Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use `Python -m Pip`

snarky.ca

Post reply on HN
Print view View original

131–140 of 141 posts

Re: Use `Python -m Pip`

#131

Post by jefurii »

gammalost wrote: post #8

Python is a fun language but the ecosystem around it is horrible. It's a shame. I just want to pip install like I would a package manager

I think this has become a meme.

It's true that people have made a lot of different ways to install Python packages. Each of these people has an axe to grind and they have supporters who are trying to boost their preferred solution and keep people away from the others. That part really is a mess.

The standard virtualenv+pip has always been rock solid for me. Maybe this is because I do all my development inside virtualenvs and I only ever use pip inside a venv. And I run Linux, though I do ship my Python code to a fleet of servers.

Sometimes I think maybe this Python-ecosystem-is-horrible stuff comes from people who are trying to steer people away from Python towards their preferred language.

Re: Use `Python -m Pip`

#132

Post by romanows »

jwilk wrote: post #123
romanows wrote: post #73

Earlier quoted context omitted.

The second thing. Python includes the current working directory first in the module search path. It leads to the above issue and occasionally some a tricky debugging problem.

If you run a script, such as "pip", sys.path[0] is the script's directory, not cwd: https://docs.python.org/3/using/cmdline.html > If the script name refers directly to a Python file, the directory containing that file is added to the start of sys.path

You are right! I missed the switch from talking about the `python -m`-style invocation versus the `python `-style invocation.

(Should I double down and attribute it to difficulties with how significant whitespace indentation can make it hard to determine the scope (of the comment threading on mobile)? :P)

Re: Use `Python -m Pip`

#133

Post by gjvc »

eslaught wrote: post #130
gjvc wrote: post #27

Earlier quoted context omitted.

"pip freeze" generates a versioned list of packages to install in the same format as requirements.txt -- in this example below i've called it versions.txt. I have a bash wrapper "bin/venv-create" which essentially does this python3 -m venv .venv/ if [[ -f versions.txt ]] && [[ versions.txt -nt requirements.txt ]]; then pip install --requirement versions.txt else pip install --requirement requirements.txt pip freeze >…

Thanks, I appreciate this. I don't think this practice is widespread, which is exactly why I made a point about human engineering in my original post. But I do appreciate that solutions like this exist, and I should look into driving more of this sort of thing in my projects.

the blog post is missing a link to the template github repo; i'll fix that

Re: Use `Python -m Pip`

#134

Post by kstrauser »

0x008 wrote: post #120
kstrauser wrote: post #28

Earlier quoted context omitted.

I have: $ cat ~/.pip/pip.conf [global] require-virtualenv = true ...which makes pip refuse to install anything unless I'm in an activated virtualenv. That, plus running as a regular user that doesn't have write permission to /usr, goes a long way.

then you cannot upgrade pip :D

I do sometimes have to disable that, but at least then it's because I'm very deliberately doing it for a specific reason.

But if you're in a virtualenv, you can use the venv's pip to upgrade the venv's pip. :-)

Re: Use `Python -m Pip`

#135

Post by JadeNB »

I know we editorialize titles, but the actual title is "why you shouldn't use `python -m pip`". Setting aside the strange capitalization, this still seems like a big change.

Re: Use `Python -m Pip`

#136

Post by okasaki »

bloblaw wrote: post #128
okasaki wrote: post #106

Earlier quoted context omitted.

Virtualenvs are no worse than static linking, or packaging dlls/sos, all very common practice (and even recommended). Python package management is VERY easy.

When I statically compile a C++ or Go binary, I end up with something I can copy and execute on any platform for which it was compiled for. Single file. Copy and run. Virtualenvs require every single target to reproduce your dev environment: (1) have internet access and able to reach pypi (or artifactory, or whatever you use). (2) the ability to install the required version of Python if it isn't already installed. Th…

I mean in the sense that you're bundling your dependencies with your program. This is well established, Python isn't special.

Obviously Python is (usually) an interpreted language, so you're going to need Python on user system. If that's a problem Python might not be for you, or you're going to need to do some extra work.

It can be done. For example the popular visual novel software Ren'Py is written in Python.

Re: Use `Python -m Pip`

#137

Post by jjnoakes »

danudey wrote: post #74
jjnoakes wrote: post #63

Earlier quoted context omitted.

Do you mean there might be a 'pip' command in the local directory that might get called by accident, or do you mean the real python pip command might load a python module from the local directory by accident?

Windows' cmd.exe is the only shell I'm aware of that (by default) checks the local directory for executables before the actual PATH variable, so I wouldn't consider that a real problem. The 'local directory' one is the actual concern. For example, our CI system for one of our tools runs commands like `pip install -U setuptools`. If we switched it to `python -m pip install -U setuptools`, it would continue to work fin…

Did you reply to the right comment? I was looking for clarification on a comment made when discussing running pip directly, as a full path to the pip executable, and not via "python -m pip ...".

Re: Use `Python -m Pip`

#138

Post by SAI_Peregrinus »

bloblaw wrote: post #46
xdfgh1112 wrote: post #37

Earlier quoted context omitted.

I'm relatively new to python. I use venv, pip and requirements.txt. It's dead simple. What am I missing?

The fact that the suggested solution in Python is to give every Python script a full copy of an entire specific Python runtime (via venv) is a mild annoyance as a design pattern... to me . Python scripting today requires shipping your development environment. Python is wonderful until you want to run that code on another machine. At that point, the target system has to venv their way into reproducing your environment…

`pyinstaller --onefile [secondscript.py] [...]`

Statically links all the dependencies and the Python interpreter. Other machine can just run the executable, no need to set up a venv+pip.

Of course the binary is huge, but IME it works. Unfortunately it can't cross-build, so you need a VM or multiple machines set up with the dev environment to run pyinstaller for each OS.

Re: Use `Python -m Pip`

#139

Post by hauntsaninja »

jwilk wrote: post #17

Beware that "python -m" is insecure in untrusted cwd: https://bugs.python.org/issue33053 E.g.: $ echo 'import os; os.execvp("cowsay", ["-", "pwned"])' > pip.py $ python -m pip --version _______ ------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||

In Python 3.11, you can use the "-P" flag or the "PYTHONSAFEPATH" environment variable to avoid adding cwd to sys.path

https://docs.python.org/3.11/whatsnew/3.11.html#summary-rele...

Post reply on HN