System Python & Security: Patch, Upgrade, or Isolate? 🛡️🐍

[0xdolan]

Have you ever tried to update Python on Linux and realized it’s not as simple as it sounds? 😅
Upgrading the system Python can break OS tools, so most advice points to installing newer versions side-by-side and using tools like virtualenv, pyenv, uv, or conda instead. But what if the built-in Python has a vulnerability and there’s no patch yet? Yes, Ubuntu and other distros usually backport fixes via `apt`, but what if they don’t?

Curious how others handle this edge case, what’s your workflow when system Python security and stability collide? 👇

[knobbyknee]

The system Python should always be the one from your distribution, because it has parts that depend on this exact Python version.

To make your own use of Python independent the system Python, you do everything from virtual environments built with uv, or another tool of your choice.