0
+hvac==0.10.5
+identify==1.4.28
+idna==2.10
+imagesize==1.2.0
+importlib-metadata==1.7.0
+inflection==0.5.0
+ipdb==0.13.3
+ipython-genutils==0.2.0
+ipython==7.17.0
+iso8601==0.1.12
+isodate==0.6.0
+itsdangerous==1.1.0
+jedi==0.17.2
+jira==2.0.0
+jmespath==0.10.0
+json-merge-patch==0.2
+jsondiff==1.1.2
+jsonpatch==1.26
+jsonpickle==1.4.1
+jsonpointer==2.0
+jsonschema==3.2.0
+junit-xml==1.9
+jupyter-client==6.1.6
+jupyter-core==4.6.3
+kombu==4.6.11
+kubernetes==11.0.0
+lazy-object-proxy==1.5.1
+ldap3==2.8
+lockfile==0.12.2
+marshmallow-enum==1.5.1
+marshmallow-sqlalchemy==0.23.1
+marshmallow==2.21.0
+mccabe==0.6.1
+mock==4.0.2
+mongomock==3.20.0
+more-itertools==8.4.0
+moto==1.3.14
+msrest==0.6.18
+msrestazure==0.6.4
+multi-key-dict==2.0.3
+mypy-extensions==0.4.3
+mypy==0.720
+mysqlclient==1.3.14
+natsort==7.0.1
+nbclient==0.4.1
+nbformat==5.0.7
+nest-asyncio==1.4.0
+networkx==2.4
+nodeenv==1.4.0
+nteract-scrapbook==0.4.1
+ntlm-auth==1.5.0
+numpy==1.19.1
+oauthlib==3.1.0
+oscrypto==1.2.1
+packaging==20.4
+pandas-gbq==0.13.2
+pandas==1.1.0
+papermill==2.1.2
+parameterized==0.7.4
+paramiko==2.7.1
+parso==0.7.1
+pathspec==0.8.0
+pbr==5.4.5
+pendulum==1.4.4
+pexpect==4.8.0
+pickleshare==0.7.5
+pinotdb==0.1.1
+pluggy==0.13.1
+pre-commit==2.6.0
+presto-python-client==0.7.0
+prison==0.1.3
+prometheus-client==0.8.0
+prompt-toolkit==3.0.6
+protobuf==3.13.0
+psutil==5.7.2
+psycopg2-binary==2.8.5
+ptyprocess==0.6.0
+py==1.9.0
+pyOpenSSL==19.1.0
+pyarrow==0.17.1
+pyasn1-modules==0.2.8
+pyasn1==0.4.8
+pycodestyle==2.6.0
+pycparser==2.20
+pycryptodomex==3.9.8
+pydata-google-auth==1.1.0
+pydruid==0.5.8
+pyflakes==2.2.0
+pykerberos==1.2.1
+pymongo==3.10.1
+pymssql==2.1.4
+pyparsing==2.4.7
+pyrsistent==0.16.0
+pysftp==0.2.9
+pytest-cov==2.10.1
+pytest-forked==1.3.0
+pytest-instafail==0.4.2
+pytest-rerunfailures==9.0
+pytest-timeout==1.4.2
+pytest-xdist==2.0.0
+pytest==5.4.3
+# 2.2.4 -> 2.2.3 https://t.corp.amazon.com/V304351598
+python-daemon==2.2.3
+python-dateutil==2.8.1
+python-editor==1.0.4
+python-http-client==3.2.7
+python-jenkins==1.7.0
+python-jose==3.2.0
+python-nvd3==0.15.0
+python-slugify==4.0.1
+python3-openid==3.2.0
+pytz==2020.1
+pytzdata==2020.1
+pywinrm==0.4.1
+pyzmq==19.0.2
+qds-sdk==1.16.0
+redis==3.5.3
+regex==2020.7.14
+requests-futures==0.9.4
+requests-kerberos==0.12.0
+requests-mock==1.8.0
+requests-ntlm==1.1.0
+requests-oauthlib==1.3.0
+requests-toolbelt==0.9.1
+requests==2.24.0
+responses==0.10.16
+rsa==4.6
+s3transfer==0.3.3
+sasl==0.2.1
+sendgrid==5.6.0
+sentinels==1.0.0
+sentry-sdk==0.16.5
+setproctitle==1.1.10
+six==1.15.0
+slackclient==1.3.2
+snowballstemmer==2.0.0
+snowflake-connector-python==2.2.10
+snowflake-sqlalchemy==1.2.3
+soupsieve==2.0.1
+sphinx-argparse==0.2.5
+sphinx-autoapi==1.0.0
+sphinx-copybutton==0.3.0
+sphinx-jinja==1.1.1
+sphinx-rtd-theme==0.5.0
+sphinxcontrib-applehelp==1.0.2
+sphinxcontrib-devhelp==1.0.2
+sphinxcontrib-dotnetdomain==0.4
+sphinxcontrib-golangdomain==0.2.0.dev0
+sphinxcontrib-htmlhelp==1.0.3
