Skip to content

pip

pip installs Python packages into the Python environment you select.

Visit pip

Which Python environment receives the packages?

Choose the Python version your project requires and use a separate virtual environment for its packages. A virtual environment keeps one project’s installed packages apart from another’s. Running pip through that environment’s Python helps select the installer that belongs to it.

A virtual environment is a dependency boundary. Code you install can still run with your user permissions. Check the package and source before installing it.

Does requirements.txt lock every version?

A requirements file is a list pip can read during installation. An entry may be a name, a version range or an exact version. It can also contain options, references to other files and package locations. Read the actual entries before assuming the file fixes every dependency.

A requirements file with all needed versions pinned can be part of a repeatable install. pip freeze lists what is already installed. It does not compute a lockfile. Current pip documents pip lock and installation from pylock.toml as experimental. Check that your project uses this format and that your installed pip version supports it before relying on it. pip only guarantees a generated lockfile for the Python version and platform where you made it.

Can you tell what is fixed without installing anything?

Use an invented dependency name and two lines on paper. Do not search for or install the fictional name.

  1. Compare a range with a pin
    Write demo-widget>=1.2,<2 in one example and demo-widget==1.2.4 in another. The first permits multiple versions. The second specifies one version for that entry.
  2. Look for what is missing
    Write down the Python version and operating system the example needs. Neither line describes the full list of dependencies that the package could bring along.
  3. Plan the handoff
    Mark the dependency file as a project file and the virtual environment as something the next machine creates again. Leave registry credentials out of the handoff.

What should another machine have before it repeats an install?

Keep the project’s dependency files and Python version requirement with the code. Record the intended package source and platform. Use the project’s own instructions for any pins or hashes. Verify that the deployment can obtain the packages it needs without exposing private registry credentials.

Recreate the virtual environment on the destination machine. A version pinned for one platform can still lack a compatible build on another. pip itself is open source. Hosting or a private package source may have separate costs.