4 ms·
Many popular Python libraries are available as Debian packages. Replacing pip/virtualenv dependencies with their distro-packaged equivalents firmly ties your p
by jefurii 4y ago
Many popular Python libraries are available as Debian packages. Replacing pip/virtualenv dependencies with their distro-packaged equivalents firmly ties your projects to your distro and comes with other issues, but could also mean nearly automated updates for security patches.
Advantages:
1. Security patches for free with distro package updates.
2. More consistency of dependency versions across projects.
3. Dependencies won't fall too far behind.
4. Major upgrades only need to happen with new distro release.
Disadvantages:
1. Less control over dependency versions - can't lock to specific versions. May be forced to upgrade when security patches drop.
2. Not getting the very latest versions - your distro e.g. Debian Stable is often a bit behind.
3. Having to upgrade everything at once with a new distro release.
4. Can't run apps with different versions of dependency on same VM.
5. App will be closely tied to a particular release of your distro.
Mitigations of disadvantages:
1. Distros like Debian are pretty good about fixing security issues without affecting functionality/APIs.
2. If you like "boring" tech more than bleeding-edge this may not be a problem. You'd be insulated from version churn, while a major distro's install numbers will hopefully bring stability.
1,2. You can still use virtualenv for certain dependencies if you absolutely have to have the latest version or lock at an old version.
3. Distros like Debian keep their old releases around for awhile and the upgrade window is pretty long.
4. If you run apps in own their own VMs that removes a major need for virtualenv in the first place.
- physicsguy 4y agoAnother disadvantage: the specific package you want might not be packaged by your distro, and may not be compatible with the versions of dependencies that your distro does package.