CML Python Package Installation Security

[#1]

Hello,

I've noticed how the CML Terminal lets you install Python packages on the 'Net using pip.

(A gcc compiler is even available!)

Isn't that a security risk?

Is there a way to only allow package installation from an in-house repository?

Many thanks.

[#2 · Accepted solution]

pip index url can be configured as an admin environment variable, but users can override the same with the project environment variable or manual override.

utmost way is to make the cluster air gapped. As long as the cluster has internet gateway, sessions can reach internet to pull the packages