feat: add --clean-env flag to tasks and run command (prefix-dev#1395)

Fixes prefix-dev#289 slightly

Adds:
```
pixi run --clean-env xxx
```

```toml
[tasks]
isolated-task = {cmd = "/usr/bin/env", clean-env = true}
```

This doesn't work on Windows, as it is just to shitty to get working on
windows.
You need to many variables and paths for a working environment for the
label "clean" as you need the `Program Files` directories for the
compilers. And other stuff.

And I'm honestly a 120% Done with this PR. And it's breaking into
actually being productive.

docs/features/advanced_tasks.md

@@ -195,6 +195,23 @@ These variables are not shared over tasks, so you need to define these for every
     ```
     This will output `/tmp/path:/usr/bin:/bin` instead of the original `/usr/bin:/bin`.
 
+## Clean environment
+You can make sure the environment of a task is "pixi only".
+Here pixi will only include the minimal required environment variables for your platform to run the command in.
+The environment will contain all variables set by the conda environment like `"CONDA_PREFIX"`.
+It will however include some default values from the shell, like:
+`"DISPLAY"`, `"LC_ALL"`, `"LC_TIME"`, `"LC_NUMERIC"`, `"LC_MEASUREMENT"`, `"SHELL"`, `"USER"`, `"USERNAME"`, `"LOGNAME"`, `"HOME"`, `"HOSTNAME"`,`"TMPDIR"`, `"XPC_SERVICE_NAME"`, `"XPC_FLAGS"`
+
+```toml
+[tasks]
+clean_command = { cmd = "python run_in_isolated_env.py", clean-env = true}
+```
+This setting can also be set from the command line with `pixi run --clean-env TASK_NAME`.
+
+!!! warning "`clean-env` not supported on Windows"
+    On Windows it's hard to create a "clean environment" as `conda-forge` doesn't ship Windows compilers and Windows needs a lot of base variables.
+    Making this feature not worthy of implementing as the amount of edge cases will make it unusable.
+
 ## Our task runner: deno_task_shell
 
 To support the different OS's (Windows, OSX and Linux), pixi integrates a shell that can run on all of them.

docs/reference/cli.md

@@ -179,7 +179,7 @@ You cannot run `pixi run source setup.bash` as `source` is not available in the
 - `--frozen`: install the environment as defined in the lock file, doesn't update `pixi.lock` if it isn't up-to-date with [manifest file](project_configuration.md). It can also be controlled by the `PIXI_FROZEN` environment variable (example: `PIXI_FROZEN=true`).
 - `--locked`: only install if the `pixi.lock` is up-to-date with the [manifest file](project_configuration.md)[^1]. It can also be controlled by the `PIXI_LOCKED` environment variable (example: `PIXI_LOCKED=true`). Conflicts with `--frozen`.
 - `--environment <ENVIRONMENT> (-e)`: The environment to run the task in, if none are provided the default environment will be used or a selector will be given to select the right environment.
-
+- `--clean-env`: Run the task in a clean environment, this will remove all environment variables of the shell environment except for the ones pixi sets. THIS DOESN't WORK ON `Windows`.
 ```shell
 pixi run python
 pixi run cowpy "Hey pixi user"
@@ -193,6 +193,11 @@ pixi run task argument1 argument2
 
 # If you have multiple environments you can select the right one with the --environment flag.
 pixi run --environment cuda python
+
+# THIS DOESN'T WORK ON WINDOWS
+# If you want to run a command in a clean environment you can use the --clean-env flag.
+# The PATH should only contain the pixi environment here.
+pixi run --clean-env "echo \$PATH"
 ```
 