+sphinxcontrib-httpdomain==1.7.0
+sphinxcontrib-jsmath==1.0.1
+sphinxcontrib-qthelp==1.0.3
+sphinxcontrib-serializinghtml==1.1.4
+sshpubkeys==3.1.0
+sshtunnel==0.1.5
+tabulate==0.8.7
+tenacity==4.12.0
+text-unidecode==1.3
+textwrap3==0.9.2
+thrift-sasl==0.4.2
+thrift==0.13.0
+toml==0.10.1
+tornado==5.1.1
+tqdm==4.48.2
+traitlets==4.3.3
+typed-ast==1.4.1
+typing-extensions==3.7.4.2
+tzlocal==1.5.1
+unicodecsv==0.14.1
+uritemplate==3.0.1
+urllib3==1.25.10
+vertica-python==0.11.0
+vine==1.3.0
+virtualenv==20.0.30
+wcwidth==0.2.5
+websocket-client==0.57.0
+wrapt==1.12.1
+xmltodict==0.12.0
+yamllint==1.24.2
+zdesk==2.7.1
+zipp==3.1.0
+zope.deprecation==4.4.0
\ No newline at end of file
diff --git a/docker/config/requirements.txt b/docker/config/requirements.txt
new file mode 100644
index 000000000..d5deb56d1
--- /dev/null
+++ b/docker/config/requirements.txt
@@ -0,0 +1,107 @@
+# Replacement for the local package installs from CodeArtifact
+alembic==1.4.2
+amqp==2.6.1
+apache-airflow==1.10.12
+apispec==1.3.3
+argcomplete==1.12.0
+attrs==19.3.0
+Babel==2.8.0
+billiard==3.6.3.0
+boto3==1.17.16
+botocore==1.20.16
+cached-property==1.5.1
+cattrs==1.0.0
+celery==4.4.7
+certifi==2020.6.20
+cffi==1.14.2
+chardet==3.0.4
+click==6.7
+colorama==0.4.3
+colorlog==4.0.2
+configparser==3.5.3
+croniter==0.3.34
+cryptography==3.0
+defusedxml==0.6.0
+dill==0.3.2
+dnspython==1.16.0
+docutils==0.16
+email-validator==1.1.1
+Flask==1.1.2
+Flask-Admin==1.5.4
+Flask-AppBuilder==2.3.4
+Flask-Babel==1.0.0
+Flask-Caching==1.3.3
+Flask-JWT-Extended==3.24.1
+Flask-Login==0.4.1
+Flask-OpenID==1.2.5
+Flask-SQLAlchemy==2.4.4
+flask-swagger==0.2.14
+Flask-WTF==0.14.3
+flower==0.9.5
+funcsigs==1.0.2
+future==0.18.2
+graphviz==0.14.1
+gunicorn==20.0.4
+humanize==2.6.0
+idna==2.10
+importlib-metadata==1.7.0
+iso8601==0.1.12
+itsdangerous==1.1.0
+Jinja2==2.11.2
+jmespath==0.10.0
+json-merge-patch==0.2
+jsonschema==3.2.0
+kombu==4.6.11
+lazy-object-proxy==1.5.1
+lockfile==0.12.2
+Mako==1.1.3
+Markdown==2.6.11
+MarkupSafe==1.1.1
+marshmallow==2.21.0
+marshmallow-enum==1.5.1
+marshmallow-sqlalchemy==0.23.1
+natsort==7.0.1
+numpy==1.19.1
+pandas==1.1.0
+pendulum==1.4.4
+prison==0.1.3
+prometheus-client==0.8.0
+psutil==5.7.2
+psycopg2==2.8.6
+pycparser==2.20
+pycurl==7.43.0.5
+Pygments==2.6.1
+PyJWT==1.7.1
+pyrsistent==0.16.0
+python-daemon==2.2.4
+python-dateutil==2.8.1
+python-editor==1.0.4
+python-nvd3==0.15.0
+python-slugify==4.0.1
+python3-openid==3.2.0
+pytz==2020.1
+pytzdata==2020.1
+PyYAML==5.3.1
+requests==2.24.0
+s3transfer==0.3.4
+setproctitle==1.1.10
+six==1.15.0
+SQLAlchemy==1.3.18
+SQLAlchemy-JSONField==0.9.0
+SQLAlchemy-Utils==0.36.8
+statsd==3.3.0
+tabulate==0.8.7
+tenacity==4.12.0
+text-unidecode==1.3
+thrift==0.13.0
+tornado==5.1.1
+typing-extensions==3.7.4.2
+tzlocal==1.5.1
+unicodecsv==0.14.1
+urllib3==1.25.10
+vine==1.3.0
+watchtower==1.0.1
+Werkzeug==0.16.1
+WTForms==2.3.3
+zipp==3.1.0
+zope.deprecation==4.4.0
\ No newline at end of file
