Conda

A Conda firewall serves a Conda channel: channeldata.json, per-platform repodata.json, and package artifacts (.conda, .tar.bz2). conda, mamba, and micromamba install through it; rules filter the package metadata and block artifact downloads. Conda support is in beta.

The examples use <namespace-id> and <firewall-id> placeholders. Replace them with IDs, not with namespace or firewall names. The firewall's Setup tab shows these snippets with both values already filled in.

Channel endpoint

https://eu-sov-1.bytesafecloud.eu/v1/<namespace-id>/conda/<firewall-id>

The namespace ID and firewall ID are part of the URL. Use HTTP basic authentication. Set the username to the literal value __token__ and the password to your Bytesafe access token.

A Conda firewall created without upstreams gets conda-forge (https://conda.anaconda.org/conda-forge) as its default upstream; point it elsewhere on the firewall's Upstreams tab.

Configure the client

Use the firewall as the only channel, with credentials embedded in the URL:

export BYTESAFE_TOKEN=<your token>
export CHANNEL_URL="https://__token__:${BYTESAFE_TOKEN}@eu-sov-1.bytesafecloud.eu/v1/<namespace-id>/conda/<firewall-id>"

conda install --override-channels -c "$CHANNEL_URL" numpy

export BYTESAFE_TOKEN=<your token>
export CHANNEL_URL="https://__token__:${BYTESAFE_TOKEN}@eu-sov-1.bytesafecloud.eu/v1/<namespace-id>/conda/<firewall-id>"

micromamba install --override-channels -c "$CHANNEL_URL" numpy

Always pass --override-channels (or clear the channels list in .condarc): otherwise defaults or a cached conda-forge entry can resolve packages around the firewall.

To persist the channel instead of passing -c on every command, set it in .condarc:

channels:
  - https://__token__:<your token>@eu-sov-1.bytesafecloud.eu/v1/<namespace-id>/conda/<firewall-id>

This writes the token in plain text into .condarc, because conda channels have no separate credential store. Keep that file out of version control and out of shared images. If you need the channel in a repository or a CI image, pass -c "$CHANNEL_URL" from an environment variable instead.

What the firewall serves

Conda clients may request current_repodata.json, repodata_from_packages.json, or compressed .zst and .bz2 variants. The firewall applies the same filtering and returns the requested format.

How rules apply

Rules on the versions execution phase filter package records out of repodata.json before the solver sees them; a filtered version cannot be picked. Rules on the download phase block the artifact fetch itself.

Selectors match the Conda package's name and version fields from the repodata record. Different builds of one version are distinct artifacts, but version selectors intentionally match the Conda version, not the build string. Age-based selectors (delay new versions) use the repodata record's timestamp.

Beta limits

Two selector functions are limited in the beta. See the selector function matrix:

• vulnerabilities is not supported for Conda; the dashboard does not offer it for Conda firewalls, and the API rejects a JSON-configured rule or exception.
• license has no data source for Conda packages, so versions resolve as unknown license; only the function's unknown option has an effect.

Verify

The install command under Configure the client is the client verification. --override-channels excludes other configured channels. If numpy may already be installed or cached, use a fresh environment and clear the package cache before testing.

If a rule matched during the install, inspect its firewall log entry:

bsfw logs --firewall <firewall-id>

CI

Use a Service Access Token (SAT) instead of a PAT. A SAT identifies the CI system rather than a person. Create one as described in Access Tokens, store it as a CI secret, and build the channel URL from it.

To correlate firewall log entries from one pipeline run, append :: and the run ID to the token. The firewall validates the token before the suffix and records the suffix as the interaction ID.

export CHANNEL_URL="https://__token__:${BYTESAFE_TOKEN}::${CI_PIPELINE_ID}@eu-sov-1.bytesafecloud.eu/v1/<namespace-id>/conda/<firewall-id>"

Use the same value for every package request in the run. See Correlating requests with interaction IDs for the token format and CLI options.

Publishing

There is no publish support for Conda in the beta: the firewall serves channels read-only, and the upload phase does not apply.

What a blocked install looks like

A versions rule removes the package record from repodata.json, so the solver fails to find the package or version; the client reports it as unsolvable or not found from the configured channels.

A download rule blocks the artifact fetch. The firewall returns a 404 with:

numpy@2.3.1 is blocked. Check firewall log entries for request <request-id> for details

Take the request ID to the logs to see which rule fired. See Investigate a blocked install.

Troubleshooting

Related

• How-to: Delay new versions, Configure upstreams
• Concept: Rule evaluation
• Reference: Rules and selectors, Selector functions