Why lock Python dependencies?

medium

Answer

$requirements.txt with only top-level packages \to transitive deps drift over time \to 'works on my machine' bugs.$
$Fix: pin every transitive dep.$
$Tools: (1) pip freeze (basic).$
$(2) pip-tools pip-compile (recommended: separate requirements.in for direct, requirements.txt locked).$
$(3) Poetry (poetry.lock).$
$(4) uv (Rust-based, fast).$
$(5) Conda / Mamba environment.yml for scientific stack.$
$Docker + pinned deps + version-pinned base image = full reproducibility.$

Check yourself — multiple choice

Random
Top-level only → transitive drift → 'works on my machine'; pin transitive via pip freeze / pip-tools (compile) / Poetry lock / uv (fast Rust) / Conda env.yml; Docker + pinned = full repro
Not needed
Just install

Pin deps: pip-tools / Poetry / uv / Conda; Docker + pin = full repro.

#reproducibility#infrastructure

215 interview questions in this topic.