Pull the manylinux2014 docker image into IREE. (#8941)

This was being managed in a separate repo and used to have some exotic
things that needed to be done to make bazel work. Now, though, it is
formulamatic, so we just include it in our normal setup.

This also moves the TBB library install into the docker build (it was
being done at release time) in order to satisfy Tracy deps.
diff --git a/.github/workflows/build_package.yml b/.github/workflows/build_package.yml
index 3301a2e..0ecc424 100644
--- a/.github/workflows/build_package.yml
+++ b/.github/workflows/build_package.yml
@@ -59,7 +59,7 @@
             build_package: py-runtime-pkg
             experimental: true
     env:
-      MANYLINUX_X86_64_IMAGE: stellaraccident/manylinux2014_x86_64-bazel-5.1.0:latest
+      MANYLINUX_X86_64_IMAGE: gcr.io/iree-oss/manylinux2014_x86_64-release@sha256:3e7ac081b69bdc54650a98725b793f072f3c3beb229f8886dbcd6f23bc1eb9ca
 
     steps:
       - uses: actions/checkout@v2
diff --git a/build_tools/docker/base/Dockerfile b/build_tools/docker/base/Dockerfile
index d03da41..5d4a35d 100644
--- a/build_tools/docker/base/Dockerfile
+++ b/build_tools/docker/base/Dockerfile
@@ -69,6 +69,10 @@
 
 ######## Bazel ########
 WORKDIR /install-bazel
+# Making a required Bazel version change? Most images derive from this one
+# and will get it automatically. However these don't. Please update them as
+# well:
+#   manylinux2014_x86_64-release
 ARG BAZEL_VERSION=5.1.0
 
