If someone builds a container that is designed like this:

  FROM debian

  RUN do-x
  RUN install python2

and then someone changes do-x, if I understand, the layers below it get invalidated and all of a sudden install python2 fails. This is very bad design but very easy to replicate.

Okay, but surely my poorly written dockerfile that grabs the wrong images and runs broken code is not Debian's or python's problem?

Older versions of debian that still support python2 will theoritically be around forever, and any codebase that absolutely needs them should always work.

(though I contend that, given that we've had 15 YEARS of warning that this was coming, such instances should be vanishingly rare and not under active development)

> … "given that we've had 15 YEARS of warning that this was coming" …

This right here is the part that I'm still having troubles wrapping my brain around. People still stressing about Python 2 "going away" (it's gone folks; accept it) despite the fact that there's been well beyond a decade of advance warning, and Python 2 having been officially EOL ages ago now.

People won't move until heavens fall down on them.

And than they will start complaining that it's other peoples fault that they didn't move.