Support pure/isolated environments

[matrss]

Problem description

pixi should allow shell/run to use a pure and isolated environment, similar to how guix supports it. What I mean by that is that pixi should make it (optionally) impossible to use tools/dependencies/packages, which are not installed with pixi.

To cite the guix docs:

By default, the shell session or command runs in an augmented environment, where the new packages are added to search path environment variables such as PATH. You can, instead, choose to create an isolated environment containing nothing but the packages you asked for. Passing the --pure option clears environment variable definitions found in the parent environment14; passing --container goes one step further by spawning a container isolated from the rest of the system:

(From: https://guix.gnu.org/en/manual/devel/en/guix.html#Invoking-guix-shell)

What we currently have is what they call an augmented environment. A pure environment would reduce "works on my machine" errors due to mistakenly using packages not installed into the pixi project. This would also side-step issues like #246 and in general be an improvement to reproducibility.

[baszalmstra]

I like this a lot.

[ctb]

yes please!

[ruben-arts]

I'm taking a look at this issue.

Sharing a few of my learnings.

I'm now (as a prototype) excluding std::env::vars() from the environments, and completely replacing the $PATH with only the pixi environment.

On linux, I can run pixi run install in pixi (e.g. compiling pixi including some C stuff) when I add the following packages:

pixi add make coreutils grep findutils

These packages install tools like cp rm mv fin etc. Which I'm not sure is a nice flow. But it at least is fully isolated 🤷‍♂️

Some questions that come to mind.

Should we embed the "isolated" toggle in the CLI or in the task definition, possibly both? Some ideas:

pixi run --isolated python main.py

[tasks]
build-iso = {cmd = "cargo build --release", isolated = true}

[ruben-arts]

I could also imagine a user wanting to specify it per environment 🤔

[ruben-arts]

Leaving this here for future reference for the clean env feature on windows. When we find a way to improve the cleaning of a windows shell environment.

// Enable this when we found a better way to support windows.
// On Windows the path is not completely replace, but we need to strip some paths to keep it as clean as possible.
if cfg!(target_os = "windows") {
    let path = env
        .get("Path")
        .map(|path| {
            // Keep some of the paths
            let win_path = std::env::split_paths(&path).filter(|p| {
                // Required for base functionalities
                p.to_string_lossy().contains(":\\Windows")
                    // Required for compilers
                    || p.to_string_lossy().contains("\\Program Files")
                    // Required for pixi environments
                    || p.starts_with(environment.dir())
            });
            // Join back up the paths
            std::env::join_paths(win_path).expect("Could not join paths")
        })
        .expect("Could not find PATH in environment variables");
    // Insert the path back into the env.
    env.insert(
        "Path".to_string(),
        path.to_str()
            .expect("Path contains non-utf8 paths")
            .to_string(),
    );
}