Disable user conda and pip installations

[manics]

You can make your python and conda directories readonly e.g. ensure they’re owned by root and that users can’t elevate their privileges. You can also prevent Python from loading user directories:

Failsafe container?

You can disable user packages by launching Python in isolated mode: python3 -I -m jupyterhub.singleuser or set PYTHONNOUSERSITE=1 . I think the linked issue is complicated by the fact that disabling user site requires controlling the command-line or environment variables and they want to be able to make it a property of the env itself. But we can set the env/cli in JupyterHub, so the existing mechanisms work for us.