Disable user conda and pip installations

[antonvorobets]

If I want to make sure that users cannot break the conda environment by installing packages using conda or pip, is there an elegant way to do that?

I tried searching this forum and the Administrator Guide without luck.

[manics]

You can make your python and conda directories readonly e.g. ensure they’re owned by root and that users can’t elevate their privileges. You can also prevent Python from loading user directories:

Failsafe container?

You can disable user packages by launching Python in isolated mode: python3 -I -m jupyterhub.singleuser or set PYTHONNOUSERSITE=1 . I think the linked issue is complicated by the fact that disabling user site requires controlling the command-line or environment variables and they want to be able to make it a property of the env itself. But we can set the env/cli in JupyterHub, so the existing mechanisms work for us.

[antonvorobets]

I tried doing this by following this suggested implementation:

Failsafe container?

So all that would be needed is to add this to profileList? - display_name: "Failsafe environment" description: "Use this if you get internal error on startup" kubespawner_override: image: jupyter/minimal-notebook:2343e33dec46 enviroment: PYTHONNOUSERSITE: "1"

But then the server fails to start for some reason.

I think many people would appreciate it if this feature could be added as a config parameter