Software Development
Production Python: Packaging and Dependencies
Everything between working code and a deployable artifact. Participants configure pyproject.toml, build wheels, lock dependencies reproducibly with pip-tools, uv, or Poetry, publish to a private index, containerize with multi-stage Docker builds, and audit the supply chain that arrives with every third-party package.
Overview
Practical learning for workplace transfer.
The failure is familiar: a build that succeeded in March fails in September because an unpinned transitive dependency published a new minor version, and nobody can reconstruct the environment that once worked. This course closes that gap. Participants move a project to a src layout with declared metadata, produce a lock file with hashes, build and publish a wheel to a private index, and wrap it in a container image that installs the same versions every time. Dependency risk is treated as an operational concern, with pip-audit, SBOM generation, licence review, and a written upgrade policy.
Prerequisites
Practical Python development experience and basic familiarity with Git and the command line. No prior packaging or Docker knowledge is assumed.
Objectives
- Declare project metadata and dependencies correctly in pyproject.toml under PEP 621.
- Produce hash-pinned lock files that rebuild an identical environment months later.
- Build source distributions and wheels, and publish them to a private package index.
- Containerize a Python application with multi-stage builds and a non-root runtime.
- Audit dependencies with pip-audit, generate an SBOM, and review licence obligations.
- Define a release and rollback policy covering versioning, tags, and bad releases.
Target audience
- Python developers preparing internal libraries for wider reuse
- DevOps and platform engineers standardizing Python build pipelines
- Release managers responsible for versioning and artifact promotion
- Security and compliance staff assessing third-party package risk
- Data teams shipping models and pipelines beyond a single workstation
- Architects consolidating multiple Python projects onto one build standard
Program outline
A clear structure for the learning journey.
Program outline
Outline points are grouped in one designed block instead of being treated as separate module cards.
Module 1: Environments and Reproducible Installs
Virtual environments, interpreter versions, and isolating project state
pip, uv, and Poetry compared on resolution behavior and install speed
Lock files, hash pinning, and rebuilding an environment many months later
Diagnosing dependency conflicts and version resolution failures
Module 2: Project Layout and pyproject.toml
src layout, package discovery, and import paths that behave predictably
PEP 621 metadata: name, version, requires-python, and dependency specifiers
Choosing a build backend among hatchling, setuptools, and Poetry
Optional dependency groups for test, documentation, and development extras
Module 3: Building and Distributing Packages
Source distributions, wheels, and platform-specific build considerations
Entry points and console scripts that install as command-line tools
Versioning schemes, changelogs, and a deprecation policy consumers can trust
Publishing to PyPI and to a private index such as Artifactory or devpi
Module 4: Containerizing Python Applications
Base image selection, layer caching, and multi-stage build structure
Installing dependencies inside an image without breaking reproducibility
Non-root users, image size reduction, and container startup time
Runtime configuration, secret injection, and health check endpoints
Module 5: Supply Chain and Dependency Risk
Auditing installed packages with pip-audit and vulnerability advisories
Generating an SBOM and tracking transitive dependency depth
Licence obligations and an approval route for new third-party packages
Upgrade policy: pinning ranges, renovation bots, and controlled bumps
Module 6: Release Pipeline and Operations
CI jobs that build, test, and publish an artifact on tag
Promoting one identical artifact through test, staging, and production
Rollback, yanked releases, and handling a bad version already in the field
Runtime configuration, log destinations, and readiness for deployment
Materials provided
- Course workbook, annotated code samples, and reference notes
- Hands-on lab environment and starter repositories
- Exercises, checklists, and reusable code templates
- 4D Certificate of Completion
- Post-course technical guidance
Training Options
Programs can be delivered in-house, online, or in a blended format depending on your team's schedule, location, and learning objectives. When an external certificate or exam is included, certification rules and fees remain under the relevant awarding body's policies, while 4D provides the training and preparation support.
Why choose 4D
4D packages one of your existing internal projects during the workshop, so participants see their own dependency conflicts resolved rather than a clean sample repository. The output is concrete: a working pyproject.toml, a hash-pinned lock file, a container image, and an upgrade policy your security and platform teams have reviewed together.
Related courses
Python Programming Fundamentals
A hands-on introduction to Python for engineers and analysts who need working code rather than tutorial fragments. Participants build fluency with data types, collections, functions, files, and error handling, then assemble a small program that reads real data and produces a usable report.
View courseIntermediate Python and Clean Code Practices
Designed for developers whose Python works but is difficult to change. The course covers dataclasses, generators, decorators, context managers, and type hints, then applies the refactoring moves that turn a nine-hundred-line module into small tested units guarded by black, ruff, and mypy.
View coursePython Automation and Scripting for Work Tasks
Aimed at teams losing hours every week to repetitive file, spreadsheet, and reporting work. Participants automate those tasks with Python: batch file handling, Excel and CSV processing, REST API calls, email alerts, and scheduled jobs that run unattended and report clearly when something fails.
View course