diff --git a/docker/config/webserver_config.py b/docker/config/webserver_config.py
new file mode 100644
index 000000000..cf20078d0
--- /dev/null
+++ b/docker/config/webserver_config.py
@@ -0,0 +1,37 @@
+# -*- coding: utf-8 -*-
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""Default configuration for the Airflow webserver"""
+
+import os
+from airflow import configuration as conf
+from flask_appbuilder.security.manager import AUTH_DB
+
+basedir = os.path.abspath(os.path.dirname(__file__))
+
+# The SQLAlchemy connection string.
+SQLALCHEMY_DATABASE_URI = conf.get('core', 'SQL_ALCHEMY_CONN')
+
+# Flask-WTF flag for CSRF
+CSRF_ENABLED = True
+
+# Flask-WTF flag for CSRF
+WTF_CSRF_ENABLED = False
+
+# The authentication type
+AUTH_TYPE = AUTH_DB
\ No newline at end of file
diff --git a/docker/docker-compose-local.yml b/docker/docker-compose-local.yml
new file mode 100644
index 000000000..be440fa76
--- /dev/null
+++ b/docker/docker-compose-local.yml
@@ -0,0 +1,38 @@
+version: '3.7'
+services:
+    postgres:
+        image: postgres:10-alpine
+        environment:
+            - POSTGRES_USER=airflow
+            - POSTGRES_PASSWORD=airflow
+            - POSTGRES_DB=airflow
+        logging:
+            options:
+                max-size: 10m
+                max-file: "3"
+        volumes:
+            - "${PWD}/db-data:/var/lib/postgresql/data"
+
+    local-runner:
+        image: amazon/mwaa-local:1.10
+        restart: always
+        depends_on:
+            - postgres
+        environment:
+            - LOAD_EX=n
+            - EXECUTOR=Local
+        logging:
+            options:
+                max-size: 10m
+                max-file: "3"
+        volumes:
+            - ${PWD}/dags:/usr/local/airflow/dags
+            - ${PWD}/plugins:/usr/local/airflow/plugins
+        ports:
+            - "8080:8080"
+        command: local-runner
+        healthcheck:
+            test: ["CMD-SHELL", "[ -f /usr/local/airflow/airflow-webserver.pid ]"]
+            interval: 30s
+            timeout: 30s
+            retries: 3
diff --git a/docker/docker-compose-resetdb.yml b/docker/docker-compose-resetdb.yml
new file mode 100644
index 000000000..a8ac24ee7
--- /dev/null
+++ b/docker/docker-compose-resetdb.yml
@@ -0,0 +1,32 @@
+version: '3.7'
+services:
+    postgres:
+        image: postgres:10-alpine
+        environment:
+            - POSTGRES_USER=airflow
+            - POSTGRES_PASSWORD=airflow
+            - POSTGRES_DB=airflow
+        logging:
+            options:
+                max-size: 10m
+                max-file: "3"
+        volumes:
+            - "${PWD}/db-data:/var/lib/postgresql/data"
+
+    resetdb:
+        image: amazon/mwaa-local:1.10
+        depends_on:
+            - postgres
+        environment:
+            - LOAD_EX=n
+            - EXECUTOR=Local
+        logging:
+            options:
+                max-size: 10m
+                max-file: "3"
+        volumes:
+            - ${PWD}/dags:/usr/local/airflow/dags
