https://packaging.python.org/en/latest/specifications/externally-managed-environments/#externally-managed-environments

This linked specification presents the use case rather well. Unlimited
installation of Python packages can cause a serious damage, when the system
component imports incompatible version of Python package instead of the
intended one. (A parallel thought: are there any initiatives to port low-level
components like firewalld to compiled languages? I know about firewalld-recode
[1], but it seems to be quite dead).

This specification tries to alleviate the problem by making it more difficult
and painfully obvious that installing packages outside of the using system
package manager is a wrong idea. That might be a good idea for normal users,
but it seems like quite a bother for people who create containers, where the
designers of such systems usually know what they are doing and who can check
and test that nothing has been broken.

The purpose of this bug is to discuss, whether we could produce some better
solution to the problem, which wouldn’t be that obnoxious to our customers.

One possible improvement would be to change our default hashbang to include
`-s` parameter to calling our Python interpreters, so that modules in `$HOME`
are not considered.

Any possible improvements?

[1]
https://web.archive.org/web/20160318144103/https://fedorahosted.org/firewalld-recode/