conda-incubator/conda-protect

Protect conda environments to avoid mistakenly modifying them

conda-protect 🔐

Protect conda environments to avoid mistakenly modifying them.

In conda, it's sometimes nice to set certain environments as "off-limits". This can especially be true for the base environment. This plugin that allows you to protect arbitrary environments, and it will cause conda to exit early on the following commands if an environment is protected:

• install
• create
• update
• remove
• env remove
• env update (still not fully supported)

Install

You can install this plugin by running the following command:

conda install -c conda-forge conda-protect

Usage

Conda protect installs several new subcommands for conda: one for protecting environments protect and one for listing guarded environments plist. These commands are explained in further detail below:

Protecting environments

To guard an environment, run the protect subcommand:

$ conda protect base
base is 🔐 protected

Now, when you try to run a command against this environment, conda will exit early:

$ conda install -n base python

CondaProtectError: Environment "base" is currently protected. Run `conda protect 'base'` to remove protection.

If you want to remove a protection to add/modify anything, just run the protect subcommand again:

$ conda protect base
base is unprotected 🔓

Listing environments and showing protection status

Conda protect also installs a plist subcommand that comes in handy when you've forgotten which environments are protected:

$ conda protect --list
                        Conda Environments
┏━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┓
┃ Name      ┃ Prefix                                ┃ Status       ┃
┡━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━┩
│ -         │ /tmp/user1-test-env-one               │ 🔐 protected │
│ base      │ /home/user1/opt/conda/                │ 🔐 protected │
│ test_env1 │ /home/user1/opt/conda/envs/test_env1  │ 🔐 protected │
│ test_env2 │ /home/user1/opt/conda/envs/test_env2  │              │
│ test_env3 │ /home/user1/opt/conda/envs/test_env3  │              │
└───────────┴───────────────────────────────────────┴──────────────┘

You can also list just the protected environments with the --protected option:

$ conda protect --list --protected
                        Conda Environments
┏━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┓
┃ Name      ┃ Prefix                                ┃ Status       ┃
┡━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━┩
│ -         │ /tmp/user1-test-env-one               │ 🔐 protected │
│ base      │ /home/user1/opt/conda/                │ 🔐 protected │
│ test_env1 │ /home/user1/opt/conda/envs/test_env1  │ 🔐 protected │
└───────────┴───────────────────────────────────────┴──────────────┘

conda-protect's Issues

Add `-h` as alias for `--help`

I noticed the plugin raises an exception when I tried conda protect -h. Since conda accepts -h, this was a little confusing.

Also, since the exception was unhandled, it triggered the generic "There is an error in a plugin" message from conda, which is very verbose.

❯ conda protect -h

# >>>>>>>>>>>>>>>>>>>>>> ERROR REPORT <<<<<<<<<<<<<<<<<<<<<<

    Traceback (most recent call last):
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/parser.py", line 514, in _process_opts
        self._match_long_opt(norm_long_opt, explicit_value, state)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/parser.py", line 398, in _match_long_opt
        raise NoSuchOption(opt, possibilities=possibilities, ctx=self.ctx)
    click.exceptions.NoSuchOption: No such option: -h

    During handling of the above exception, another exception occurred:

    Traceback (most recent call last):
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/conda/exception_handler.py", line 17, in __call__
        return func(*args, **kwargs)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/conda/cli/main.py", line 83, in main_subshell
        exit_code = do_call(args, parser)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/conda/cli/conda_argparse.py", line 175, in do_call
        result = plugin_subcommand.action(getattr(args, "_args", args))
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/conda_protect/main.py", line 226, in guard_wrapper
        guard(args=args, prog_name=f"conda {GUARD_COMMAND_NAME}", standalone_mode=False)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/core.py", line 1157, in __call__
        return self.main(*args, **kwargs)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/core.py", line 1077, in main
        with self.make_context(prog_name, args, **extra) as ctx:
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/core.py", line 943, in make_context
        self.parse_args(ctx, args)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/core.py", line 1405, in parse_args
        opts, args, param_order = parser.parse_args(args=args)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/parser.py", line 337, in parse_args
        self._process_args_for_options(state)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/parser.py", line 364, in _process_args_for_options
        self._process_opts(arg, state)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/parser.py", line 523, in _process_opts
        self._match_short_opt(arg, state)
      File "/Users/mattkram/miniconda3/lib/python3.10/site-packages/click/parser.py", line 436, in _match_short_opt
        raise NoSuchOption(opt, ctx=self.ctx)
    click.exceptions.NoSuchOption: No such option: -h

`$ /Users/mattkram/miniconda3/bin/conda protect -h`

 <REDACTED>

An unexpected error has occurred. Conda has prepared the above report.
If you suspect this error is being caused by a malfunctioning plugin,
consider using the --no-plugins option to turn off plugins.

Example: conda --no-plugins install <package>

Alternatively, you can set the CONDA_NO_PLUGINS environment variable on
the command line to run the command without plugins enabled.

Example: CONDA_NO_PLUGINS=true conda install <package>

Upload successful.

IMHO: conda plist should be "conda protect list"

I suggest keeping all commands under the "conda protect" namespace to keep the "global" namespace cleaner.

Don't block `--dry-run` (`-d`) updates

When I have an environment protected, I still sometimes want to see what is out of date and can be updated.

In such a case I usually run conda update --all --dry-run which since its not actually changing the environment would be useful to see that supported.

Discontinue use of `context.active_prefix`

Based on discussions from conda/conda#12704, this project should instead do this:

def custom_plugin_pre_commands_action(command: str, args):
    if is_environment_locked(context.target_prefix):
        raise CondaEnvLockError(
            f"Environment \"{context.target_prefix}\" is currently locked. "
            f"Run `conda envlock '{context.target_prefix}'` to unlock it"
        )

Move to `conda-incubator`?

I really like this project. It's a commonly asked feature that should be part of some opinionated book of conda best practices, and I think it would benefit from having more visibility.

WDYT @travishathaway?

Add a manual short-term unlock/lock context manager thing

It would be nice if there was a way to conda install that explicitly un-protects the environment, does the install, then re-protects at the end. In Python, this would use a context manager pattern:

# Pseudocode
with un_protect(env):
  do_install()
# Environment gets `conda protect env`'d after exiting the with block

But at the CLI it might be something like: conda force-install numpy or something. I'm not sure what the best naming would be, but it would help with usability. Ideally the subcommand name is different enough from install that it would be really hard to accidentally use it.