greywall/docs/recipes/pip-poetry.md

Recipe: pip / poetry

Goal: allow Python dependency fetching while keeping egress minimal.

Start restrictive (PyPI)

{
  "network": {
    "allowedDomains": ["pypi.org", "files.pythonhosted.org"]
  },
  "filesystem": {
    "allowWrite": [".", "/tmp"]
  }
}

Run:

fence --settings ./fence.json pip install -r requirements.txt

For Poetry:

fence --settings ./fence.json poetry install

Iterate with monitor mode

fence -m --settings ./fence.json poetry install

If you use private indexes, add those domains explicitly.