4 ms·

It is best practice, but you probably don’t need virtualenv if you’re deploying a single application in a docker container.

brummm 7y ago
Messing with the system python without using some form of virtual environment is a recipe for disaster.
- dkarp 7y ago
  It's a docker box, you're already inside some form of virtual environment
- kevin_thibedeau 7y ago
  Debian distros have a separate dist-packages directory for system libs. You can do whatever you want in site-packages. It is effectively like a default virtualenv when operating in a container.
- penagwin 7y ago
  In the docker container you ARE the system python version. In fact many docker best practices would say that preferably only 1 application is running, and that would be your application.
  - viraptor 7y ago
    It's still not safe. For example there was a conflict one day between awscli, urllib and some system tool (apt?) which led to a broken (apt fails) system if you just "pip install awscli" globally. Even in docker image, you still need virtualenv to be safe (or use only global distro packages).
    - fjp 7y ago
      Could you elaborate on why? I worked at a co that almost exclusively ran Alpine containers with a single Python app. No use of virtualenv. Never experienced any hangups with this.
      - viraptor 7y ago
        Looked up the issue and it was cloud-init, not apt that failed. Here are the details: https://github.com/aws/aws-cli/issues/3678 https://github.com/aws/aws-cli/issues/3678 In one sentence: "Installing the latest aws-cli on an image is preventing new AMIs based on that image from booting due to the above issue with urllib3." While this specific issue wouldn't affect docker images since you normally don't run cloud-init on them, it's just luck that it wasn't some other utility affected instead. Next time it can affect docker images too.
        kortilla 7y ago
        Why do you have cloud-init in a container?
      - markbnj 7y ago
        Same here, and I'm curious to know why some think virtualenv is required in a container, as opposed to just starting with am image containing a clean python install and adding what you need.
        viraptor 7y ago
        I linked the example here https://news.ycombinator.com/item?id=22186046 https://news.ycombinator.com/item?id=22186046 But tlrd is: if you "apt install some-utility", then "pip install something else", you may have upgraded packages that some-utility relies on but is not compatible with the new version anymore.
        mixmastamyk 7y ago
        Pip and apt install to different folders already. In the very unlikely event there’s an issue in a container the solution is simple, modify the sys.path. The other 99% of the time avoiding the venv is a win.
- pid_0 7y ago
  Not in docker. The entire point of docker is isolation so when you use something like python3.7-slim, its fine to use the system python. Thats the whole point of using the image. Now you still want to run and install pip packages as a non-root user of course, but you don't need a virtualenv in docker.

brummm 7y ago

Messing with the system python without using some form of virtual environment is a recipe for disaster.

dkarp 7y ago
It's a docker box, you're already inside some form of virtual environment
kevin_thibedeau 7y ago
Debian distros have a separate dist-packages directory for system libs. You can do whatever you want in site-packages. It is effectively like a default virtualenv when operating in a container.
penagwin 7y ago
In the docker container you ARE the system python version. In fact many docker best practices would say that preferably only 1 application is running, and that would be your application.
- viraptor 7y ago
  It's still not safe. For example there was a conflict one day between awscli, urllib and some system tool (apt?) which led to a broken (apt fails) system if you just "pip install awscli" globally. Even in docker image, you still need virtualenv to be safe (or use only global distro packages).
  - fjp 7y ago
    Could you elaborate on why? I worked at a co that almost exclusively ran Alpine containers with a single Python app. No use of virtualenv. Never experienced any hangups with this.
    - viraptor 7y ago
      Looked up the issue and it was cloud-init, not apt that failed. Here are the details: https://github.com/aws/aws-cli/issues/3678 https://github.com/aws/aws-cli/issues/3678 In one sentence: "Installing the latest aws-cli on an image is preventing new AMIs based on that image from booting due to the above issue with urllib3." While this specific issue wouldn't affect docker images since you normally don't run cloud-init on them, it's just luck that it wasn't some other utility affected instead. Next time it can affect docker images too.
      - kortilla 7y ago
        Why do you have cloud-init in a container?
    - markbnj 7y ago
      Same here, and I'm curious to know why some think virtualenv is required in a container, as opposed to just starting with am image containing a clean python install and adding what you need.
      - viraptor 7y ago
        I linked the example here https://news.ycombinator.com/item?id=22186046 https://news.ycombinator.com/item?id=22186046 But tlrd is: if you "apt install some-utility", then "pip install something else", you may have upgraded packages that some-utility relies on but is not compatible with the new version anymore.
        mixmastamyk 7y ago
        Pip and apt install to different folders already. In the very unlikely event there’s an issue in a container the solution is simple, modify the sys.path. The other 99% of the time avoiding the venv is a win.
pid_0 7y ago
Not in docker. The entire point of docker is isolation so when you use something like python3.7-slim, its fine to use the system python. Thats the whole point of using the image. Now you still want to run and install pip packages as a non-root user of course, but you don't need a virtualenv in docker.