Prevent changes to the base environment by non-root users

[qomhmd]

We have some servers with previous multi-user Conda instances on it. I started to use Miniforge on the newer ones and want to prevent users from cluttering up the base environment. It seems there is no implemented configuration to do such a thing. I did not find envs_dirs and pkgs_dirs useful for this purpose.

Moreover, I tried adding this code to a bashrc profile, but only the pip part is working. It seems I should deal with dedicated miniforge3/etc/profile.d/conda.sh or so to make it happen.

function get_conda_env() {
  current_env=$(conda info --envs | grep '*' | awk '{print $1}')
  echo "$current_env"
}

function pip_unbased() {
  current_env=$(get_conda_env)

  if [ "$current_env" = "base" ] && [[ "$1" = "install" || "$1" = "uninstall" ]]; then
    echo "Warning: Changing Conda's base environment is not allowed. You should create and/or activate another environment."
  else
    command pip "$@"
  fi
}

function conda_unbased() {
  current_env=$(get_conda_env)

  if [[ "$current_env" = "base" || "$current_env" = "" ]] && [[ "$1" = "install" || "$1" = "remove" ]]; then
    echo "Warning: Changing Conda's base environment is not allowed. You should create and/or activate another environment."
  else
    command conda "$@"
  fi
}

alias conda=conda_unbased
alias mamba=conda_unbased
alias pip=pip_unbased

[jaimergp]

conda is already a shell function so maybe that's why it doesn't work.

I wonder if you can handle this with your OS permissions, though. Make base readable and executable, but not writable. Maybe do allow write in pkgs/ (and envs/?) so the cache doesn't get duplicated across user homes.

[pyinstallerbaggins]

Have you looked into Jupyterhub for its permissions and access capabilities?

Try out Nebari or mybinder.org?

Let me know what you think!

[gernophil]

I am looking for the same thing. Somehow overlooked yours yesterday when I opened my thread. Seems like you've adapted the code from here. However, they are using $CONDA_PROMPT_MODIFIER. Could that work?

EDIT: they also don't use command conda "$@", but only conda "$@".