4 ms·
In that case, it's better to just pin the major version of the container: FROM python:3 will work as long as Python3 doesn't make any backwards incompatib
by bheadmaster 5y ago
In that case, it's better to just pin the major version of the container:
FROM python:3
will work as long as Python3 doesn't make any backwards incompatible changes (note: Python3 occasionally deprecates then removes a feature that was part of the official API[0], so Python3 is not technically semver-correct).
If, however, one wants automatic updates WITH reproducible builds, then a CI/CD pipeline that automatically updates the FROM line in a Dockerfile on every upstream release is an only solution.
[0] https://docs.python.org/3.10/whatsnew/3.10.html#removed https://docs.python.org/3.10/whatsnew/3.10.html#removed
- thejosh 5y agothis works great until a library decides it only likes python 3.8 or 3.9 or 3.10 and won't work with 3.10.
- Kwpolska 5y agoPython never claimed to be semver-compliant. Also, if you’re using 3rd-party packages that require compiling stuff (eg. numpy), pre-built binary packages (aka wheels) might not be available on PyPI in the first few days (or weeks, or sometimes even months) after Python 3.x.0 is released, so you don’t want the version to be randomly changed under you. Moreover, I pulled python:3 a year ago, so I get 3.9. FROM python:3.10 should generally be fine though.
- oefrha 5y agoThis is very bad advice. Lots of nontrivial things aren't automatically compatible with the latest Python minor version. PyTorch for instance doesn't support Python 3.10 and it's been five months since the stable release (ten months since the first beta). For anything nontrivial, you almost always want to specify a minor Python version.
- deleted 5y ago[deleted]
- paskozdilar 5y agoWhy is this bad advice? The PyTorch scenario is an exception, not the rule, and the users of PyTorch should know not to use unsupported versions. > For anything nontrivial, you almost always want to specify a minor Python version. Depends on how you define "trivial".
- chomp 5y agoIt’s non-optimal advice because PyTorch is not the only library that runs into problems like this, because Python does not follow semver. You should pin to an X.Y release, and let .Z releases update automatically (which is where your security updates fall)