Fix caching of exposed packages

The problem with --ignore-installed is that it also ignores packages in
the target site, therefore re-installing all packages and making caching
futile.

Install snekbox's dependencies to the default user site. During
installation of the exposed packages, switch the user site to a custom
one to ensure pip will not skip packages due to seeing them as already
installed as one of snekbox's dependencies.

If pip made the --root option ignore packages outside the root, then
using --root would be the best solution. There is a 5+ year old issue
open about that.

1 files changed, 8 insertions, 9 deletions

diff --git a/Dockerfile b/Dockerfile
index 62d8bcb..87ece7d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,11 +21,15 @@ RUN make
 
 # ------------------------------------------------------------------------------
 FROM python:3.9-slim-buster as base
-ENV PIP_NO_CACHE_DIR=false \
+
+# Everything will be a user install to allow snekbox's dependencies to be kept
+# separate from the packages exposed during eval.
+ENV PATH=/root/.local/bin:$PATH \
+    PIP_NO_CACHE_DIR=false \
+    PIP_USER=1 \
     PIPENV_DONT_USE_PYENV=1 \
     PIPENV_HIDE_EMOJIS=1 \
-    PIPENV_NOSPIN=1 \
-    PYTHONUSERBASE=/snekbox/user_base
+    PIPENV_NOSPIN=1
 
 RUN apt-get -y update \
     && apt-get install -y \
@@ -42,15 +46,10 @@ RUN chmod +x /usr/sbin/nsjail
 FROM base as venv
 ARG DEV
 
-ENV PIP_NO_CACHE_DIR=false \
-    PIPENV_DONT_USE_PYENV=1 \
-    PIPENV_HIDE_EMOJIS=1 \
-    PIPENV_NOSPIN=1 \
-    PYTHONUSERBASE=/snekbox/user_base
-
 COPY Pipfile Pipfile.lock /snekbox/
 WORKDIR /snekbox
 
+# Install to the default user site since PIP_USER is set.
 RUN pipenv install --deploy --system ${DEV:+--dev}
 
 # At the end to avoid re-installing dependencies when only a config changes.