title: pip's requirements.txt best practice
body: <p>I am trying to generate <code>requirements.txt</code> for someone to replicate my environment. As you may know, the standard way is </p>
  
  <pre><code>pip freeze &gt; requirements.txt
  </code></pre>
  
  <p>I noticed that this will list all the packages, including the dependencies of installed packages, which makes this list unnecessary huge. I then browsed around and came across <a href="https://github.com/rbanffy/pip-chill" rel="noreferrer"><code>pip-chill</code></a> that allows us to only list installed packages in <code>requirements.txt</code>. </p>
  
  <p>Now, from my understanding when someone tries to replicate the environment with <code>pip install -r requirements.txt</code>, this will automatically install the dependencies of installed packages. </p>
  
  <p>If this is true, this means it is safe to use <code>pip-chill</code> instead of <code>pip</code> to generate the <code>requirements.txt</code>. My question is, is there any other risk of omitting dependencies of installed packages using <code>pip-chill</code> that I am missing here?</p>