Skip to main content
emisar

Python application runtime

v0.1.14

Inspect a Python deployment — interpreter + venv state, pip inventory + freeze, dependency conflicts, outdated packages, sys.path. Read-only. Most actions act on the venv at PY_VENV env var (default /opt/app/venv).

10 allowed by default
Pack ID
python-app
Vendor
emisar
OS
linux
Actions
10
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
python3

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install python-app --hash sha256:c4f2742644b6779aef5ed7a5512863dee5f33a999ec89679b84fa1f19b2db307

Setup

Inspects a local Python deployment on the runner host — interpreter, venv, and pip state — no credentials needed.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • PY_VENV default /opt/app/venv

    Path to the application's virtualenv; the venv-scoped actions run its bin/python and bin/pip. Optional; defaults to /opt/app/venv . Add it to the runner's inherit_env if you override it.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Read a virtual environment owned by another operating-system user.

py.venv_python_versionpy.pip_listpy.pip_freezepy.pip_showpy.pip_checkpy.pip_outdatedpy.sys_pathpy.site_packages_dupy.pip_cache_info

Add the Emisar service user to the group that owns the venv

Grant access 
sudo usermod -aG "$(stat -c %G /opt/app/venv)" emisar
sudo chmod -R g+rX /opt/app/venv
sudo systemctl restart emisar
Verify access 
id -nG emisar | tr ' ' '\n' | grep -Fx "$(stat -c %G /opt/app/venv)"
sudo -u emisar test -r /opt/app/venv/bin/python

Impact: Every process running as emisar can read whatever the deployment group grants on this host, not only the virtual environment. It gets no write access and no other user's files. Substitute your own PY_VENV for /opt/app/venv , and note that an action declaring execution.user replaces these inherited supplementary groups.

Run the Emisar service as root (last resort)

Grant access 
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-python-app-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar
Verify access 
test "$(systemctl show emisar --property=User --value)" = root

Impact: Every Emisar action on this runner executes as root and can read application code, installed packages, and any credentials stored beside the virtual environment. Reading a venv is a filesystem-permission problem, so take the group grant above unless the venv's owner genuinely cannot share a group.

Notes

  • System actions use /usr/bin/python3 ; venv actions use PY_VENV .

Verify it works

Runs py.python_version_system, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify python-app

Install and configure a pack walks through the whole sequence on a host.

Actions 10 total

View on GitHub
  • py.pip_cache_info exec low Low — read-only or trivially reversible

    $PY_VENV/bin/pip cache info

    Show pip cache size + location.

    View source on GitHub
  • py.pip_check exec low Low — read-only or trivially reversible

    $PY_VENV/bin/pip check

    Check for dependency conflicts. Empty output means clean.

    View source on GitHub
  • py.pip_freeze exec low Low — read-only or trivially reversible

    $PY_VENV/bin/pip freeze

    Dump installed packages in requirements format.

    View source on GitHub
  • py.pip_list exec low Low — read-only or trivially reversible

    $PY_VENV/bin/pip list

    List installed packages with versions.

    View source on GitHub
  • py.pip_outdated exec low Low — read-only or trivially reversible

    $PY_VENV/bin/pip list --outdated

    List packages with newer versions available.

    View source on GitHub
  • py.pip_show exec low Low — read-only or trivially reversible

    $PY_VENV/bin/pip show <pkg>

    Show details for one package (version, deps, location).

    View source on GitHub
  • py.python_version_system exec low Low — read-only or trivially reversible

    python3 --version (system)

    Show the system python interpreter version.

    View source on GitHub
  • py.site_packages_du exec low Low — read-only or trivially reversible

    du -sh site-packages/*

    Show disk usage per installed package — find bloated installs.

    View source on GitHub
  • py.sys_path exec low Low — read-only or trivially reversible

    python -c 'import sys; print(sys.path)'

    Show the effective sys.path for the venv interpreter.

    View source on GitHub
  • py.venv_python_version exec low Low — read-only or trivially reversible

    $PY_VENV/bin/python --version

    Show the interpreter version inside the configured venv.

    View source on GitHub
← Back to registry
Pack reference  Publish your own