[nijave]

Do you have examples of issues? OCI is tarball of dependencies that doesn't fight with the OS userland.

Why do you need to write code to insulate Python in containers?

At the simplest level, you can add the flags to the container runtime (network host, host ipc, host process namespace) to turn off all the namespacing besides filesystem and the Python container runs just like a non containerized process.

An extreme example

https://github.com/home-assistant/docker-base (Debian, Ubuntu, Alpine base images with Python for arm64 and amd64)

& https://github.com/home-assistant/core/blob/dev/Dockerfile (Python app built on those with >1000 deps)

And even there most of the custom code is just running a ton of combinations of inputs against docker build. The OCI container gets rid of "wide range of scenarios" for you standardizing the runtime environment