 !!! info

docs/reference/project_configuration.md

@@ -176,6 +176,7 @@ alias = { depends-on=["depending"]}
 download = { cmd="curl -o file.txt https://example.com/file.txt" , outputs=["file.txt"]}
 build = { cmd="npm build", cwd="frontend", inputs=["frontend/package.json", "frontend/*.js"]}
 run = { cmd="python run.py $ARGUMENT", env={ ARGUMENT="value" }}
+clean-env = { cmd = "python isolated.py", clean-env = true} # Only on Unix!
 ```
 
 You can modify this table using [`pixi task`](cli.md#task).

examples/cpp-sdl/pixi.toml

@@ -17,6 +17,7 @@ sdl2 = "2.26.5.*"
 cmake = "3.26.4.*"
 cxx-compiler = "1.5.2.*"
 ninja = "1.11.1.*"
+make = ">=4.3,<5"
 
 [feature.build.tasks.configure]
 # Configures CMake

schema/examples/valid/full.toml

@@ -49,7 +49,8 @@ test4 = { cmd = "pytest", cwd = "tests", depends-on = ["test2"] }
 test5 = { cmd = "pytest" }
 test6 = { depends-on = ["test5"] }
 test7 = { cmd = "pytest", cwd = "tests", depends-on = ["test5"], env = {PYTHONPATH = "bla", "WEIRD_STRING" = "blu"}}
-
+test8 = { cmd = "pytest", cwd = "tests", depends-on = ["test5"], env = {PYTHONPATH = "bla", "WEIRD_STRING" = "blu"}, clean-env = true}
+test9 = { cmd = "pytest", clean-env = false}
 [system-requirements]
 linux = "5.10"
 libc = { family="glibc", version="2.17" }

schema/model.py

@@ -261,6 +261,11 @@ class TaskInlineTable(StrictBaseModel):
         description="A map of environment variables to values, used in the task, these will be overwritten by the shell.",
         examples=[{"key": "value"}, {"ARGUMENT": "value"}],
     )
+    clean_env: bool | None = Field(
+        None,
+        alias="clean-env",
+        description="Whether to run in a clean environment, removing all environment variables except those defined in `env` and by pixi itself.",
+    )
 
 
 #######################

schema/schema.json

@@ -1145,6 +1145,11 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "clean-env": {
+          "title": "Clean-Env",
+          "description": "Whether to run in a clean environment, removing all environment variables except those defined in `env` and by pixi itself.",
+          "type": "boolean"
+        },
         "cmd": {
           "title": "Cmd",
           "description": "A shell command to run the task in the limited, but cross-platform `bash`-like `deno_task_shell`. See the documentation for [supported syntax](https://pixi.sh/latest/features/advanced_tasks/#syntax)",

src/activation.rs

@@ -132,6 +132,7 @@ pub fn get_activator<'p>(
 /// Runs and caches the activation script.
 pub async fn run_activation(
     environment: &Environment<'_>,
+    clean_env: bool,
 ) -> miette::Result<HashMap<String, String>> {
     let activator = get_activator(environment, ShellEnum::default()).map_err(|e| {
         miette::miette!(format!(
@@ -141,6 +142,12 @@ pub async fn run_activation(
         ))
     })?;
 
+    let path_modification_behavior = if clean_env {
+        PathModificationBehavior::Replace
+    } else {
+        PathModificationBehavior::Prepend
+    };
+
     let activator_result = match tokio::task::spawn_blocking(move || {
         // Run and cache the activation script
         activator.run_activation(ActivationVariables {
@@ -151,7 +158,7 @@ pub async fn run_activation(
             conda_prefix: None,
 
             // Prepending environment paths so they get found first.
-            path_modification_behavior: PathModificationBehavior::Prepend,
+            path_modification_behavior,
         })
     })
     .await
@@ -186,7 +193,47 @@ pub async fn run_activation(
         }
     };
 
-    Ok(activator_result)
+    if clean_env && cfg!(windows) {
+        return Err(miette::miette!(
+            format!("It's not possible to run a `clean-env` on Windows as it requires so many non conda specific files that it is basically useless to use. \
+        So pixi currently doesn't support this feature.")));
+    } else if clean_env {
+        let mut cleaned_environment_variables = get_clean_environment_variables();
+
+        // Extend with the original activation environment
+        cleaned_environment_variables.extend(activator_result);
+
+        // Enable this when we found a better way to support windows.
+        // On Windows the path is not completely replace, but we need to strip some paths to keep it as clean as possible.
