I needed to rebuild the image for arm64.
Among others, Poetry depends on pyrsistent, msgpack, and cryptography packages, and these don’t have wheels for arm64 -- so they need a compile step themselves -- but python:3.8-slim doesn’t include gcc.
My first attempt was to change the first-stage to RUN apt update && install -y –no-install-recommends build-essential libssl-dev libffi-dev python3-dev && pip3 install poetry && apt remove –y –purge build-essential libssl-dev libffi-dev python3-dev. I verified that this allowed Poetry itself to be built.
NOTE: for some reason apt install python3-dev selected python3.7-dev from the archives, although the base image is called python:3.8.
Invoking Poetry would then also need GCC for some other package, and at that point I figured a smaller and more maintainable change would be to use the non-slim image for the initial stage; this appears to include the libffi and openssl headers, along with GCC and whatever's needed to compile a wheel in arm64.
I reckon the disk space from apt install build-essential is in the ballpark of using the full python:3.8 image anyway, and doing this saves having to debug why apt install was selecting 3.7-dev and didn't have 3.8.