So I can also speak to the experience of non-hermetic Python builds. It usually is OK. I manage an org of maybe 100 engineers/data scientists and only get hit by non-hermetic issues maybe once a month? And that's considering these folks don't know the nuances of the Python ecosystem and love running

pip install

(I blame Python, not people). That being said, it's really frustrating to use non-hermetic Python. That's why I'm divorcing Pants from system Python 🙂 The linked PR makes it so you can opt-into having Pants use

pyenv

to build and install Python in a read-only cache directory. So it should become way more hermetic. It'll still rely on system libraries, but nothing is truly hermetic and this is a great improvement.