> What are the issues with using docker to solve this problem ?

Docker alone doesn't solve the problem and neither does pip unless you take extra steps.

Here's a common use case to demonstrate the issue:

I open source a web app written in Flask and push it to GitHub today with a requirements.txt file that only has top level dependencies (such as Flask, SQLAlchemy, etc.) included, all pinned down to their exact patch version.

You come in 3 months from now and clone the project and run docker-compose build.

At this point in time you're going to get different versions than I had 3 months ago for many sub-dependencies. This could result in broken builds. This happened multiple times with Celery and its sub-dependency of Vine and Flask with its sub-dependency of Werkzeug.

So the answer is simple right, just pip freeze your requirements.txt file. That works but now you have 100 dependencies in this file when really only about 8 of them are top level dependencies. It becomes a nightmare to maintain that as a human. You basically need to become a human dependency resolution machine that traces every dependency to each dependency.

Fortunately pip has an answer to this with the -c flag but for such a big problem it's not very well documented or talked about.

It is a solvable problem tho, to have a separate lock file with pip without using any external tools and the solution works with and without Docker. I have an example of it in this Docker Flask example repo https://github.com/nickjj/docker-flask-example#updating-depe..., but it'll work without Docker too.

Throwing more technology on a problem means more complexity and more things that can go wrong. Doing it once or twice is fine, but the complexity increases exponentially.

Also, Docker is not a universal and secure solution. It works great as an "universal server executable format and/or programming environment" on Linux, but less so on Windows, macOS and especially FreeBSD.

Imagine you get a new phone with a new phone number, and you have a problem because some people still contact you on your old number. So instead of getting everyone to use the same number, you hire someone to take both of your phones and forward you the messages from each one.

Yes at some level it solves your problem, but it adds a lot of complexity which doesn't need to exist. Also now depend on someone in the middle who takes effort to manage, and might not do exactly what you want.

If you are developing a software that you run on your own servers, none. It works fine.

If you are developing an open source software that people can install on their machines, is a terrible solution. In that case you should package it correctly and distribute it via pip, so people can easily install it on their systems.