@@ -237,6 +237,13 @@ class UnitsConfig(TestConfig):

         self.collect_only = args.collect_only  # type: bool

+        self.requirements_mode = args.requirements_mode if 'requirements_mode' in args else ''

+

+        if self.requirements_mode == 'only':

+            self.requirements = True

+        elif self.requirements_mode == 'skip':

+            self.requirements = False

+

 class CoverageConfig(EnvironmentConfig):

     """Configuration for the coverage command."""

@@ -275,6 +275,29 @@ def delegate_docker(args, exclude, require, integration_targets):

             if isinstance(args, UnitsConfig) and not args.python:

                 cmd += ['--python', 'default']

+            # run unit tests unprivileged to prevent stray writes to the source tree

+            if isinstance(args, UnitsConfig):

+                writable_dirs = [

+                    '/root/ansible/lib/ansible.egg-info',

+                    '/root/ansible/.pytest_cache',

+                ]

+

+                docker_exec(args, test_id, ['mkdir', '-p'] + writable_dirs)

+                docker_exec(args, test_id, ['chmod', '777'] + writable_dirs)

+

+                docker_exec(args, test_id, ['find', '/root/ansible/test/results/', '-type', 'd', '-exec', 'chmod', '777', '{}', '+'])

+

+                docker_exec(args, test_id, ['chmod', '755', '/root'])

+                docker_exec(args, test_id, ['chmod', '644', '/root/ansible/%s' % args.metadata_path])

+

+                docker_exec(args, test_id, ['useradd', 'pytest', '--create-home'])

+

+                docker_exec(args, test_id, cmd + ['--requirements-mode', 'only'], options=cmd_options)

+

+                cmd += ['--requirements-mode', 'skip']

+

+                cmd_options += ['--user', 'pytest']

+

             try:

                 docker_exec(args, test_id, cmd, options=cmd_options)

             finally:

@@ -12,6 +12,7 @@ import time

 import textwrap

 import functools

 import pipes

+import sys

 import hashlib

 import lib.pytar

@@ -49,6 +50,8 @@ from lib.util import (

     raw_command,

     get_coverage_path,

     get_available_port,

+    generate_pip_command,

+    find_python,

 )

 from lib.docker_util import (

@@ -148,9 +151,10 @@ def create_shell_command(command):

     return cmd

-def install_command_requirements(args):

+def install_command_requirements(args, python_version=None):

     """

     :type args: EnvironmentConfig

+    :type python_version: str | None

     """

     generate_egg_info(args)

@@ -168,7 +172,10 @@ def install_command_requirements(args):

         if args.junit:

             packages.append('junit-xml')

-    pip = args.pip_command

+    if not python_version:

+        python_version = args.python_version

+

+    pip = generate_pip_command(find_python(python_version))

     commands = [generate_pip_install(pip, args.command, packages=packages)]

@@ -1133,8 +1140,6 @@ def command_units(args):

     if args.delegate:

         raise Delegate(require=changes)

-    install_command_requirements(args)

-

     version_commands = []

     for version in SUPPORTED_PYTHON_VERSIONS:

@@ -1142,6 +1147,9 @@ def command_units(args):

         if args.python and version != args.python_version:

             continue

+        if args.requirements_mode != 'skip':

+            install_command_requirements(args, version)

+

         env = ansible_environment(args)

         cmd = [

@@ -1167,6 +1175,9 @@ def command_units(args):

         version_commands.append((version, cmd, env))

+    if args.requirements_mode == 'only':

+        sys.exit()

+

     for version, command, env in version_commands:

         display.info('Unit test with Python %s' % version)

@@ -335,6 +335,10 @@ def parse_args():

                        action='store_true',

                        help='collect tests but do not execute them')

+    units.add_argument('--requirements-mode',

+                       choices=('only', 'skip'),

+                       help=argparse.SUPPRESS)

+

     add_extra_docker_options(units, integration=False)

     sanity = subparsers.add_parser('sanity',

@@ -21,6 +21,7 @@ passenv =

 [pytest]

 xfail_strict = true

+cache_dir = .pytest_cache

 [flake8]

 # These are things that the devs don't agree make the code more readable