+        // if cfg!(target_os = "windows") {
+        //     let path = env
+        //         .get("Path")
+        //         .map(|path| {
+        //             // Keep some of the paths
+        //             let win_path = std::env::split_paths(&path).filter(|p| {
+        //                 // Required for base functionalities
+        //                 p.to_string_lossy().contains(":\\Windows")
+        //                     // Required for compilers
+        //                     || p.to_string_lossy().contains("\\Program Files")
+        //                     // Required for pixi environments
+        //                     || p.starts_with(environment.dir())
+        //             });
+        //             // Join back up the paths
+        //             std::env::join_paths(win_path).expect("Could not join paths")
+        //         })
+        //         .expect("Could not find PATH in environment variables");
+        //     // Insert the path back into the env.
+        //     env.insert(
+        //         "Path".to_string(),
+        //         path.to_str()
+        //             .expect("Path contains non-utf8 paths")
+        //             .to_string(),
+        //     );
+        // }
+
+        return Ok(cleaned_environment_variables);
+    }
+    Ok(std::env::vars().chain(activator_result).collect())
 }
 
 /// Get the environment variables that are statically generated from the project and the environment.
@@ -213,6 +260,45 @@ pub fn get_environment_variables<'p>(environment: &'p Environment<'p>) -> HashMa
         .collect()
 }
 
+pub fn get_clean_environment_variables() -> HashMap<String, String> {
+    let env = std::env::vars().collect::<HashMap<_, _>>();
+
+    let unix_keys = if cfg!(unix) {
+        vec![
+            "DISPLAY",
+            "LC_ALL",
+            "LC_TIME",
+            "LC_NUMERIC",
+            "LC_MEASUREMENT",
+            "SHELL",
+            "USER",
+            "USERNAME",
+            "LOGNAME",
+            "HOME",
+            "HOSTNAME",
+        ]
+    } else {
+        vec![]
+    };
+
+    let macos_keys = if cfg!(target_os = "macos") {
+        vec!["TMPDIR", "XPC_SERVICE_NAME", "XPC_FLAGS"]
+    } else {
+        vec![]
+    };
+
+    let keys = unix_keys
+        .into_iter()
+        .chain(macos_keys)
+        // .chain(windows_keys)
+        .map(|s| s.to_string().to_uppercase())
+        .collect_vec();
+
+    env.into_iter()
+        .filter(|(key, _)| keys.contains(&key.to_string().to_uppercase()))
+        .collect::<HashMap<String, String>>()
+}
+
 /// Determine the environment variables that need to be set in an interactive shell to make it
 /// function as if the environment has been activated. This method runs the activation scripts from
 /// the environment and stores the environment variables it added, finally it adds environment
@@ -224,7 +310,10 @@ pub async fn get_activation_env<'p>(
     // Get the prefix which we can then activate.
     get_up_to_date_prefix(environment, lock_file_usage, false).await?;
 
-    environment.project().get_env_variables(environment).await
+    environment
+        .project()
+        .get_env_variables(environment, false)
+        .await
 }
 
 #[cfg(test)]
@@ -253,14 +342,13 @@ mod tests {
 
         let default_env = project.default_environment();
         let env = default_env.get_metadata_env();
-        dbg!(&env);
+
         assert_eq!(env.get("PIXI_ENVIRONMENT_NAME").unwrap(), "default");
         assert!(env.get("PIXI_ENVIRONMENT_PLATFORMS").is_some());
         assert!(env.get("PIXI_PROMPT").unwrap().contains("pixi"));
 
         let test_env = project.environment("test").unwrap();
         let env = test_env.get_metadata_env();
-        dbg!(&env);
 
         assert_eq!(env.get("PIXI_ENVIRONMENT_NAME").unwrap(), "test");
         assert!(env.get("PIXI_PROMPT").unwrap().contains("pixi"));
@@ -294,4 +382,15 @@ mod tests {
             &project.version().as_ref().unwrap().to_string()
         );
     }
+
+    #[test]
+    #[cfg(target_os = "unix")]
+    fn test_get_linux_clean_environment_variables() {
+        let env = get_clean_environment_variables();
+        // Make sure that the environment variables are set.
+        assert_eq!(
