Workspace allows dbf path to install in Databricks 16.4 LTS

AniruddhaGI
New Contributor II

Feature: Library installation using requirements.txt on DB Runtime 16.4 LTS
Affected Areas: Workspace isolation, Library Management

Steps to Reproduce:

  1. Upload a wheel file to dbf

  2. Put the requirements.txt file in the Workspace and put dbfs path in requirements file

  3. In the requirements.txt, include the line:
    Install the requirements.txt file using the install feature in the UI.

Actual Behavior:
The library is successfully installed from the /dbfs path. This bypasses intended workspace isolation and allows cross-workspace library installation using shared file paths.

Expected Behavior:
The installation should fail or disallow usage of /dbfs paths that point to shared or non-local workspace files. Workspaces should be isolated and not have access to shared or external /dbfs content unless explicitly permitted.

Potential Impact:

  • Breaks workspace isolation guarantees.

  • May lead to security, compliance, or dependency management issues in regulated or multi-tenant environments.

  • Risk of using unverified or unintended code across environments.