Bazel is using user site packages by default

[jwnimmer-tri]

Something like

• https://docs.python.org/2/library/site.html#site.USER_SITE
  or
• https://docs.python.org/2/library/site.html#site.USER_BASE

is enabled by default when Bazel is running python stuff, which means that $HOME/.local can non-hermetically enter the build.

This is bad in general, but specifically bad for genrules such as https://github.com/RobotLocomotion/drake/blob/master/tools/workspace/godotengine/main_make_binders.py where we do import core and some other thing in .local was named core, and then poof our genrule fails.

Note that this is different than PYTHONPATH leaks -- I think we are correctly guarding against PYTHONPATH breaking the hermetic seal. The user site mechanism appears to operate distinctly and outside of the PYTHONPATH mechanisms.

More details / fixes to follow as I explore more. This is just a placeholder for now.

[jwnimmer-tri]

Filed upstream as bazelbuild/bazel#4939.

[jwnimmer-tri]

If I'm recalling correctly, #8476 fixed tools (genrules, actions, etc.) that use python, but did not isolate things like unit tests, which still use user site-packages.

Now that we have platform-specific bazel rcfiles, I believe we could disable $HOME on Ubuntu only. Seems like we should? WDYT?

[EricCousineau-TRI]

Hm... What if we did something like adding test --test_env=PYTHONNOUSERSITE=1 to ubuntu-bionic.bazelrc?

But yes, I'm down for whatever can cut that off from affecting unittests.

[jwnimmer-tri]

Yes, that's essentially what I was proposing. Though we'd need to check if --test_env causes too much flux when alternating bazel build //... vs bazel test //.... (I see to recall it re-runs the analysis phase if you use test --test_env, should use build --test_env instead possibly.) We may need to use --action_env as well / alternatively.

[jwnimmer-tri]

FYI I'm prototyping the rcfile changes in Anzu. If we bake that for a while and like it, I'll pull the changes into Drake (Ubuntu only) next.

[jwnimmer-tri]

We've had this in TRI (Anzu) since March. It seems to be working great:

# Disable python imports from ~/.local (pip -U) during build and test.
# https://github.com/bazelbuild/bazel/issues/4939
# https://github.com/RobotLocomotion/drake/issues/8475
build --action_env=PYTHONNOUSERSITE=1
build --test_env=PYTHONNOUSERSITE=1

We should probably add it to our Ubuntu rcfile in Drake.