Workspace allows dbf path to install in Databricks 16.4 LTS

[AniruddhaGI]

Feature: Library installation using requirements.txt on DB Runtime 16.4 LTS
Affected Areas: Workspace isolation, Library Management

Steps to Reproduce:

1. Upload a wheel file to dbf

2. Put the requirements.txt file in the Workspace and put dbfs path in requirements file

3. In the requirements.txt, include the line:
   Install the requirements.txt file using the install feature in the UI.

Actual Behavior:
The library is successfully installed from the /dbfs path. This bypasses intended workspace isolation and allows cross-workspace library installation using shared file paths.

Expected Behavior:
The installation should fail or disallow usage of /dbfs paths that point to shared or non-local workspace files. Workspaces should be isolated and not have access to shared or external /dbfs content unless explicitly permitted.

Potential Impact:

• Breaks workspace isolation guarantees.

• May lead to security, compliance, or dependency management issues in regulated or multi-tenant environments.

• Risk of using unverified or unintended code across environments.

[AniruddhaGI]

I would like to know if the workspace isolation is a priority, and only Databricks 14.3 and lower allow installation via DBFS.

Why should the requirements.txt allow you to install libraries or packages via dbfs path?

Could someone please explain why this is the case?