Purposefully unconstrained pip dependencies pinned undesirably

[kevin-hanselman]

Describe the bug As of BentoML 0.9.0, dependencies in pip_packages that have no version constraints (as in pandas, not pandas>=1 or pandas==1.1.0) are automatically pinned to the version present in the environment. This behavior is not present in <0.9.0, and I believe it can be traced to this code.

This is a key departure from the expectation that pip_packages matches the requirements.txt rules.

To Reproduce

Create and build a BentoML service with one or more unconstrained pip package dependencies. For example:

@bentoml.env(pip_packages=['numpy', 'pandas>=1'])
class MyService(bentoml.BentoService):
    ...

View the auto-generated requirements.txt and see that all packages are pinned, even those without declared version constraints:

# requirements.txt
numpy==1.19.0
pandas==1.1.4

Expected behavior

The requirements.txt should not pin versions of packages without declared constraints:

# requirements.txt
numpy
pandas==1.1.4

Environment:

• OS: Ubuntu 18.04
• Python Version: 3.7.5
• BentoML Version: >=0.9.0

[parano]

Thanks for reporting this @kevin-hanselman - this behavior is indeed a lack of consideration on the BentoML side as it tries to pin the exact package version used in the environment it got saved. I will look into a fix.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[parano]

Hi @kevin-hanselman - after discussing with the team, we think that the current behavior of pinning the pip package version makes more sense and is aligned with what most other tools are doing. However, you can use the @env(requirements_txt_file=...) API to specify your own requirement.txt file, in that case, bentoml will not modify the file in any way, but the user will need to be responsible for potential issues with using a different version of the packages across training and serving environment. Let me know if you have any other questions.