Conda reads settings from many places: system folders, the conda root, your home directory, the active environment, an environment variable and the command line. They merge, and the later ones win. So the channel list you think you use may come from a file you never opened.
Why this is a supply chain question
The channels setting decides where packages come from. Anyone or anything that can write one of those files, or set a conda environment variable, can point your installs at a different source. For a data science team that shares machines or build agents, knowing the order is the first control.
The search order
The conda documentation lists the locations it checks. On Linux and macOS they include system paths under etc and var, the conda root, the XDG config folder, the dot conda folder and home directory files, then a condarc inside the active environment, and finally a file named by the CONDARC variable. Windows has its own ProgramData paths.
The same page gives the merge rules and the precedence:
| Setting type | When two sources disagree |
|---|---|
| Lists, such as channels | Merged |
| Dictionaries | Merged |
| Single values | The later one overwrites |
| Environment variables named CONDA followed by the setting | Beat every config file |
| Command line parameters | Beat everything |
See your effective settings
Do not guess. Conda can print what it uses:
conda config --show-sources
conda config --get channels
conda info
The first shows every config file and its contents. The second shows the merged value. Conda info reports the location of the config file in use.
What to do with it
- Run the show sources command on a developer laptop and on a CI agent, and compare.
- Look for channel entries nobody can explain, and for files in the active environment.
- Search your environment variables for CONDA settings that override files.
- Record the intended channel list in the project, next to its environment file.
- On shared servers, move the decision to an administrator controlled file, covered in a companion post about locking channels.
Mind the credentials
The documentation shows that a channel URL can embed a username and password from environment variables. That is fine in principle, but make sure those variables are not printed in build logs and that the account can only read packages.
Where Safeguard fits
Safeguard's asset discovery and SBOM features help you find which projects and environments exist. Channel configuration is something you verify with conda itself, so treat the commands above as the source of truth. The free scan at gold.safeguard.sh/scan covers the dependency side.
Quick check
Which wins, a condarc file or a CONDA environment variable?
The environment variable. The documentation says such variables take precedence over all config files.
How do I see where my channel list came from?
Run the show sources command, which lists each config file and its contents.
Sources
- Using the .condarc conda configuration file, conda documentation, fetched 19 October 2026.
- conda configuration settings, conda documentation, fetched 19 October 2026.
Last reviewed: 19 October 2026.
