Can the image dependencies for an offline/air-gapped Phoenix deployment be simplified?

[ToWorld]

The official build pipeline depends on 4 external images — node:22-slim, ghcr.io/astral-sh/uv, gcr.io/distroless/python3, and denoland/deno — plus a WASM binary downloaded from GitHub releases. In a fully air-gapped environment, each of these artifacts has to be mirrored manually, which is operationally costly.
In our testing, simply running pip install arize-phoenix[container,pg] from the published PyPI wheel provides full functionality (the UI static assets are bundled in the wheel) on top of a plain python:3.13 base image. We'd like to confirm:

1. Is installing from the PyPI wheel a supported offline deployment path?
2. Are the deno + WASM binaries only required for the sandbox feature (running user-defined functions in experiments/evals)? Can they be omitted if that feature is unused?
3. Is there an official "offline deployment bill of materials" we can reference?

[anticorrelator]

The wheel includes the UI, and Deno and the WASM binary are only used by the local sandboxes that run code evaluators, so pip install arize-phoenix[container,pg] is a supported path. If mirroring one artifact is easier, the published arizephoenix/phoenix: image bundles both runtimes and works offline.

Right now, we try to download the WASM binary at startup but if that's blocked by a firewall it'll time out before the server starts.

To avoid this: provide the binary copy in python-3.12.0.wasm, check its SHA-256 (e5dc5a398b07b54ea8fdb503bf68fb583d533f10ec3f930963e02b9505f7a763), and point PHOENIX_WASM_BINARY_PATH at it.

Also set PHOENIX_ALLOW_EXTERNAL_RESOURCES=false to turn off Google Fonts, telemetry, etc.

We're planning to make the WASM download respect PHOENIX_ALLOW_EXTERNAL_RESOURCES, so that flag alone will stop it. At the moment there's no formal offline bill of materials beyond the SBOM attached to each published image (docker buildx imagetools inspect arizephoenix/phoenix: --format '{{ json .SBOM }}')

Sorry about that @ToWorld, I'll mention this discussion in the PR that fixes this too

[anticorrelator]

@ToWorld the external resources flag is now respected for the sandbox requirements in #16639