[docs] Simple steps for service deployment

User story: I am a Django developer. I want to deploy my Django site onto a Debian server machine, so that I can execute it as a daemon/service.

Problem: The advanced docs currently mention --system --deploy but don’t explain what they do: https://pipenv.readthedocs.io/en/latest/advanced/#deploying-system-dependencies

(This issue is an attempt to isolate one item from https://github.com/pypa/pipenv/issues/2660 , define a clear user story to be addressed, and document the solution.)

[techalchemy]

Hey, sorry for the delay here! It’s been a crazy few weeks. Firstly thanks for starting this very necessary discussion and tackling this documentation problem!

@kwill :

–system just says “System pip management.” This is less clear to me. What does it mean?

It just means we use which pip to find pip and invoke it directly, basically, instead of making a virtualenv (so often this is derived from python -m pip or else it is found on your path). It means that installation is done without any resolution and without any virtualenv creation.

pip(env[sic]) install with a combination of --system and/or --deploy
AND, I have a requirements.txt in my root folder

…will I reimport the requirements.txt? I still have it for legacy reasons, but I don’t want it to interfere with my pipenv-driven deployment.

If you have a pipfile or a lockfile, pipenv should skip your requirements file if it finds one. If you use --deploy pipenv should never use anything but your lockfile and will fail spectacularly if the lockfile and pipfile do not agree with one another (the lockfile stores a hash of the pipfile used to generate it)

---

@sirosen

There appear to be at least three ways of doing a reproducible install from the lockfile. Which of these is recommended, and why?

pipenv install --ignore-pipfile

This installs dependencies from your Pipfile.lock only, whether you have a pipfile or not, whether it is out of sync with your lockfile or not, it doesn’t even check.

pipenv install --deploy

This command is an ‘enforcement’ command, it basically says ‘install the dependencies from my lockfile, if and only if my lockfile is in sync with my pipfile, otherwise give me an error message’.

pipenv sync

This command says ‘take the dependencies specified in my lockfile and put them in my virtualenv’

[sirosen]

There appear to be at least three ways of doing a reproducible install from the lockfile. Which of these is recommended, and why?

• pipenv install --ignore-pipfile
• pipenv install --deploy
• pipenv sync

I’ve been using pipenv install --ignore-pipfile, which seems to do what I want.

We don’t want things to fail if we go back to an old commit and Pipfile.lock could be updated – we went back to that commit on purpose, and used an old Pipfile.lock on purpose. We also don’t want things to fail if there’s a delay between Pipfile.lock being committed and a build happening. If a library updates at the same time that an app version is making its way through a CD pipeline, that should be ignored/okay.

It seems like pipenv install --deploy won’t work for these cases, unless I misunderstand?

What exactly is the difference between pipenv install --ignore-pipfile and pipenv sync? I think any docs about deployment should cover that too.