i'm trying to include this in my container:
pip install python-jose[cryptography]
as a test, i ran that in a virtual env and got:
cffi==1.14.6
cryptography==3.4.7
ecdsa==0.17.0
pyasn1==0.4.8
pycparser==2.20
python-jose==3.3.0
rsa==4.7.2
six==1.16.0
typically, in requirements.txt i'll have just:
python-jose==3.3.0
but i'm curious to know how i can keep the same version for the sub-packages.
i.e. something like this:
python-jose[cryptography==3.4.7]==3.30
but idk what i'm doing...
So the cryptography in python-jose[cryptography] is not generally the name of some other Python package. In this case it is but you can define any sets of extras you want named whatever you want for your package. For example you could have my-package[dev] for development requirements. See how python-jose defines these extra requirements here. Again, they are often other Python packages but not always, so what you're asking for is not something that would work generally.
Now when you just want to specify what requirements your application has, a requirements.txt with pinned versions for top-level dependencies will usually do a good job. But in your case it sounds like you want to fully freeze an environment. In that case specifying the versions of all dependencies including transitive dependencies is a very reasonable thing to do. python -m pip freeze > requirements.txt will do that for you (as it looks like you already know).
That, of course, is not something you want to do for a library that you want to let other people integrate into their own code, but it is absolutely something you might want to do when deploying an application.
This blog is good general reading on requirements files.