I had an issue with code released to a client today that I would only have caught if I’d been using a virtualenv that started with no 3rd-party modules installed. That is when activating it it must cut off access to the existing 3rd-party modules available on the system; such that the only 3rd-party modules available within the virtualenv would be those I’ve explicitly installed. How can I create such a virtualenv?

Research I’ve done on this site suggests that --no-site-packages, a flag virtualenv once supported, was removed because that behavior is now the default. Well, when I create a virtualenv, activate it, and run pip3 list, the output has 542 lines, so no that is not the case.

$ mkdir test_venv
$ python3 -m venv test_venv/
$ cd test_venv/
$ source bin/activate
(test_venv) $ pip3 list | head -n 20
Package                            Version
---------------------------------- -------------------------
aiohttp                            3.8.3
aiosignal                          1.3.1
alembic                            1.13.1
annotated-types                    0.7.0
anyio                              3.6.2
appdirs                            1.4.4
apsw                               3.40.0.0
apt-clone                          0.2.1
apturl                             0.5.2
argon2-cffi                        21.1.0
asttokens                          2.2.1
async-generator                    1.10
async-timeout                      4.0.2
attrs                              22.2.0
Automat                            22.10.0
Babel                              2.10.3
backcall                           0.2.0
bcrypt                             3.2.2
(test_venv) $ pip3 list | wc -l
542
(test_venv) $

How can I create a virtualenv that I can use to catch non-obvious dependencies that pipreqs doesn’t? It really needs to only contain the modules I explicitly install. virtualenv used without arguments does not create this.