But now I am seeing more of this. Do you have any good links to read more about why using venv/non-root makes sense for Docker?
I do know setting up a proper user in Docker is just a couple lines away in a Dockerfile (As a matter of fact, I did that for the main app I develop).
For my other use cases, I just don't care. I'm using Docker to quickly bootstrap a Jupyter Labs environment, and I do that by sharing some confs (Like the Pip cache folder).
The caveat to this is that files I create are owned by root, but that again is just a command away for fixing (If I need it, that haven't yet).
[1] https://stackoverflow.com/questions/27017715/does-virtualenv...
- exploits for breaking out of the container are easier to pull off if you have root access
- if the image has a system python, installing with sudo will install things in the system site-packages directory, which can cause a lot of troubles
For instance, yesterday a PHP tool made the HN frontpage [1] that seemed rather interesting. Problem is, it needs PHP 7.2+ and my app runs on 5.6.* What to do? (Bear in mind, 3 weeks ago I moved from Virtual Box to Docker for local dev, and my files are now in a regular folder in my machine).
In this case, I just need to tell Docker to fetch the image and run it pointing to the same folder where my app is. Just a 1 line command.
After that, I just need to remove the Docker image and my system is as pristine as before.
I think I have itches very similar to yours (Like, I'm learning Python and all things Data Science and Machine learning related, instead of virtualenv or even *conda, I'm separating my projects using Docker), and nowadays I'm using Docker for all of'em.
[1]https://news.ycombinator.com/item?id=23654973