new tenets proposal: "A {Checker|Service} MUST pin its dependencies as pedantic as possible

[Trolldemorted]

We don't want another pyDns debacle

[ldruschk]

We would have to check how well this works with stuff like enowars/enochecker#62

In that case we would could end up with two requirements.txt pinning two different versions

[Trolldemorted]

Don't you start with a "normal" dependency list, find out that it works, and then pin it? The values should match in that case unless you update the base image

[ldruschk]

Yes, but if you pin your versions outside of the docker image and we update something in the base image, the dependencies might no longer match. This is fine when only pinning everything non-enochecker/gunicorn related, but if one of the "outside" dependencies shares a dependency with a dependency from the base-image, we might end up with two different pinned versions for the same package.

[Trolldemorted]

we update something in the base image

hence pin the base image hash in your dockerfile and verify everything works when upgrading? 😛

[ldruschk]

That would somewhat eliminate the use case for the base Docker image, which is being able to update/modify the configuration without requiring manual action in each repository. But maybe that is not desirable at all since it might break other stuff