Consider packaging with e.g. (docker) Drydock pattern

[openprivacy]

To avoid local dependency conflicts and enable packaging that "just works" in sandbox and CI environments, consider the Drydock Pattern. We've used this pattern to create a set of compliance tools that reads templated markdown to produce an SSP. (Disclaimer: we "extended" the opencontrol schema so this is not currently compliance-masonry compatible.)