rigolepe
commented
2 months ago +1 I would like to have this option as well for better isolation from my host system.
This is important, compare the two solutions:
Python virtual environment
- Any Python code, whether run inside or outside a virtual environment, can still access, read, write, or delete files on your system. A virtual environment does not restrict the filesystem access of the code running within it.
- Code executed in a virtual environment can run system commands (using modules like os or subprocess) and potentially affect the system by installing packages, modifying configuration files, or interacting with hardware.
Docker container
- A Docker container's filesystem is completely isolated from the host by default. The code inside the container can only access the container’s internal file system. You can share specific parts of the host's file system with the container using volume mounts, but this must be explicitly configured.
- This isolation makes it much harder for code running inside a container to affect the host system unintentionally.
This means folks don't need to install things on their host, and the code execution is restricted from accessing their host