As per https://packaging.python.org/en/latest/specifications/externally-managed-environments/, we should mark /usr/lib/python3.X as "externally managed", so that pip doesn't try and delete/upgrade/install into it directly. 1) tell python and pip to look in /usr/local/ so that there is still somewhere system-level to write to 2) Drop an EXTERNALLY-MANAGED file into /usr/lib/python3.X. Regarding (1), https://github.com/pypa/distutils/pull/70 looks relevant.
I believe this means that for crops containers we will need virtualenv installed (which is already required for debian-12 anyway). Otherwise, the user cannot run `pip install --user` at runtime?
This would be possibly too invasive or affect other layers in some odd behaviour changes, so moving to 5.1 M1.
pip install --user will still work.
(In reply to Ross Burton from comment #3) > pip install --user will still work. Yeah, I think I meant `pip install` will not work without `--user`. Munging multiple things from some work happening in crops for debian-12 and virtualenv.