Hacker News Reader

Comment by jonpalmisc | Hacker News Reader

Probably going to catch hate for this, but the Python package/environment management debacle is one of the things that causes me to avoid the language in my own personal projects.

All of the following are real tools for Python package/environment management: virtualenv; pipenv; venv; pyenv; poetry; pyenv-virtualenv; and pip-tools. There are probably more. Which one is "best" varies by who you ask and with time. If you do a bunch of Python work, you'll probably need most of them installed since different projects use different tools.

The messiness of the whole situation just takes the fun out of it for me. I don't hate Python, but when I code in my free time, I'd simply prefer to use a language that doesn't have those problems.

View on HN

I think the unfortunate thing is the lack of unified messaging around this. There are three/four problems that seem interlinked but are not really:

- Managing python versions (no packaging/enviroments) Pyenv is the solution if you don't want to use a global OS version.

- Environments, you don't need anything that isn't bundled with python, `python -m venv env` is the "official solution" and works really well.

- Packaging your app for running in production, `pip freeze > requirements.txt` and `pip install -r requirements.txt` is the "official solution", it works well enough.

- Packaging a lib for public distribution, setuptools... I don't have enough experience there but not many people need to actually use it. But again it is the "official solution"

Pyenv is the only none standard tool that I would recommend.

As far as I'm concerned all of these are redundant or not needed: virtualenv, pipenv, poetry pyenv-virtualenv, and pip-tools.

I wouldn't say those tools are "redundant or not needed". Tools like pipenv add features on top of pip and venv. Stuff like separating development dependencies (e.g. mypy), since you don't need that stuff at runtime. Pipenv will also move transitive dependencies into a lockfile instead of cluttering your requirements.txt (or rather Pipfile in the pipenv world).

> separating development dependencies

I just have:

  requirements-dev.txt (dev only requirements)
  requirements.txt (top level requirements)
  requirements-freeze.txt. (all requirements frozen)

How do you make sure that transitive dev dependencies end up in requirements-dev.txt? Do you manually say "dev dep X depends on transitive deps A and B, so I'll put X, A, and B in requirements-dev.txt"?

I only put top level dependancies in requirements-dev.txt, however you are quite right that a naive `pip freeze > requirements-freeze.txt` would result in it freezing dev dependancies.

It's a problem that I hope PIP will solve one day, but I like to keep tooling simple.

However because it's so easy to create venvs I regally just rebuild from scratch, do a `pip freeze > requirements-freeze.txt` then install dev dependencies (so not freezing dev dependencies). In many ways I think it's better to not mutate your venv and just rebuild if making significant changes.

Fortunately the packaging culture in Python isn't quite the same as with Node and you don't tend to end up with hundreds or thousands of dependancies.

Yea, the JS community's "moar dependencies!" culture is a big downside. But I do think that npm is great and pip should take a lot of cues from it

> It's a problem that I hope PIP will solve one day, but I like to keep tooling simple.

The way I've been doing is to not refer to dev dependencies in requirements.txt and then install the dependencies from requirements.txt before doing a requirements-freeze.txt. I made pip-chill to make the process a bit easier.

pip-compile facilitates this kind of setup and will generate the frozen/lock version for you.

> Packaging your app for running in production, `pip freeze > requirements.txt` and `pip install -r requirements.txt` is the "official solution", it works well enough.

It doesn't though. The default format for requirements doesn't specify which requirements are top-level and which are not. Updating dependencies on a project that doesn't have this distinction is complete pain. It also doesn't work when "production" might mean different environments with different Python versions.

> Packaging a lib for public distribution, setuptools... I don't have enough experience there but not many people need to actually use it.

Actually, using setuptools and setup.py (or a modern equivalent) is very helpful for packaging scripts and commands, defining top-level dependencies or other things. It's much easier to distribute a wheel file to production than a full repository.

Fair enough, I actually do `requirements.txt` and `requirements-freeze.txt` for top level and then everything. But honestly it works very well.

Most of the tools you mentioned appeared precisely because the basics with Python don't work that well. I had a project that started similarly, and in the end I had to use to pip-tools to actually separate top-level requirements and lockfiles for different "flavors" of the package (production and dev dependencies, for example). For new projects I would seriously consider poetry because it manages those two concepts directly. There's also the problem of changing requirement files and the environment not being updated to match 1-to-1 the files, either because someone installs something to test and doesn't put it in the requirements file or because you get an updated file from a coworker and forget to run the update. Even then, pip will not delete packages that it doesn't find on the files.

It's a mess once you start digging a bit, Python dependency management is extremely basic. It's no wonder why alternative tools appear, they're not redundant, they actually fix pain points in the default tools.

Completely with you, in complex projects the tooling can be improved and those tools attempt to do that. However going back to what the OP was suggesting about how the situation puts them off using Python, I do think it's the messaging around this that's the problem. Python, the community, need to unify on a message around official tools. There will always be edge cases, but the noise generated by them can give the impression the ecosystem is broken when it really isn't.

> It doesn't though. The default format for requirements doesn't specify which requirements are top-level and which are no

Shameless plug: you can `pip install pip-chill && pip-chill > requirements.txt` and work as usual. If you feel brave, you can `pip-chill --no-version > requirements.txt` and check if your thing works with the latest of everything.

> It doesn't though. The default format for requirements doesn't specify which requirements are top-level and which are not. Updating dependencies on a project that doesn't have this distinction is complete pain. It also doesn't work when "production" might mean different environments with different Python versions.

This is why (imo) you should include immediate dependencies in setup.py install_requires, and use requirements.txt for the "lock file" that contains all dependencies.

