If you've ever set up a self-hosted CI/CD agent on a fresh Ubuntu image and hit pip: command not found or No module named pip, your first instinct is probably to check the network. Mine was too. That instinct is wrong, and the real answer took me four attempts to actually land on.
Here's the full story, including the three dead ends, because I think the dead ends are the useful part.
The setup
A self-hosted CI agent (in my case, an Azure DevOps agent, but this applies just as much to a self-hosted GitHub Actions runner or a plain Jenkins box) running on a minimal Ubuntu image. No sudo access on the box that's deliberate, since the agent shouldn't need root just to run a pipeline. I needed to install a CLI tool that only ships via pip.
Reasonable first attempt:
