When a C extension module is created with PyModuleDef_Init(), it becomes possible to create more than one instance of the module.

It would take significant effort to modify some extensions to make their code fully ready to have two isolated module.

For example, the atexit module calls _Py_PyAtExit() to register itself into the PyInterpreterState. If the module is created more than once, the most recently created module wins, and calls registered on other atexit instances are ignore: see bpo-40288.

One simple option would be to simply disallow loading the module more than once per interpreter.

Also, some extensions are not fully compatible with subinterpreters. It may be interesting to allow to load them in a subinterpreter if it's not already loaded in another interpreter, like another subinterpreter or the main interpreter. It would be only load it once per Python *process*. For example, numpy would be a good candidate for such option.

I'm not sure fow a module should announced in its definition that it should not be loaded more than once.

Title clarified. Leaving subinterpreters aside, only one instance, AFAIK, is true for stdlib and python modules unless imported with different names, as can happen with main module (which is a nuisance if not a bug). So only once per interpreter seems like a bugfix. Only once per process, if once per interpreter otherwise becomes normal, seems like an enhancement, even if a necessary option.

What about a new PyModuleDef_Slot function?

static int my_can_create(/*need any arg??, InterpreterState, etc?*/) {
    if (test_global_condition()) {
        return -1; //Don't allow creation
    }
    return 0; //Allow creation
};

static PyModuleDef_Slot signal_slots[] = {
    {Py_mod_exec, my_exec},
    {Py_mod_can_create, my_can_create},
    {0,0}
};

One of my opinions is that

Since module object supports detecting error during Py_mod_exec,
The only thing we have to do is return -1 when the module has already existed.

we should define new exception type and don't have to define new slots.
The pros of this method is that we don't have to modify module object and no needs to write the new PEP

but the cons of this method is that we should promise the standard exception when try to create multiple instances which is not allowed.

ref:

On the other side, defining a Py_mod_exec_once that supports execution for just once can be a way.
Although the usage is little, it will be fine because the use case will exist.

Please point out what I missed :)

One option is to get the behavior before multi-phase initialization. We store extensions in a list. Once it's load, it cannot be unloaded before we exit Python. See _PyState_AddModule() and _PyState_AddModule().

Calling PyInit_xxx() the second time would simply return the existing module object.

When we exit Python, the clear and/or free function of the module is called.

Something like this?

static PyObject *def;

PyMODINIT_FUNC
PyInit_mymod(void)
{
    if (def == NULL) {
       def = PyModuleDef_Init(&mymod);
    }
    return def;
}

Then add a flag to PyModuleDef to indicate it is already exec?

On the other side, defining a Py_mod_exec_once that supports execution > >for just once can be a way.
Although the usage is little, it will be fine because the use case will >exist.

IMHO, Py_mod_exec_once is more like a slot control flag. MAYBE we need add a module flag in PyModuleDef.

MAYBE we need add a module flag in PyModuleDef.
I created a demo in PR 23683.

Is it really necessary to add a slot/flag for this?
It can be done in about 10 lines as below, without complications like a global (or per-interpreter) registry of singleton modules.
Are there many modules that need to be per-interpreter singletons, but may be loaded in multiple interpreters? In my experience, it is really hard to ensure modules behave that way; if (if!) we need to add a dedicated API for this, I'd go for once-per-process.

static int loaded = 0;

static int
exec_module(PyObject* module)
{
    if (loaded) {
        PyErr_SetString(PyExc_ImportError,
                        "cannot load module more than once per process");
        return -1;
    }
    loaded = 1;
    // ... rest of initialization
}

static int loaded = 0;

I would like to limit an extension to once instance *per interpreter*.

See the atexit module for an example.

Are there any other examples?

In my view, atexit is very special, and very closely tied to interpreter. I don't think it's good to design general API for one module.

I'm not 100% sure that preventing to create multiple module instances is needed. For the atexit module, another solution is to move the "module state" into the interpreter, as it has been done for other modules like _warnings.

another solution is to move the "module state" into the interpreter,

I am +1 on this solution if this module is a very special case.

another solution is to move the "module state" into the interpreter,

OK, I am agree victor's solution too. It's a more simpler way.

I created bpo-42639 and PR 23763 to move the atexit module to PyInterpreterState and so allow to have more than one atexit instance.

Thanks! Indeed, that's an even better solution than I had in mind.
It follows PEP-630 quite nicely: https://www.python.org/dev/peps/pep-0630/#managing-global-state

I will close this issue and PRs.
I don't agree with adding a general API for disallowing multiple modules, but do let me know if you see a need for it again.

Thanks! Indeed, that's an even better solution than I had in mind.
It follows PEP-630 quite nicely: https://www.python.org/dev/peps/pep-0630/#managing-global-state

The atexit module was my main motivation for this issue. So I'm fine with closing it.