 # https://bazel.build/install/ubuntu
diff --git a/build_tools/docker/manage_images.py b/build_tools/docker/manage_images.py
index 04268da..c362d74 100755
--- a/build_tools/docker/manage_images.py
+++ b/build_tools/docker/manage_images.py
@@ -43,6 +43,7 @@
 # Map from image names to images that they depend on.
 IMAGES_TO_DEPENDENCIES = {
     'base': [],
+    'manylinux2014_x86_64-release': [],
     'android': ['base'],
     'emscripten': ['base'],
     'nvidia': ['base'],
diff --git a/build_tools/docker/manylinux2014_x86_64-release/Dockerfile b/build_tools/docker/manylinux2014_x86_64-release/Dockerfile
new file mode 100644
index 0000000..4cc7e9d
--- /dev/null
+++ b/build_tools/docker/manylinux2014_x86_64-release/Dockerfile
@@ -0,0 +1,52 @@
+# Copyright 2022 The IREE Authors
+#
+# Licensed under the Apache License v2.0 with LLVM Exceptions.
+# See https://llvm.org/LICENSE.txt for license information.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+# This is derived from a stock manylinux2014 image, based on CentOS 7.
+# It does not derive from any of our other images and contains sufficient
+# software to build release packages for that OS. Note that the upstream
+# images are patched regularly with backports from RedHat and have relatively
+# recent dev tooling and Python versions. Bump the base hash to get Python
+# and dev tooling upgrades.
+#
+# This line of images is EOL on June 30, 2024. Prior to that, we should upgrade
+# to a newer revision. Newer manylinux images are based on Debian.
+#
+# Refer to: https://github.com/pypa/manylinux
+FROM quay.io/pypa/manylinux2014_x86_64@sha256:9b463efac479efbcab6dec77eca28c5cfa0c5ef64f13ac184eb7117dc1f8edda
+
+USER root
+
+######## Pre-requisite packages ########
+# Add RHEL7 CUDA repo.
+RUN yum-config-manager --add-repo \
+  https://developer.download.nvidia.com/compute/cuda/repos/rhel7/x86_64/cuda-rhel7.repo
+RUN yum install -y \
+  cuda-nvcc-11-6 cuda-cudart-devel-11-6 cuda-cupti-11-6 \
+  java-11-openjdk-devel \
+  ccache \
+  capstone-devel libzstd-devel
+
+######## Bazel ########
+# Bazel requires Java.
+ARG BAZEL_VERSION=5.1.0
+RUN curl -fsSL \
+  https://github.com/bazelbuild/bazel/releases/download/${BAZEL_VERSION}/bazel-${BAZEL_VERSION}-linux-x86_64 \
+  -o /usr/local/bin/bazel \
+  && chmod a+x /usr/local/bin/bazel \
+  && /usr/local/bin/bazel --version
+
+# See: https://github.com/bazelbuild/bazel/issues/10327
+# Note also that many things that link fine on newer OS's seem to fail based
+# on missing -lm, so just adding here.
+ENV BAZEL_LINKOPTS ""
+ENV BAZEL_LINKLIBS "-lstdc++ -lm"
+
+######## TBB ########
+# TBB is a dependency of Tracy and there is not a packaged source for a versoin
+# that is compatible with the STL shipped on this OS. So we use a script to
+# fetch/build/install exactly what is needed.
+COPY install_tbb_manylinux2014.sh /usr/local/bin
+RUN bash /usr/local/bin/install_tbb_manylinux2014.sh
diff --git a/build_tools/github_actions/install_tbb_manylinux2014.sh b/build_tools/docker/manylinux2014_x86_64-release/install_tbb_manylinux2014.sh
similarity index 100%
rename from build_tools/github_actions/install_tbb_manylinux2014.sh
rename to build_tools/docker/manylinux2014_x86_64-release/install_tbb_manylinux2014.sh
diff --git a/build_tools/docker/prod_digests.txt b/build_tools/docker/prod_digests.txt
index 9a7de63..4a08617 100644
--- a/build_tools/docker/prod_digests.txt
+++ b/build_tools/docker/prod_digests.txt
@@ -9,3 +9,4 @@
 gcr.io/iree-oss/nvidia@sha256:44c61c9db49792a1bf6bb6337b602f78c867f6ff136ddb25e71ef323d5b19c95
 gcr.io/iree-oss/emscripten@sha256:eaf9d11499f5763a4e5ea85260a2b03e4494ecef68abe71dbf06b7e3a1e5f5ba
 gcr.io/iree-oss/android@sha256:64492d86ba72328fdf21e462244e52edd54b960c125c37a21960baf65ee4c654
+gcr.io/iree-oss/manylinux2014_x86_64-release@sha256:3e7ac081b69bdc54650a98725b793f072f3c3beb229f8886dbcd6f23bc1eb9ca
diff --git a/build_tools/github_actions/install_tracy_cli_deps_manylinux2014.sh b/build_tools/github_actions/install_tracy_cli_deps_manylinux2014.sh
deleted file mode 100755
index 2eda736..0000000
--- a/build_tools/github_actions/install_tracy_cli_deps_manylinux2014.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash
-# Copyright 2021 The IREE Authors
-#
-# Licensed under the Apache License v2.0 with LLVM Exceptions.
-# See https://llvm.org/LICENSE.txt for license information.
-# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-# Installs deps on a manylinux2014 CentOS docker container needed for
-# building Tracy CLI capture tool.
-
-set -e
-
-td="$(cd $(dirname $0) && pwd)"
-yum -y install capstone-devel libzstd-devel
-$td/install_tbb_manylinux2014.sh
diff --git a/build_tools/python_deploy/build_linux_packages.sh b/build_tools/python_deploy/build_linux_packages.sh
index ac148ac..33dcbad 100755
--- a/build_tools/python_deploy/build_linux_packages.sh
+++ b/build_tools/python_deploy/build_linux_packages.sh
@@ -43,7 +43,7 @@
 script_name="$(basename $0)"
 repo_root="$(cd $this_dir/../../ && pwd)"
 script_name="$(basename $0)"
-manylinux_docker_image="${manylinux_docker_image:-stellaraccident/manylinux2014_x86_64-bazel-5.1.0:latest}"
+manylinux_docker_image="${manylinux_docker_image:-gcr.io/iree-oss/manylinux2014_x86_64-release@sha256:3e7ac081b69bdc54650a98725b793f072f3c3beb229f8886dbcd6f23bc1eb9ca}"
 python_versions="${override_python_versions:-cp37-cp37m cp38-cp38 cp39-cp39 cp310-cp310}"
 output_dir="${output_dir:-${this_dir}/wheelhouse}"
 packages="${packages:-iree-runtime iree-runtime-instrumented iree-compiler}"
@@ -119,15 +119,6 @@
 }
 
 function build_iree_runtime_instrumented() {
-  tracy_installed_touch="/.tracy_installed"
-  if ! [ -f "$tracy_installed_touch" ]; then
-    echo "Installing tracy deps..."
-    bash /main_checkout/iree/build_tools/github_actions/install_tracy_cli_deps_manylinux2014.sh
-    touch "$tracy_installed_touch"
-  else
-    echo "Tracy deps already installed..."
-  fi
-
   IREE_HAL_DRIVER_CUDA=ON IREE_BUILD_TRACY=ON IREE_ENABLE_RUNTIME_TRACING=ON \
   IREE_RUNTIME_CUSTOM_PACKAGE_SUFFIX="-instrumented" \
   python -m pip wheel -v -w /wheelhouse /main_checkout/iree/runtime/