Virtual environments don't provide any sandboxing, they just let you isolate different dependency sets from each other when switching between working on different applications.

If you're inside a venv, you'll see either:

    sys.prefix != sys.base_prefix (venv created by Py3 stdlib)

or:

    hasattr(sys, "real_prefix") (venv created by virtualenv)

In this case, you can assume the user has write permissions to the virtual environment and just invoke sys.executable with "-m pip install pipgui" as arguments.

If you're *not* in a virtual environment, you're running directly in the system Python, and the user may not have permission to install new packages for everyone (and even if they do, it's not necessarily a good idea). In that case, you want to pass "-m pip install --user pipgui", so the GUI components get installed in the user's home directory, rather than system wide.