Should I install Python packages as non root user or set up a virtual environment to install them inside a Docker container?

user_6630397 0
Viewed 1314

When installing Python package through pip in a Dockerfile, such as:

pip install --trusted-host pypi.python.org -r requirements.txt

with requirements.txt, e.g. as:

python-dotenv>=0.15.0
psycopg2>=2.8.6
sqlalchemy>=1.3.22
numpy>=1.19.0
rasterio>=1.1.8
pandas>=1.1.5
geopandas>=0.8.1
matplotlib>=3.3.0
seaborn>=0.11.0

I recently seen this warning:

WARNING: Running pip as the 'root' user can result in broken permissions
and conflicting behavior with the system package manager.
It is recommended to use a virtual environment
instead: https://pip.pypa.io/warnings/venv

Hence my 'naive' question:
would that make sense to set up a virtual environment / or installing Python packages as the non root user (which is the default in Docker), as one would normally do on his/her local computer?
For the moment I never cared about that, because I'm inside a Docker container which by definition hosts a single application, so I think it's perfectly OK that these packages are installed globally. Hopefully I cannot break anything on my local machine.

docker pip python
3 Answers

Honestly? It doesn't much matter.

Using the root user during the build of your container is generally necessary and expected. The warning from pip is "running pip as root could screw up the packages your OS programs depend on" - but there's no OS in your container.

If you drop to a less privileged user at the end of your build or during your docker run, installing the packages as root won't have hurt you any. Practically a container is a single process (your python application) that has a view of the filesystem different from the root system- very much like a virtualenv would try to accomplish.

user_22599340

As @Paul Becotte said in his answer, there is no risk in installing your packages globally in your container, but you are seeing this warning because pip doesn't care you are running inside a container or not.

The general python good practice is to create a virtual env as an unprivileged user : $ python -m venv .venv

Then activate it : $ source .venv/bin/activate

And then install your packages with your $ pip install -r requirements.txt command.

You can totally adapt that to the docker build syntax :

RUN python -m venv /abolute/path/to/venv
RUN source /absolute/path/to/venv/bin/activate && pip install -r requirements.txt
CMD source /absolute/path/to/venv/bin/activate && python /path/to/your/app.py

However, the General docker good practice is to run with an unprivileged user. So you have multiple choice here :

  • Live with the warning, install your python packages globally without venv, drop the privileges and run your container with a normal user
  • create venv to get rid of the warning, install your packages in it, run you container as root (not a good practice, but maybe remapping root user can be ok)
  • create a venv, install the packages, run the container as a normal user, which is probably the best option if your application doesn't need to be run as root in your container.
user_31493790

It's not the best practice to run pip as a root user or to install packages globally. The best practice is to create virtual environment within the project and install every packages there.

If you install globally, it will actually affect other projects because you might not need the packages you installed for project A in the project B that you are about to start and if you remove all the packages, there will be a break in project A as it cannot access the packages again.

Have virtual environment for all your projects and with that, you will be rest assured that all projects will not affect each other.

user_169322160
Related