在Anaconda虚拟环境中安装非python软件包（java更新，c ++更新）是否安全？

Question

I am running Anaconda on MacOS and I have multiple virtual environments for different versions of Python, TensorFlow, Pytorch, etc...

Recently I have tried to install Auto-Keras and to build Tensorflow from the source (each in a separate virtual env), and in both cases it asked me to update a bunch of C++ stuff (SWIG, gcc,..), a new java version, among other things, and occasionally it is asking me for my root password halfway through the process.

With Python style pip install <lib> I always assumed it was safe to do whatever I wanted in a given virtual env, since the whole point what that it containerized the dependencies and packages, and installs in other virtual env won't be broken.

But in this case, I am worried, since:

a) They are not installed using pip or conda

b) It keeps asking me to type in my admin password and changing global configurations like the Java vision etc....

Are other packages besides python packages "containerized" in the same way that Python packages are in a virtual env?

If not, do I risk breaking stuff by upgrading C++, SWIG, Java, etc...?

Answer 1

First, virtual env gives you no protection:) It just modifies PATH environment variable. You are not in a safe sandbox even with Python packages. pip install xxx will execute setup.py which could also introduce malware.

Second, yes, they are asking you for sudo permission, and definitely, it is dangerous. But you still can trust who is worth to trust. After all, you still use a third-party OS instead of creating it on your own right?