fix python install on save with nsjail

backend/windmill-worker/src/python_executor.rs

@@ -185,18 +185,6 @@ pub async fn handle_python_job(
     };
 
     if requirements.len() > 0 {
-        if !*DISABLE_NSJAIL {
-            let _ = write_file(
-                job_dir,
-                "download.config.proto",
-                &NSJAIL_CONFIG_DOWNLOAD_PY_CONTENT
-                    .replace("{WORKER_DIR}", &worker_dir)
-                    .replace("{CACHE_DIR}", PIP_CACHE_DIR)
-                    .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string()),
-            )
-            .await?;
-        }
-
         additional_python_paths = handle_python_reqs(
             requirements
                 .split("\n")
@@ -208,6 +196,7 @@ pub async fn handle_python_job(
             db,
             worker_name,
             job_dir,
+            worker_dir,
         )
         .await?;
     }
@@ -443,6 +432,7 @@ pub async fn handle_python_reqs(
     db: &sqlx::Pool<sqlx::Postgres>,
     worker_name: &str,
     job_dir: &str,
+    worker_dir: &str,
 ) -> error::Result<Vec<String>> {
     let mut req_paths: Vec<String> = vec![];
     let mut vars = vec![("PATH", PATH_ENV.as_str())];
@@ -456,6 +446,15 @@ pub async fn handle_python_reqs(
         if let Some(host) = PIP_TRUSTED_HOST.as_ref() {
             vars.push(("TRUSTED_HOST", host));
         }
+        let _ = write_file(
+            job_dir,
+            "download.config.proto",
+            &NSJAIL_CONFIG_DOWNLOAD_PY_CONTENT
+                .replace("{WORKER_DIR}", &worker_dir)
+                .replace("{CACHE_DIR}", PIP_CACHE_DIR)
+                .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string()),
+        )
+        .await?;
     };
 
     for req in requirements {