Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One does not simply 'pip install'

ianwootten.co.uk

Post reply on HN
Print view View original

21–30 of 118 posts

Re: One does not simply 'pip install'

#21

Post by unxdfa »

lazka wrote: post #11

The next Debian/Ubuntu releases will no longer allow `pip install` outside of a venv: https://discuss.python.org/t/pep-668-marking-python-base-env... You can still force it via `pip install --break-system-packages ...` if needed.

This makes me so happy. Back when we had Jenkins slaves, one of our devops guys set a pipeline up that pip installed different versions over the top of system packages causing weird intermittent failures everywhere. Different pipelines would be running in different requirements files. I revoked sudo privs immediately for Jenkins (I didn't add them in the first place) and reprovisioned the whole build cluster resulting in pipelines breaking consistently where they should have been breaking: trying to do stupid stuff.

Personally I only ever use the system python packages on Linux if I can get away with it. Saves a whole world of problems.

Re: One does not simply 'pip install'

#23

Post by aflukasz »

Slightly tangential, but... one also does not simply `pip download` if one does not want execute code - https://github.com/pypa/pip/issues/1884.

I wanted to run guarddog on source packages. Only then build them locally and install. Turns out, `pip download` triggers code execution in fetched packages.

Somewhat surprising and in this day and age worth spreading awareness of.

Re: One does not simply 'pip install'

#24

Post by davidmurdoch »

I'm convinced that there are very few python libraries that Just Work if you follow their installation instructions. I've never found one that didn't come with issues myself.

Complain about this to a Python dev and you'll be "Well actually"ied to oblivion and each and every one will have their own opinion-as-fact on the best practice for managing these -- totally unaware how antithetical Python development has become from The Zen of Python.

Re: One does not simply 'pip install'

#25

Post by jackhoy »

savrajsingh wrote: post #13

Pyenv virtualenv is my personal fav for this issue

Yes, I don't write a lot of Python but found that was the easiest to get minimal repeatable builds and isolate them per project.

Link for anyone not familiar with pyenv/virtual env usage: https://www.jackhoy.com/web-applications/2017/02/12/setting-...

Re: One does not simply 'pip install'

#26

Post by llanowarelves »

michaelcampbell wrote: post #20
georgyo wrote: post #16

Earlier quoted context omitted.

Npm, yarn, yarn2, pnp, pnpm, and more. The only thing they have in common is package.json, but even then they can interpret things differently, such as workspaces. And then node_modules, which packages should not rely on but do, forcing many other tools into compatibility mode which often takes an install take a very long time. Yes, the node ecosystem is very healthy.

> And then node_modules, which packages should not rely on but do, Isn't the point of node_modules to house ... dependencies? I'm confused as to what you're getting at here.

I think he prefers a python-esque way where they're sort of dumped in a flat namespace (and not in current project directory), rather than the node_modules way where it's recursively a copy of each thing and its specific exact dependencies, all the way down.

There are ways to not use node_modules, by using newer Yarns for example.

Re: One does not simply 'pip install'

#27

Post by virtualritz »

> There’s no shortage of package management alternatives available for Python [...]

> How someone is meant to pick between these as a new developer is a mystery.

This.

Every time I get booked to look at some Python project hours are usually wasted initially figuring out what dependency mgmt solution was used how. And with what 'special sauce' the resp. developers deemed to be 'the right way' (or some library required because ... it just does)

As the author wrote: it seems common to omit the dependency setup in the Readme for Python projects.

I can understand why one would not mention this 'step' in a Rust or Node project but for Python it seems very much necessary.

Re: One does not simply 'pip install'

#28

Post by meitham »

lazka wrote: post #11

The next Debian/Ubuntu releases will no longer allow `pip install` outside of a venv: https://discuss.python.org/t/pep-668-marking-python-base-env... You can still force it via `pip install --break-system-packages ...` if needed.

Hopefully that’s not going to be the case inside a container!

Re: One does not simply 'pip install'

#29

Post by azornathogron »

michaelcampbell wrote: post #20
georgyo wrote: post #16

Earlier quoted context omitted.

Npm, yarn, yarn2, pnp, pnpm, and more. The only thing they have in common is package.json, but even then they can interpret things differently, such as workspaces. And then node_modules, which packages should not rely on but do, forcing many other tools into compatibility mode which often takes an install take a very long time. Yes, the node ecosystem is very healthy.

> And then node_modules, which packages should not rely on but do, Isn't the point of node_modules to house ... dependencies? I'm confused as to what you're getting at here.

Various packages rely on node_modules existing as a directory with a particular layout, some rely on being able to write into it. Some of the npm alternatives are built to store and manage dependencies in other ways (e.g., keep packages as zip files or other archives and get node to load direct from the zip), and these other mechanisms do not use a node_modules directory, hence compatibility problems.
Post reply on HN