This is such a clusterfuck. I use so many containers in my home lab and various local installations and stuff. Honestly, I have no idea what I'm even supposed to do at this point because I'm not a full time developer.
Then we layered _another_ level of package management on top with Flatpak etc.
I don’t think anyone has _really_ been - in practice - able to understand how many versions of Python (or shells or ruby or Perl etc…) are installed on any system for a decade or two now.
[Edit to add: and I forgot entirely about venvs (and other language’s equivalents). We put package managers into packages! Now there can be a different version of every package for every script on your system. In every container. And Python even has more than one venv system to choose from!]
[Yes, I use all these things - it’s so hard _not_ to and still use modern software or participate in modern software development…]
Flatpak is somewhere in the middle because it can and does centrally update dependencies, though they are packaged in larger boxes and it's tempting to include more exotic stuff in the app package instead of creating and maintaining a separate Flatpak shared with other dependees.
I ran watchtowerr before, but I think this is a smarter way to do it.
i highly suggest you forget about containers, learn about systemd unit file hardening, and then you only have to play sysadmin to your base os and the binary for the program you want to run.
* Take the containers offline for the time being until you know what to do
* If it's important for your that they keep running, still take them offline and put them in a VPN this weekend
* Use renovate in the future to automatically update your containers
Takes about 20 seconds. Depending if you need to hit enter.
Node 26.3 → 26.12.1 Homebrew’s CA bundle, certifi and OpenSSL are updated, and so are Python 3.13 and 3.14 (3.13.17 and 3.14.9). uv 0.10.9 → 0.13.5. python.org Python 3.13: pip 26.2.2, installed from PyPI’s wheel with its checksum checked, then certifi 2026.10.19.
It also checked some of the other recent vulnerabilities like LiteLLM (already updated).
It went OK this time. There's no guarantee that it'll go OK every time, for every thing.
All I'm saying is that understanding how to maintain the systems that you are responsible for maintaining is an important thing, and outsourcing that understanding is very dangerous.
Awwww. It is like talking to a dev in 2010. Ok. So, there are machines now smarter than you. You are the problem. You are the thing that adds errors. "understanding how to maintain" No, that is over. sorry. As a human, you are too slow, too dumb to compete.
When a CVE comes out, the patch needs to be applied across the company in minutes. YOU cannot do this 2010 dev dude. Put down the Puppet files. Let go of the python PR.