Fix "externally-managed-environment" and missing venv on Ubuntu 26.04 / WSL2

2 min read

If you're on a fresh Ubuntu 24.04+/26.04 system (including WSL2) and run into either of these, they're related and both come from Debian/Ubuntu's PEP 668 packaging changes:

error: externally-managed-environment
× This environment is externally managed

Error: Command '['/path/to/venv/bin/python3', ...]' returned non-zero exit status 1.
The virtual environment was not created successfully because ensurepip is not available.
On Debian/Ubuntu systems, you need to install the python3-venv package:
    apt install python3.14-venv

Why this happens

Since Ubuntu 24.04, the system Python is "externally managed": pip install (even with --user) is blocked outside a virtual environment to stop you from breaking OS packages that depend on a specific Python setup. Separately, Ubuntu splits ensurepip out of the base python3 package and into python3.<version>-venv, so python3 -m venv fails until that's installed.

Fix 1: proper fix, if you have sudo

sudo apt update
sudo apt install -y python3-pip python3.14-venv   # match your `python3 --version`
python3 -m venv .venv
source .venv/bin/activate
pip install <packages>

Fix 2: no sudo available

You can still get a working venv without touching system packages, because the PEP 668 restriction lives in system pip, not in the venv module itself:

python3 -m venv --without-pip .venv     # creates the venv, skips the broken ensurepip step
curl -sS https://bootstrap.pypa.io/get-pip.py -o get-pip.py
.venv/bin/python get-pip.py             # installs pip *inside* the venv only
.venv/bin/pip install <packages>        # now works normally, no --break-system-packages needed

This works because --without-pip skips the ensurepip call that fails when the python3.X-venv package is missing, and get-pip.py bootstraps pip directly into the venv's site-packages without touching the system interpreter at all.

What not to do

pip install --user --break-system-packages ... "works" but installs into your system Python's user site-packages, defeating the isolation venv exists for, and can conflict with apt-managed packages later. Prefer Fix 1 when you have sudo, Fix 2 when you don't.

Sources: PEP 668; Debian's python3-defaults packaging notes on the externally-managed-environment marker file; python3 -m venv --help; behavior verified directly on Ubuntu 26.04 (WSL2), Python 3.14.