Agreed, Pip isn't to blame, treating `pip install -r requirements.txt` as one's sole dependency management is. You can choose to build your own dependency mana

Agreed, Pip isn't to blame, treating `pip install -r requirements.txt` as one's sole dependency management is. You can choose to build your own dependency management practice around pip, or use one someone else has already created. I think that it is easier to get a team on the same page with something like Poetry, especially if they're used to bundler or npm. You're right about the docker containers as well, but upstream does what it wants and downstream has a strong tendency to not mess with upstream's choices.