+            - ${PWD}/plugins:/usr/local/airflow/plugins
+        ports:
+            - "8080:8080"
+        command: resetdb
diff --git a/docker/docker-compose-sequential.yml b/docker/docker-compose-sequential.yml
new file mode 100644
index 000000000..5b7b22932
--- /dev/null
+++ b/docker/docker-compose-sequential.yml
@@ -0,0 +1,23 @@
+version: '3.7'
+services:
+    webserver:
+        image: amazon/mwaa-local:1.10
+        restart: always
+        environment:
+            - LOAD_EX=n
+            - EXECUTOR=Sequential
+        logging:
+            options:
+                max-size: 10m
+                max-file: "3"
+        volumes:
+            - ${PWD}/dags:/usr/local/airflow/dags
+            - ${PWD}/plugins:/usr/local/airflow/plugins
+        ports:
+            - "8080:8080"
+        command: webserver
+        healthcheck:
+            test: ["CMD-SHELL", "[ -f /usr/local/airflow/airflow-webserver.pid ]"]
+            interval: 30s
+            timeout: 30s
+            retries: 3
diff --git a/docker/script/bootstrap.sh b/docker/script/bootstrap.sh
new file mode 100644
index 000000000..26909e6f6
--- /dev/null
+++ b/docker/script/bootstrap.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+set -e
+
+# On RHL and Centos based linux, openssl needs to be set as Python Curl SSL library
+export PYCURL_SSL_LIBRARY=openssl
+pip3 install $PIP_OPTION --compile pycurl
+pip3 install $PIP_OPTION celery[sqs]
+
+# install postgres python client
+pip3 install $PIP_OPTION psycopg2
+
+# install minimal Airflow packages
+pip3 install $PIP_OPTION --constraint /constraints.txt apache-airflow[crypto,celery,statsd"${AIRFLOW_DEPS:+,}${AIRFLOW_DEPS}"]=="${AIRFLOW_VERSION}"
+
+# install additional python dependencies
+if [ -n "${PYTHON_DEPS}" ]; then pip3 install $PIP_OPTION "${PYTHON_DEPS}"; fi
+
+# install adduser and add the airflow user
+adduser -s /bin/bash -d "${AIRFLOW_USER_HOME}" airflow
+
+# install watchtower for Cloudwatch logging
+pip3 install $PIP_OPTION watchtower==1.0.1
+
+# Use symbolic link to ensure Airflow 2.0's backport packages are in the same namespace as Airflow itself
+# see https://airflow.apache.org/docs/apache-airflow/stable/backport-providers.html#troubleshooting-installing-backport-packages
+ln -s /usr/local/airflow/.local/lib/python3.7/site-packages/airflow/providers /usr/local/lib/python3.7/site-packages/airflow/providers
+
+# install awscli v2, according to https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2-linux.html#cliv2-linux-install
+zip_file="awscliv2.zip"
+cd /tmp
+curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o $zip_file
+unzip $zip_file
+./aws/install
+rm $zip_file
+rm -rf ./aws
+cd -  # Return to previous directory
+
+# snapshot the packages
+if [ -n "$INDEX_URL" ]
+then
+  pip3 freeze > /requirements.txt
+else
+  # flask-swagger depends on PyYAML that are known to be vulnerable
+  # even though Airflow names flask-swagger as a dependency, it doesn't seem to use it.