Wow - someone shares my view!

I use pyenv + direnv to automatically configure my Python interpreter and virtual environment for each repo. It is pretty painless.

In addition to the redundant tools you already mentioned: conda.

Conda isn't redundant if you have multiple C-level dependencies like pretty much every DS project in existence. I wish it were, but it's not.

I have to agree with the OP here, Python's dependency management story is just awful.

> - Environments, you don't need anything that isn't bundled with python, `python -m venv env` is the "official solution" and works really well.

Except when you run on Debian based systems, where you need to install the module separately for the OS Python

    $ python -m venv env
    /usr/bin/python: No module named venv

Solution: don't use Debian.

IMO the way most Linux Distro package managers install stuff is absolutely awful (system wide, no isolation, shared libs, shared PATH...)

That's one package you need to install (and that you only install if you'll be developing or testing Python packages). You'll want to install a lot more stuff (python-dev, build-essential) in that case anyway.

OTOH, if you will just use the OS, you won't need venv, as Debian packagers make sure everything works out of the box without it.

One problem with pip freeze (and pip-tools) is that it won't capture platform-specific dependencies. For example, ipython depends on appnope only on macos. If you build your lock file on Linux or Windows, the appnope version won't be locked.

Poetry solves this to an extent by including these dependencies along with their markers in the lock file.

Come on..it's very, very far from a debacle. It has strengths and weaknesses, sure. But a debacle?

pip, pip-tools (to generate a lock file), and virtualenv are all I've needed for years now.

I just started using pyenv to install Python on Ubuntu. Before that I was using the deadsnakes ppa.

The tools are there to use as needed. You don't have to install or learn them until...you have to. Which may very well be never.

If you avoid Python and all its benefits because of its packaging situation, it's really your loss.

I just hope no one reads this and gets scared off thinking that this top voted comment matches reality. It's not that hard to get your bearings and the Python foundation has invested heavily into the packaging ecosystem the last few years.

For example: https://packaging.python.org/en/latest/

Unless you have multiple C-level dependencies and/or need to install a Google created framework :(

I don't disagree with you but pyenv is just nvm for Python. You use it to manage multiple Python versions without touching the system Python, which tends to get people into trouble.

With libraries that alter your path at runtime. I've encountered comments on issues that implied that this wasn't a complete hack. I have had the impression that this is all just overhead in getting an environment up and running, and not taken for granted that you should be able to achieve repeatable isolation relatively simply.

So I think even if one of those packaging tools worked really well, a library somewhere could undo your best efforts at isolation.

I also don't hate python itself, but I wish the one way of doing things ethos applied to managing dependencies and python versions.

I don't understand what the problem is: 1) you install ONE version of python, more can't coexist in your environment usually 2) then you install your packages in a venv (because python provides tools to configure this)

Only part 2 is a problem of the Python ecosystem, part 1 is a problem of any environment to run binary programs. It applies to C-compilers, node, ..., perl...

Naturally, as most people involved with Python seemed to agree with that view, there was a lot of room for "improvement". And people got their improvement aplenty. Other people just realized that this is a general problem and nowadays instead of keeping around their /opt they now use something like spack. Which allows you to install a range of python-versions just fine. As well as C-Compilers. As well as perl-versions.

Very much agreed. I briefly tried to use poetry, tox, and pytest, and even using the support packages that are supposed to make poetry and tox play nicely together, it was a massive failure. tox would claim to be running tests with python3.8, say, but actually it was still using the default system python3.10, etc.

I now refuse to use any packaging tools for anything other than generating a requirements.txt, and refuse to use any version matrix tools like tox. I don't have a preference for/against pyenv for sourcing python interpreters (I'll use an AUR or scoop sometimes), or poetry or pipenv or anything else for specifying dependencies, but whatever method is used, I will always only use them to export a requirements.txt, and I will manually create my own venv for each interpreter, and run anything I want inside each venv via oneliners like:

    bash -c '. "$0/bin/activate" && exec "$@"' venv38 pip install --upgrade pip setuptools wheel
    bash -c '. "$0/bin/activate" && exec "$@"' venv38 pip install -r requirements.txt
    bash -c '. "$0/bin/activate" && exec "$@"' venv38 pytest --doctest-modules -v

Usually I'll wrap that `bash -c` preamble into a simple with_venv.sh script, and make a similar with_venv.ps1 for Windows. Create a Makefile with targets for those commands for each interpreter you want to test, and you can run everything in knowledge that you'll always know what's happening, instead of relying on stacked magic.

It’s a total mess. But build and runtime environment are a weak point for many, many languages.

You don't need any of those tools. One can use virtualenvs to avoid global Python pollution, but that's it.

I've used poetry, pipenv and others... Nowadays my opinion is that I want my package managers to be simple.

For each app, I mantain requirements.txt, requirements.dev.txt, requirements.test.txt... I edit those files manually and only use pip freeze for pinning requirements.freeze.txt

For libs, flit + pyproject.toml is a breeze.

None of the the tools are needed. You could compile Python 3.10 for each project on separately and just set your PATH to use the one you want. But pyenv makes life a lot easier.

I just use pip and, sometimes, virtualenvwrapper. You just pick one that works the way you want and be happy.

Having said that, I dislike the way pyenv works by adding proxy interpreters that are globally visible.

Is this any different/worse than JS/node ecosystem? Npm vs yarn vs bower. Webpack vs rollup, etc.

You're missing Pyflow which is writtenin Rust. But alpha at least. But wait, there's more…

Reply on news.ycombinator.com