Ideally you'd deploy to a virtualenv in a container, recreating the virtualenv with each new image. You wouldn't update the system Python at all.
The whole point of a container is to isolate dependencies.
The whole point of a virtualenv is also to isolate dependencies.
If using a container, why bother with a virtualenv at all?