0001-wip-managed-conda-Strict-isolation-mode.patch

From c65b3d35c4057f7cb89ad60319bedb4fc0ca811e Mon Sep 17 00:00:00 2001
From: Thomas Sibley <tsibley@fredhutch.org>
Date: Tue, 13 Sep 2022 15:28:18 -0700
Subject: [PATCH] wip! managed-conda: Strict isolation mode

---
 nextstrain/cli/command/shell.py        | 13 ++++---
 nextstrain/cli/runner/managed_conda.py | 47 ++++++++++++++++++--------
 2 files changed, 42 insertions(+), 18 deletions(-)

diff --git a/nextstrain/cli/command/shell.py b/nextstrain/cli/command/shell.py
index 5e3ee3c..f7e64b7 100644
--- a/nextstrain/cli/command/shell.py
+++ b/nextstrain/cli/command/shell.py
@@ -84,10 +84,15 @@ def run(opts):
                 *opts.default_exec_args,
                 "--rcfile", str(bashrc),
             ]
-            extra_env = {
-                "NEXTSTRAIN_SOURCE_DEFAULTS": "1",
-                "NEXTSTRAIN_PS1_PREFIX": ps1(prefix_only = True),
-            }
+            if managed_conda.ISOLATION_MODE == "strict": # type: ignore
+                extra_env = {
+                    "NEXTSTRAIN_PS1": ps1(),
+                }
+            else:
+                extra_env = {
+                    "NEXTSTRAIN_SOURCE_DEFAULTS": "1",
+                    "NEXTSTRAIN_PS1_PREFIX": ps1(prefix_only = True),
+                }
         elif opts.__runner__ is docker:
             opts.volumes.append(NamedVolume("bashrc", bashrc, dir = False, writable = False))
             extra_env = {
diff --git a/nextstrain/cli/runner/managed_conda.py b/nextstrain/cli/runner/managed_conda.py
index 2abba23..393423b 100644
--- a/nextstrain/cli/runner/managed_conda.py
+++ b/nextstrain/cli/runner/managed_conda.py
@@ -7,13 +7,15 @@ import platform
 import requests
 import shutil
 import subprocess
+import sys
 import tarfile
 import traceback
 from pathlib import Path, PurePosixPath
-from typing import Iterable, Tuple
+from typing import Iterable, List, Tuple, Union
 from urllib.parse import urljoin
+from .. import config
 from ..types import RunnerSetupStatus, RunnerTestResults, RunnerUpdateStatus
-from ..util import capture_output, exec_or_return, user_app_data_dir, warn
+from ..util import capture_output, exec_or_return, standalone_installation, user_app_data_dir, warn
 
 
 USER_APP_DATA_DIR = user_app_data_dir()
@@ -24,6 +26,14 @@ PREFIX_BIN = PREFIX / "bin"
 MICROMAMBA_ROOT = USER_APP_DATA_DIR / "micromamba"
 MICROMAMBA      = MICROMAMBA_ROOT / "bin/micromamba"
 
+ISOLATION_MODE = os.environ.get("NEXTSTRAIN_MANAGED_CONDA_ISOLATION_MODE") \
+              or config.get("managed-conda", "isolation-mode") \
+              or "strict"
+
+if ISOLATION_MODE not in {"strict", "relaxed"}:
+    warn(f"WARNING: Managed Conda runtime's isolation mode ({ISOLATION_MODE!r}) is invalid.  Using 'strict' instead.")
+    ISOLATION_MODE = "strict"
+
 
 def register_arguments(parser) -> None:
     """
@@ -49,23 +59,32 @@ def run(opts, argv, working_volume = None, extra_env = {}, cpus: int = None, mem
 
 def path_with_prefix(env = {}) -> str:
     """
-    Prepends our prefix onto the existing value of ``PATH``, which is taken
-    from the first place it's found:
+    Adds the runtime prefix to ``PATH``.
+
+    In strict isolation mode, the returned ``PATH`` consists of the:
+
+      1. Runtime prefix
+      2. Standalone installation prefix, if applicable
+      3. :py:attr:`os.defpath`
+
+    In other isolation modes, the runtime prefix is prepended onto the existing
+    value of ``PATH``, which is taken from the first place it's found:
 
       1. *env*
       2. :py:attr:`os.environ`
       3. :py:attr:`os.defpath`
-
-    Returns the modified ``PATH`` string.
     """
-    # XXX TODO: Consider not inheriting the existing PATH, so as not to leak
-    # the user's ambient environment into this runtime.  In that case, we'd
-    # want PATH to be something like: our runtime prefix, standalone
-    # installation prefix (for `nextstrain`, if applicable), default path
-    # (os.defpath).
-    #   -trs, 13 Sept 2022
-    PATH = env.get("PATH", os.environ.get("PATH", os.defpath))
-    return os.pathsep.join([str(PREFIX_BIN), PATH])
+    path: List[Union[str, Path]] = [PREFIX_BIN]
+
+    if ISOLATION_MODE == "strict":
+        if standalone_installation():
+            path += [Path(sys.prefix).resolve(strict = True).parent]
+
+        path += [os.defpath]
+    else:
+        path += [env.get("PATH", os.environ.get("PATH", os.defpath))]
+
+    return os.pathsep.join(map(str, path))
 
 
 def setup(force: bool = False) -> RunnerSetupStatus:
-- 
2.37.2