+            env.get("USER").unwrap(),
+            std::env::var("USER").as_ref().unwrap()
+        );
+    }
 }

src/cli/run.rs

@@ -9,7 +9,6 @@ use dialoguer::theme::ColorfulTheme;
 use itertools::Itertools;
 use miette::{miette, Context, Diagnostic, IntoDiagnostic};
 
-use crate::activation::get_environment_variables;
 use crate::environment::verify_prefix_location_unchanged;
 use crate::project::errors::UnsupportedPlatformError;
 use crate::task::{
@@ -47,6 +46,12 @@ pub struct Args {
 
     #[clap(flatten)]
     pub config: ConfigCli,
+
+    /// Use a clean environment to run the task
+    ///
+    /// Using this flag will ignore your current shell environment and use bare minimum environment to activate the pixi environment in.
+    #[arg(long)]
+    pub clean_env: bool,
 }
 
 /// CLI entry point for `pixi run`
@@ -166,8 +171,12 @@ pub async fn execute(args: Args) -> miette::Result<()> {
         let task_env: &_ = match task_envs.entry(executable_task.run_environment.clone()) {
             Entry::Occupied(env) => env.into_mut(),
             Entry::Vacant(entry) => {
-                let command_env =
-                    get_task_env(&mut lock_file, &executable_task.run_environment).await?;
+                let command_env = get_task_env(
+                    &mut lock_file,
+                    &executable_task.run_environment,
+                    args.clean_env || executable_task.task().clean_env(),
+                )
+                .await?;
                 entry.insert(command_env)
             }
         };
@@ -230,6 +239,7 @@ fn command_not_found<'p>(project: &'p Project, explicit_environment: Option<Envi
 pub async fn get_task_env<'p>(
     lock_file_derived_data: &mut LockFileDerivedData<'p>,
     environment: &Environment<'p>,
+    clean_env: bool,
 ) -> miette::Result<HashMap<String, String>> {
     // Make sure the system requirements are met
     verify_current_platform_has_required_virtual_packages(environment).into_diagnostic()?;
@@ -239,19 +249,13 @@ pub async fn get_task_env<'p>(
 
     // Get environment variables from the activation
     let activation_env = await_in_progress("activating environment", |_| {
-        crate::activation::run_activation(environment)
+        crate::activation::run_activation(environment, clean_env)
     })
     .await
     .wrap_err("failed to activate environment")?;
 
-    // Get environments from pixi
-    let environment_variables = get_environment_variables(environment);
-
     // Concatenate with the system environment variables
-    Ok(std::env::vars()
-        .chain(activation_env)
-        .chain(environment_variables)
-        .collect())
+    Ok(activation_env)
 }
 
 #[derive(Debug, Error, Diagnostic)]

src/cli/shell_hook.rs

@@ -88,7 +88,10 @@ async fn generate_activation_script(
 /// Generates a JSON object describing the changes to the shell environment when
 /// activating the provided pixi environment.
 async fn generate_environment_json(environment: &Environment<'_>) -> miette::Result<String> {
-    let environment_variables = environment.project().get_env_variables(environment).await?;
+    let environment_variables = environment
+        .project()
+        .get_env_variables(environment, false)
+        .await?;
     let shell_env = ShellEnv {
         environment_variables,
     };

src/cli/task.rs

@@ -81,6 +81,10 @@ pub struct AddArgs {
     /// The environment variable to set, use --env key=value multiple times for more than one variable
     #[arg(long, value_parser = parse_key_val)]
     pub env: Vec<(String, String)>,
+
+    /// Isolate the task from the shell environment, and only use the pixi environment to run the task
+    #[arg(long)]
+    pub clean_env: bool,
 }
 
 /// Parse a single key-value pair
@@ -149,6 +153,7 @@ impl From<AddArgs> for Task {
         } else if depends_on.is_empty() && value.cwd.is_none() && value.env.is_empty() {
             Self::Plain(cmd_args)
         } else {
+            let clean_env = value.clean_env;
             let cwd = value.cwd;
             let env = if value.env.is_empty() {
                 None
@@ -166,6 +171,7 @@ impl From<AddArgs> for Task {
                 outputs: None,
                 cwd,
                 env,
+                clean_env,
             })
         }
     }