Composer always gets dev dependencies when executed manually

[bserem]

I am having a very strange issue with BOA (head):

When I add a composer based platform from Aegir all is fine, the resulting platform has no dev dependencies.
When I go from the CLI, as user o1.ftp and run composer install --no-dev I always get dev dependencies installed, and this results to drush 9/10 getting added.

I can easily go on and remove vendor/drush but I am wondering why something like this happens and how I could fix it.

$ composer -V
Composer version 1.9.3 2020-02-04 12:58:49

[omega8cc]

Composer is not part of BOA itself, just third party tool included. It shouldn't be a problem, since Aegir will remove the Drush copy on platform verify anyway.

[omega8cc]

Ah, you meant that things are different with limited shell. Nothing major, but still interesting why the flag is not respected.

[bserem]

It's not major because it is easy to go ahead and delete vendor/drush manually, but if this is not done then Aegir will eventually fail because it will pick up Drush 9.

I did not think about the limited shell, I'll too try to figure out why it acts like that.

[omega8cc]

Aegir will not fail, because it will delete local drush on platform verify, which is special case, because it doesn't bootstrap Drupal at all, since there is no site context used, only codebase / platform context. Still, composer shouldn't behave differently.