4 ms·

Given that you guys are in charge of both uv and rye, why keep two alive at the same time? Why not just kill rye now to avoid fragmentation, and confusion that

by pen2l 2y ago

Given that you guys are in charge of both uv and rye, why keep two alive at the same time? Why not just kill rye now to avoid fragmentation, and confusion that comes with the burden of having to choose between the two?

rfoo 2y ago
IIUC, uv is a replacement for pip (?), and rye is for pyenv+poetry.
- baggiponte 2y ago
  In the end, uv will be the pyenv + poetry replacement, and supersede rye.
  - Joeboy 2y ago
    So which should I use for a new project, as of July 2024?
    - sali0 2y ago
      Rye is perfectly fine to use as of now. It uses uv under the hood anyway, but has some niceties of its own.
      - remram 2y ago
        For example?
    - PufPufPuf 2y ago
      Poetry.
    - VagabundoP 2y ago
      I would.
    - kzrdude 2y ago
      I would use Uv - if you can handle that it's a moving target right now. (uv python, uv lock, uv sync and so on, and in pyproject tool.uv.sources). All preview features that replace similar Rye features with a more robust implementation.
the_mitsuhiko 2y ago
UV doesn’t do all these things yet. The end goal is that UV can fully replace Rye and a neat migration will be provided so that one can move over. Since Rye already uses uv behind the scenes there won’t be a lot of incompatibilities to deal with so the migration should be trivial.
- semi-extrinsic 2y ago
  I love Rye, especially with UV, and we are rolling it out where I work. Question: are there any plans to add sandboxing support to Rye or UV? I realize it is a big ask and that it might not be possible on all platforms. My dream scenario is that I can define a section in pyproject.toml that goes like [sandbox] allowed_urls = [...] allowed_dirs = [".",...] and then "rye run" wraps the executed code in a sandbox which forbids the code to access anything outside those two whitelists. This would make me sleep so much better at night, as it solves 99% of my supply chain attack fears. And it's lightweight enough from the user side that it will actually be used.
  - VWWHFSfQ 2y ago
    Is there a technology in existence that would facilitate this from userspace and wouldn't require elevated kernel privileges to set caps?
    - semi-extrinsic 2y ago
      From my cursory googling, I believe seccomp on Linux is one way to achieve this. See e.g. Cloudflare's "sandbox" wrapper: https://github.com/cloudflare/sandbox https://github.com/cloudflare/sandbox FWICT, it's not possible to achieve something like this reliably on Windows natively, but maybe in WSL it could work. On Mac, there is the similar libsecinit aka App Sandbox which also can be spawned from a userspace process, I think? Of course in every case the program spawning the sandbox has to be outside the sandbox. But having to trust Rye or UV is much better than having to trust thousands of "RandomDevsNichePythonPackage".
  - the_mitsuhiko 2y ago

by pen2l 2y ago

rfoo 2y ago

IIUC, uv is a replacement for pip (?), and rye is for pyenv+poetry.

baggiponte 2y ago
In the end, uv will be the pyenv + poetry replacement, and supersede rye.
- Joeboy 2y ago
  So which should I use for a new project, as of July 2024?
  - sali0 2y ago
    Rye is perfectly fine to use as of now. It uses uv under the hood anyway, but has some niceties of its own.
    - remram 2y ago
      For example?
  - PufPufPuf 2y ago
    Poetry.
  - VagabundoP 2y ago
    I would.
  - kzrdude 2y ago
    I would use Uv - if you can handle that it's a moving target right now. (uv python, uv lock, uv sync and so on, and in pyproject tool.uv.sources). All preview features that replace similar Rye features with a more robust implementation.

the_mitsuhiko 2y ago

UV doesn’t do all these things yet. The end goal is that UV can fully replace Rye and a neat migration will be provided so that one can move over. Since Rye already uses uv behind the scenes there won’t be a lot of incompatibilities to deal with so the migration should be trivial.

semi-extrinsic 2y ago
I love Rye, especially with UV, and we are rolling it out where I work. Question: are there any plans to add sandboxing support to Rye or UV? I realize it is a big ask and that it might not be possible on all platforms. My dream scenario is that I can define a section in pyproject.toml that goes like [sandbox] allowed_urls = [...] allowed_dirs = [".",...] and then "rye run" wraps the executed code in a sandbox which forbids the code to access anything outside those two whitelists. This would make me sleep so much better at night, as it solves 99% of my supply chain attack fears. And it's lightweight enough from the user side that it will actually be used.
- VWWHFSfQ 2y ago
  Is there a technology in existence that would facilitate this from userspace and wouldn't require elevated kernel privileges to set caps?
  - semi-extrinsic 2y ago
    From my cursory googling, I believe seccomp on Linux is one way to achieve this. See e.g. Cloudflare's "sandbox" wrapper: https://github.com/cloudflare/sandbox https://github.com/cloudflare/sandbox FWICT, it's not possible to achieve something like this reliably on Windows natively, but maybe in WSL it could work. On Mac, there is the similar libsecinit aka App Sandbox which also can be spawned from a userspace process, I think? Of course in every case the program spawning the sandbox has to be outside the sandbox. But having to trust Rye or UV is much better than having to trust thousands of "RandomDevsNichePythonPackage".
- the_mitsuhiko 2y ago