+  pip3 uninstall -y flask-swagger
+fi
diff --git a/docker/script/entrypoint.sh b/docker/script/entrypoint.sh
new file mode 100644
index 000000000..0037aef73
--- /dev/null
+++ b/docker/script/entrypoint.sh
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+
+TRY_LOOP="20"
+
+# Global defaults
+: "${AIRFLOW_HOME:="/usr/local/airflow"}"
+: "${AIRFLOW__CORE__FERNET_KEY:=${FERNET_KEY:=$(python -c "from cryptography.fernet import Fernet; FERNET_KEY = Fernet.generate_key().decode(); print(FERNET_KEY)")}}"
+: "${AIRFLOW__CORE__EXECUTOR:=${EXECUTOR:-Sequential}Executor}"
+
+# Load DAGs examples (default: Yes)
+if [[ -z "$AIRFLOW__CORE__LOAD_EXAMPLES" && "${LOAD_EX:=n}" == n ]]; then
+  AIRFLOW__CORE__LOAD_EXAMPLES=False
+fi
+
+export \
+  AIRFLOW_HOME \
+  AIRFLOW__CORE__EXECUTOR \
+  AIRFLOW__CORE__FERNET_KEY \
+  AIRFLOW__CORE__LOAD_EXAMPLES \
+
+# Install custom python package if requirements.txt is present
+install_requirements() {
+    # Install custom python package if requirements.txt is present
+    if [[ -e "$AIRFLOW_HOME/dags/requirements.txt" ]]; then
+        echo "Installing requirements.txt"
+        pip3 install --user -r "$AIRFLOW_HOME/dags/requirements.txt"
+    fi
+}
+
+wait_for_port() {
+  local name="$1" host="$2" port="$3"
+  local j=0
+  while ! nc -z "$host" "$port" >/dev/null 2>&1 < /dev/null; do
+    j=$((j+1))
+    if [ $j -ge $TRY_LOOP ]; then
+      echo >&2 "$(date) - $host:$port still not reachable, giving up"
+      exit 1
+    fi
+    echo "$(date) - waiting for $name... $j/$TRY_LOOP"
+    sleep 5
+  done
+}
+
+# Other executors than SequentialExecutor drive the need for an SQL database, here PostgreSQL is used
+if [ "$AIRFLOW__CORE__EXECUTOR" != "SequentialExecutor" ]; then
+  # Check if the user has provided explicit Airflow configuration concerning the database
+  if [ -z "$AIRFLOW__CORE__SQL_ALCHEMY_CONN" ]; then
+    # Default values corresponding to the default compose files
+    : "${POSTGRES_HOST:="postgres"}"
+    : "${POSTGRES_PORT:="5432"}"
+    : "${POSTGRES_USER:="airflow"}"
+    : "${POSTGRES_PASSWORD:="airflow"}"
+    : "${POSTGRES_DB:="airflow"}"
+    : "${POSTGRES_EXTRAS:-""}"
+
+    AIRFLOW__CORE__SQL_ALCHEMY_CONN="postgresql+psycopg2://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}${POSTGRES_EXTRAS}"
+    export AIRFLOW__CORE__SQL_ALCHEMY_CONN
+  else
+    # Derive useful variables from the AIRFLOW__ variables provided explicitly by the user
+    POSTGRES_ENDPOINT=$(echo -n "$AIRFLOW__CORE__SQL_ALCHEMY_CONN" | cut -d '/' -f3 | sed -e 's,.*@,,')
+    POSTGRES_HOST=$(echo -n "$POSTGRES_ENDPOINT" | cut -d ':' -f1)
+    POSTGRES_PORT=$(echo -n "$POSTGRES_ENDPOINT" | cut -d ':' -f2)
+  fi
+
+  wait_for_port "Postgres" "$POSTGRES_HOST" "$POSTGRES_PORT"
+fi
+
+
+case "$1" in
+  local-runner)
+    install_requirements
+    airflow initdb
+    if [ "$AIRFLOW__CORE__EXECUTOR" = "LocalExecutor" ] || [ "$AIRFLOW__CORE__EXECUTOR" = "SequentialExecutor" ]; then
+      # With the "Local" and "Sequential" executors it should all run in one container.
+      airflow scheduler &
+      sleep 2
+    fi
+    airflow create_user -r Admin -u admin -e admin@example.com -f admin -l user -p test
+    exec airflow webserver
+    ;;
+  resetdb)
+    airflow resetdb -y
+    sleep 2
+    airflow initdb
+    ;;
+  test-requirements)
+    install_requirements
+    ;;
+  *)
+    # The command is something like bash, not an airflow subcommand. Just run it in the right environment.
