Python: PYTHONNOUSERSITE propagates from Python binaries to whatever they run

[gleber-da]

Issue description

We have observed this with ansible-playbook. Our playbook executes a python script inside, which was doing

pip3 install --user pyyaml
python3 -c 'import yaml'

and it was failing, since python3 binary would pick up the env variable set in the ansible-playbook binary.

Steps to reproduce

nix-shell -p ansible --run "ansible localhost -a python3.6"

and then type

import sys
sys.path

and check if there's ~/.local/lib/python2.6/site-packages or similar package. If it is not there, the issue stands.

Technical details

Possible solution would to replace use of PYTHONNOUSERSITE with -s argument to Python binary.

• system: "x86_64-darwin"
• host os: Darwin 17.3.0, macOS 10.13.2
• multi-user?: no
• sandbox: no
• version: nix-env (Nix) 1.11.15pre4522_506828d0
• channels(gleber): "nixpkgs-18.03pre122585.b212125b541"
• nixpkgs: /Users/gleber/code/foo/bar/lib/gc-roots/nixpkgs-snapshot

[gleber-da]

@joamaki CC

[FRidh]

The reason the environment variable is exported is to prevent impurities. The downside of exporting environment variables is that they always propagate all the way down the process tree, unless they are explicitly unset at some point. Using the -s argument applies it only to the process executed in the wrapper.

I think we could make this change. Could you test with https://github.com/FRidh/nixpkgs/tree/imp/pythonnousersite.

[FRidh]

See #33528 for the proposed change.

[FRidh]

Closing since #33528 is now in staging.

[FRidh]

Reverted it in e527eb0.
See 3102035#commitcomment-26697936

[stale]

Thank you for your contributions.

This has been automatically marked as stale because it has had no activity for 180 days.

If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.

Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the related code and @ mention them in a comment.
2. Ask on the NixOS Discourse.
3. Ask on the #nixos channel on irc.freenode.net.