fix: Stop using PYTHONPATH to set up sys.path

python/private/common/attributes.bzl

@@ -168,6 +168,15 @@ Specifies additional environment variables to set when the target is executed by
         # The value is required, but varies by rule and/or rule type. Use
         # create_stamp_attr to create one.
         "stamp": None,
+        "_entrypoint_py_template": attr.label(
+            default = "@rules_python//python/private/common:entrypoint.tmpl.py",
+            allow_single_file = True,
+        ),
+        "_runfiles": attr.label(
+            default = "@rules_python//python/runfiles",
+            providers = [PyInfo],
+        ),
+
     },
     allow_none = True,
 )

python/private/common/common.bzl

@@ -262,7 +262,11 @@ def filter_to_py_srcs(srcs):
     return [f for f in srcs if f.extension == "py"]
 
 def collect_imports(ctx, semantics):
-    return depset(direct = semantics.get_imports(ctx), transitive = [
+    if hasattr(ctx.attr, "_runfiles"):
+        base = [ctx.attr._runfiles[PyInfo].imports]
+    else:
+        base = []
+    return depset(direct = semantics.get_imports(ctx), transitive = base + [
         dep[PyInfo].imports
         for dep in ctx.attr.deps
         if PyInfo in dep

python/private/common/entrypoint.tmpl.py

@@ -0,0 +1,21 @@
+import runpy
+import sys
+from pathlib import Path
+
+from python.runfiles import runfiles
+
+RUNFILES = runfiles.Create()
+RUNFILES_DIR = Path(RUNFILES.EnvVars()["RUNFILES_DIR"])
+MAIN = RUNFILES_DIR / "%MAIN_REPO%/%MAIN_SHORT_PATH%"
+
+IMPORTS = %IMPORTS%
+
+# Work around sys.path[0] escaping the sandbox by deleting it.
+# See https://github.com/bazelbuild/rules_python/issues/382 for more info.
+# TODO(phil): How do we distinguish between safe-path Python and non-safe-path
+# Python? I.e. how do we know if sys.path[0] should be deleted or not?
+del sys.path[0]
+
+sys.path[0:0] = [str(RUNFILES_DIR / path) for path in IMPORTS]
+
+runpy.run_path(str(MAIN), run_name="__main__")

python/private/common/py_executable.bzl

@@ -14,6 +14,7 @@
 """Common functionality between test/binary executables."""
 
 load("@bazel_skylib//lib:dicts.bzl", "dicts")
+load("@bazel_skylib//lib:paths.bzl", "paths")
 load("//python/private:reexports.bzl", "BuiltinPyRuntimeInfo")
 load(
     ":attributes.bzl",
@@ -125,11 +126,26 @@ def py_executable_base_impl(ctx, *, semantics, is_test, inherited_environment =
     _validate_executable(ctx)
 
     main_py = determine_main(ctx)
+
+    entrypoint_py = ctx.actions.declare_file(
+        paths.replace_extension(main_py.basename, "_entrypoint.py"),
+        sibling = main_py,
+    )
+
     direct_sources = filter_to_py_srcs(ctx.files.srcs)
-    output_sources = semantics.maybe_precompile(ctx, direct_sources)
+    output_sources = semantics.maybe_precompile(ctx, direct_sources) + [entrypoint_py]
     imports = collect_imports(ctx, semantics)
     executable, files_to_build = _compute_outputs(ctx, output_sources)
 
+    _generate_entrypoint_py(
+        ctx,
+        imports = imports,
+        main_py = main_py,
+        entrypoint_py = entrypoint_py,
+    )
+    main_py = entrypoint_py
+    imports = depset()
+
     runtime_details = _get_runtime_details(ctx, semantics)
     if ctx.configuration.coverage_enabled:
         extra_deps = semantics.get_coverage_deps(ctx, runtime_details)
@@ -158,6 +174,7 @@ def py_executable_base_impl(ctx, *, semantics, is_test, inherited_environment =
             cc_details.extra_runfiles,
             native_deps_details.runfiles,
             semantics.get_extra_common_runfiles_for_binary(ctx),
+            ctx.attr._runfiles[DefaultInfo].default_runfiles,
         ],
         semantics = semantics,
     )
@@ -201,6 +218,18 @@ def py_executable_base_impl(ctx, *, semantics, is_test, inherited_environment =
         providers = modern_providers,
     )
 
+def _generate_entrypoint_py(ctx, imports, main_py, entrypoint_py):
+    ctx.actions.expand_template(
+        template = ctx.file._entrypoint_py_template,
+        output = entrypoint_py,
+        substitutions = {
+            # Is there a better way to retrieve the name of the main repo?
+            "%MAIN_REPO%": ctx.label.workspace_name or ctx.workspace_name,
+            "%MAIN_SHORT_PATH%": main_py.short_path,
+            "%IMPORTS%": json.encode_indent(imports.to_list()),
+        },
+    )
+
 def _get_build_info(ctx, cc_toolchain):
     build_info_files = py_internal.cc_toolchain_build_info_files(cc_toolchain)
     if cc_helper.is_stamping_enabled(ctx):