Unsafe handling of 3rd party python dependencies

[hmpf]

In various docker-files, you install 3rd party python libraries like this:

$ pip install dependency1 dependency2 ..

Sooner or later, these dependencies will need different versions of a sub-dependency, and then pip will fail because of a version conflict.

I recommend that you put these dependencies in requirements-files with version numbers and install them like this:

$ pip install -r requirements-for-subsystem-1.txt

You can generate a requirements file with pip freeze or better: pip-compile from piptools.

By using the same requirements-files everywhere you can make reproducible deploys, and also test on the actual versions that will be deployed. Much recommended!

[katsel]

The file affected is the cnaas-setup.sh of the dhcpd Docker container, as far as I can see.
https://github.com/SUNET/cnaas-nms/blob/develop/docker/dhcpd/cnaas-setup.sh#L37