pex VS nogil

We get (very) close to cross-environment reproducible builds for Python with https://github.com/pantsbuild/pex (via Pants). For instance, we build Linux x86-64 artifacts that run on AWS Lambda, and can build them natively on ARM macOS.

This is not raw requirements.txt, but isn’t too far off: Pants/PEX can consume one to produce a hash-pinned lock file.

You should look into pex, or it’s parent build system pants. A PEX (Python EXecutable) file can package up all your code including dependencies and run on another machine of similar OS with just an available compatible interpreter.

For well-supported libraries, pip-audit might do the trick. Where I've worked, we have used a central build system with library version enforcement. The build system produces a deployable archive, like PEX or similar. Rock-solid tests and sandbox validation environments provide good paths for version upgrades. Restricting libraries to a small set, making sure those repos remain actively developed, performing audits and centralizing builds has helped organizations I've worked in keep on top of potential security issues.

Don't know if I agree about the goto thing, but there are actually a number of options now for delivering varying degrees of self-contained Python executable.

When I evaluated the landscape a few years ago, I settled on PEX [1] as the solution that happened to fit my use-case the best— it uses a system-provided Python + stdlib, but otherwise brings everything (including compiled modules) with it in a self-extracting executable. Other popular options include pyinstaller and cx_freeze, which have different tradeoffs as far as size, speed, convenience, etc.

[1]: https://github.com/pantsbuild/pex

Somewhat related, I had a devil of a time a little bit ago trying to ship a small Python app as a fully standalone environment runnable on "any Linux" (but for practical purposes, Ubuntu 16.04, 18.04, and 20.04). It turns out that if you don't want to use pip, and you don't want to build separate bundles for different OSes and Python versions, it can be surprisingly tricky to get this right. Just bundling the whole interpreter doesn't work either because it's tied to a particular stdlib which is then linked to specific versions of a bunch of system dependencies, so if you go that route, you basically end up taking an entire rootfs/container with you.

After evaluating a number of different solutions, I ended up being quite happy with pex: https://github.com/pantsbuild/pex

It basically bundles up the wheels for whatever your workspace needs, and then ships them in an archive with a bootstrap script that can recreate that environment on your target. But critically, it natively supports the idea of targeting multiple OS and Python versions, you just explicitly tell it which ones to include, eg:

    --platform=manylinux2014_x86_64-cp-38-cp38   # 16.04

This might be a dumb question, but why would removing the GIL break FFI? Is it just that existing no-GIL implementations/proposals have discarded/ignored it, or is there a fundamental requirement, e.g. C programs unavoidably interact directly with the GIL? I know that the C-API is only stable between minor releases [0] compiled in the same manner [1], so it's not like the ecosystem is dependent upon it never changing.

I cannot seem to find much discussion about this. I have found a no-GIL interpreter that works with numpy, scikit, etc. [2][3] so it doesn't seem to be a hard limit. (That said, it was not stated if that particular no-GIL implementation requires specially built versions of C-API libs or if it's a drop-in replacement.)

[0]: https://docs.python.org/3/c-api/stable.html#c-api-stability

[1]: https://docs.python.org/3/c-api/stable.html#platform-conside...

[2]: https://github.com/colesbury/nogil

[3]: https://discuss.python.org/t/pep-703-making-the-global-inter...

https://github.com/colesbury/nogil does manage to get rid of the GIL, but it's not certain to make it into Python core. The main problem is the amount of existing libraries that depend on the existence of the GIL without realizing it - breaking those would be extremely disruptive.

CPython is also investigating the removal of the GIL (PEP703, nogil). I think requiring the GIL is a wider thing that libraries will need to address anyway. But also, for the same reason as above I'd be surprised if the Modular team thought that saying "you can run all your python code unchanged" was a good idea if there was a secret "except for code that uses numpy" muttered under the breath.

I'm worried about the speedup

My understanding is that it's based on the most recent attempt to remove the GIL by Sam Gross

https://github.com/colesbury/nogil

In addition to some ways to try to not have nogil have as much overhead he added a lot of unrelated speed improvements so that python without the gil would still be faster not slower in single thread mode. They seem to have merged those performance patches first that means if they add his Gil removal patches in say python 3.12 it will still be substantially slower then 3.11 although faster then 3.10. I hope that doesn't stop them from removing the gil (at least by default)

Looks like it's still active to me:

https://github.com/colesbury/nogil/