title: How to keep dependencies consistent between dev and production env for a python package with poetry and pyproject.toml
body: <p>I have a python package where the dependencies is specified in a poetry.lock file for development and testing. I then build and publish the package, which gets installed on the production docker image. But here is the problem: the published package has its dependency specified in the <strong>tool.poetry.dependencies</strong> section of pyproject.toml, which could be different from poetry.lock. So it's possible that the production env ends up with dependencies different from testing env.</p>
  <p>I can think of several ways to achieve consistency, but none of them seems that good to me:</p>
  <ol>
  <li><p>Use the same set versions in pyproject.toml as in poetry.lock. This will guarantee the published package has the same dependencies as dev/test. But what's even the point of keeping a poetry.lock file at this point, since pyproject.toml can be used for <code>poetry install</code> as well if there is no poetry.lock file. I think this works, but then I don't understand why even have poetry.lock in the first place.</p>
  </li>
  <li><p>In the production docker image, checkout the poetry.lock file from package repo and run <code>poetry install</code> before installing the package itself. But this will increase the docker image size, introduce unnecessary config if the repo is private, and overall doesn't seem natural.</p>
  </li>
  </ol>
  <p>I'm pretty new to this part of Python so maybe one of these is the &quot;standard&quot; workflow. Or maybe I'm just completely missing something. Thanks for answering!</p>