PEP 668 lets an operating system mark its Python installation as managed by the system package manager by dropping an EXTERNALLY-MANAGED file next to the stdlib. pip 23.0 and later honour it and abort with error: externally-managed-environment. Debian 12, Ubuntu 23.04 and later, Fedora 38 and later, and Homebrew Python all ship that marker, so the same pip install requests that worked for years now fails on a fresh machine.
The point is to stop pip from overwriting files that apt or dnf owns, which historically bricked system tools written in Python. The message names the marker file's location, and python -c "import sysconfig; print(sysconfig.get_path('stdlib'))" tells you where to look for it.
Use a virtual environment for project dependencies, or pipx or uv tool install for command line applications, which create one per tool automatically. --break-system-packages and pip config set global.break-system-packages true override the check and are exactly as safe as the name suggests. In a container, a venv is still the better answer because it keeps the image reproducible.