+    exec "$@"
+    ;;
+esac
diff --git a/docker/script/systemlibs.sh b/docker/script/systemlibs.sh
new file mode 100644
index 000000000..e86f267b8
--- /dev/null
+++ b/docker/script/systemlibs.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+yum update -y
+
+# install basic python environment
+yum install -y python37 gcc gcc-g++ python3-devel
+
+# JDBC and Java dependencies
+yum install -y java-1.8.0-openjdk unixODBC-devel 
+
+# Database clients
+yum install -y mariadb-devel postgresql-devel
+
+# Archiving Libraries
+yum install -y zip unzip bzip2 gzip
+
+# Airflow extras
+yum install -y gcc-c++ cyrus-sasl-devel libcurl-devel openssl-devel shadow-utils
+
+#### Required Libraries for entrypoint.sh script
+
+# jq is used to parse ECS-injected AWSSecretsManager secrets
+yum install -y jq
+
+# nc is used to check DB connectivity
+yum install -y nc
+
+# Needed for generating fernet key for local runner
+yum install -y python2-cryptography
+
+# Install additional system library dependencies. Provided as a string of libraries separated by space
+if [ -n "${SYSTEM_DEPS}" ]; then yum install -y "${SYSTEM_DEPS}"; fi
+
+yum clean all
\ No newline at end of file
diff --git a/mwaa-local-env b/mwaa-local-env
new file mode 100755
index 000000000..18271c102
--- /dev/null
+++ b/mwaa-local-env
@@ -0,0 +1,86 @@
+#!/bin/bash
+
+AIRFLOW_VERSION=1.10
+
+display_help() {
+   # Display Help
+   echo "======================================"
+   echo "   MWAA Local Runner CLI"
+   echo "======================================"
+   echo "Syntax: mwaa-local-runner [command]"
+   echo
+   echo "---commands---"
+   echo "help                   Print CLI help"
+   echo "build-image            Build Image Locally"
+   echo "reset-db               Reset local PostgresDB container."
+   echo "start                  Start Airflow local environment. (LocalExecutor, Using postgres DB)"
+   echo "test-requirements      Install requirements on an ephemeral instance of the container."
+   echo "validate-prereqs       Validate pre-reqs installed (docker, docker-compose, python3, pip3)"
+   echo
+}
+
+validate_prereqs() {
+   docker -v >/dev/null 2>&1
+   if [ $? -ne 0 ]; then
+      echo -e "'docker' is not installed or not runnable without sudo. \xE2\x9D\x8C"
+   else
+      echo -e "Docker is Installed. \xE2\x9C\x94"
+   fi
+
+   docker-compose -v >/dev/null 2>&1
+   if [ $? -ne 0 ]; then
+      echo -e "'docker-compose' is not installed. \xE2\x9D\x8C"
+   else
+      echo -e "Docker compose is Installed. \xE2\x9C\x94"
+   fi
+
+   python3 --version >/dev/null 2>&1
+   if [ $? -ne 0 ]; then
+      echo -e "Python3 is not installed. \xE2\x9D\x8C"
+   else
+      echo -e "Python3 is Installed \xE2\x9C\x94"
+   fi
+
+   pip3 --version >/dev/null 2>&1
+   if [ $? -ne 0 ]; then
+      echo -e "Pip3 is not installed. \xE2\x9D\x8C"
+   else
+      echo -e "Pip3 is Installed. \xE2\x9C\x94"
+   fi
+}
+
+build_image() {
+   docker build --rm --compress -t amazon/mwaa-local:1.10 ./docker
+}
+
+case "$1" in
+validate-prereqs)
+   validate_prereqs
+   ;;
+test-requirements)
+   BUILT_IMAGE=$(docker images -q amazon/mwaa-local:$AIRFLOW_VERSION)
+   if [[ -n "$BUILT_IMAGE" ]]; then
+     echo "Container amazon/mwaa-local:$AIRFLOW_VERSION exists. Skipping build"
+   else
+     echo "Container amazon/mwaa-local:$AIRFLOW_VERSION not built. Building locally."
+     build_image
+   fi
+   docker run -v $(pwd)/dags:/usr/local/airflow/dags -it amazon/mwaa-local:$AIRFLOW_VERSION test-requirements
+   ;;
+build-image)
+   build_image
+   ;;
+reset-db)
+   docker-compose -f ./docker/docker-compose-resetdb.yml up
+   ;;
+start)
+   docker-compose -f ./docker/docker-compose-local.yml up
+   ;;
+help)
+   display_help
+   ;;
+*)
+   echo "No command specified, displaying help"
+   display_help
+   ;;
+esac