diff --git a/all-spark-notebook/README.md b/all-spark-notebook/README.md index 99ab4e11..8f4d4a4f 100644 --- a/all-spark-notebook/README.md +++ b/all-spark-notebook/README.md @@ -5,7 +5,7 @@ ## What it Gives You -* Jupyter Notebook 4.2.x +* Jupyter Notebook 4.3.x * Conda Python 3.x and Python 2.7.x environments * Conda R 3.3.x environment * Scala 2.10.x @@ -17,17 +17,18 @@ * [tini](https://github.com/krallin/tini) as the container entrypoint and [start-notebook.sh](../base-notebook/start-notebook.sh) as the default command * A [start-singleuser.sh](../base-notebook/start-singleuser.sh) script useful for running a single-user instance of the Notebook server, as required by JupyterHub * A [start.sh](../base-notebook/start.sh) script useful for running alternative commands in the container (e.g. `ipython`, `jupyter kernelgateway`, `jupyter lab`) -* Options for HTTPS, password auth, and passwordless `sudo` - +* Options for a self-signed HTTPS certificate and passwordless `sudo` ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/all-spark-notebook +docker run -it --rm -p 8888:8888 jupyter/all-spark-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Using Spark Local Mode This configuration is nice for using Spark on small, local data. @@ -195,7 +196,7 @@ Connection to Spark Cluster on Standalone Mode requires the following set of ste The Docker container executes a [`start-notebook.sh` script](../base-notebook/start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/all-spark-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -207,26 +208,45 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/all-spark-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` +For example, to disable all authentication mechanisms (not a recommended practice): + +``` +docker run -d -p 8888:8888 jupyter/all-spark-notebook start-notebook.sh --NotebookApp.token='' +``` + You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. ## Docker Options -You may customize the execution of the Docker container and the Notebook server it contains with the following optional arguments. +You may customize the execution of the Docker container and the command it is running with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. -`-p 4040:4040` - Opens the default port for the [Spark Monitoring and Instrumentation UI](http://spark.apache.org/docs/latest/monitoring.html). Note every new Spark context that is created is put onto an incrementing port (ie. 4040, 4041, 4042, etc.) by default, and it might be necessary to open multiple ports using a command like `docker run -d -p 8888:8888 -p 4040:4040 -p 4041:4041 jupyter/pyspark-notebook`. You can also control the port Spark uses for its web UI with the `spark.ui.port` config option. - ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/all-spark-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/all-spark-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: @@ -234,6 +254,8 @@ For additional information about using SSL, see the following: * The [jupyter_notebook_config.py](jupyter_notebook_config.py) file for how this Docker image generates a self-signed certificate. * The [Jupyter Notebook documentation](https://jupyter-notebook.readthedocs.io/en/latest/public_server.html#using-ssl-for-encrypted-communication) for best practices about running a public notebook server in general, most of which are encoded in this image. + + ## Conda Environments The default Python 3.x [Conda environment](http://conda.pydata.org/docs/using/envs.html) resides in `/opt/conda`. A second Python 2.x Conda environment exists in `/opt/conda/envs/python2`. You can [switch to the python2 environment](http://conda.pydata.org/docs/using/envs.html#change-environments-activate-deactivate) in a shell by entering the following: diff --git a/base-notebook/Dockerfile b/base-notebook/Dockerfile index b1ee6cd4..6644de94 100644 --- a/base-notebook/Dockerfile +++ b/base-notebook/Dockerfile @@ -2,7 +2,7 @@ # Distributed under the terms of the Modified BSD License. # Debian Jessie image released 2016 May 03. -FROM debian@sha256:32a225e412babcd54c0ea777846183c61003d125278882873fb2bc97f9057c51 +FROM debian@sha256:f7062cf040f67f0c26ff46b3b44fe036c29468a7e69d8170f37c57f2eec1261b MAINTAINER Jupyter Project @@ -58,11 +58,10 @@ RUN mkdir /home/$NB_USER/work && \ # Install conda as jovyan RUN cd /tmp && \ mkdir -p $CONDA_DIR && \ - wget --quiet https://repo.continuum.io/miniconda/Miniconda3-4.1.11-Linux-x86_64.sh && \ - echo "efd6a9362fc6b4085f599a881d20e57de628da8c1a898c08ec82874f3bad41bf *Miniconda3-4.1.11-Linux-x86_64.sh" | sha256sum -c - && \ - /bin/bash Miniconda3-4.1.11-Linux-x86_64.sh -f -b -p $CONDA_DIR && \ - rm Miniconda3-4.1.11-Linux-x86_64.sh && \ - $CONDA_DIR/bin/conda install --quiet --yes conda==4.1.11 && \ + wget --quiet https://repo.continuum.io/miniconda/Miniconda3-4.2.12-Linux-x86_64.sh && \ + echo "c59b3dd3cad550ac7596e0d599b91e75d88826db132e4146030ef471bb434e9a *Miniconda3-4.2.12-Linux-x86_64.sh" | sha256sum -c - && \ + /bin/bash Miniconda3-4.2.12-Linux-x86_64.sh -f -b -p $CONDA_DIR && \ + rm Miniconda3-4.2.12-Linux-x86_64.sh && \ $CONDA_DIR/bin/conda config --system --add channels conda-forge && \ $CONDA_DIR/bin/conda config --system --set auto_update_conda false && \ conda clean -tipsy @@ -71,9 +70,9 @@ RUN cd /tmp && \ # Stick with jpeg 8 to avoid problems with R packages RUN echo "jpeg 8*" >> /opt/conda/conda-meta/pinned -# Install Jupyter notebook as jovyan +# Install Jupyter Notebook and Hub RUN conda install --quiet --yes \ - 'notebook=4.2*' \ + 'notebook=4.3*' \ jupyterhub=0.7 \ && conda clean -tipsy diff --git a/base-notebook/README.md b/base-notebook/README.md index 9ccb495b..dfed04bc 100644 --- a/base-notebook/README.md +++ b/base-notebook/README.md @@ -6,28 +6,30 @@ Small base image for defining your own stack ## What it Gives You -* Minimally-functional Jupyter Notebook 4.2.x (e.g., no pandoc for document conversion) +* Minimally-functional Jupyter Notebook 4.3.x (e.g., no pandoc for document conversion) * Miniconda Python 3.x * No preinstalled scientific computing packages * Unprivileged user `jovyan` (uid=1000, configurable, see options) in group `users` (gid=100) with ownership over `/home/jovyan` and `/opt/conda` * [tini](https://github.com/krallin/tini) as the container entrypoint and [start-notebook.sh](./start-notebook.sh) as the default command * A [start-singleuser.sh](./start-singleuser.sh) script useful for running a single-user instance of the Notebook server, as required by JupyterHub * A [start.sh](./start.sh) script useful for running alternative commands in the container (e.g. `ipython`, `jupyter kernelgateway`, `jupyter lab`) -* Options for HTTPS, password auth, and passwordless `sudo` +* Options for a self-signed HTTPS certificate and passwordless `sudo` ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/base-notebook +docker run -it --rm -p 8888:8888 jupyter/base-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Notebook Options The Docker container executes a [`start-notebook.sh` script](./start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/base-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -39,24 +41,45 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/base-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` +For example, to disable all authentication mechanisms (not a recommended practice): + +``` +docker run -d -p 8888:8888 jupyter/base-notebook start-notebook.sh --NotebookApp.token='' +``` + You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. ## Docker Options You may customize the execution of the Docker container and the command it is running with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/base-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/base-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: diff --git a/base-notebook/jupyter_notebook_config.py b/base-notebook/jupyter_notebook_config.py index 84a10334..d55cfab1 100644 --- a/base-notebook/jupyter_notebook_config.py +++ b/base-notebook/jupyter_notebook_config.py @@ -1,39 +1,36 @@ # Copyright (c) Jupyter Development Team. +# Distributed under the terms of the Modified BSD License. + from jupyter_core.paths import jupyter_data_dir import subprocess import os import errno import stat -PEM_FILE = os.path.join(jupyter_data_dir(), 'notebook.pem') - c = get_config() c.NotebookApp.ip = '*' c.NotebookApp.port = 8888 c.NotebookApp.open_browser = False -# Set a certificate if USE_HTTPS is set to any value -if 'USE_HTTPS' in os.environ: - if not os.path.isfile(PEM_FILE): - # Ensure PEM_FILE directory exists - dir_name = os.path.dirname(PEM_FILE) - try: - os.makedirs(dir_name) - except OSError as exc: # Python >2.5 - if exc.errno == errno.EEXIST and os.path.isdir(dir_name): - pass - else: raise - # Generate a certificate if one doesn't exist on disk - subprocess.check_call(['openssl', 'req', '-new', - '-newkey', 'rsa:2048', '-days', '365', '-nodes', '-x509', - '-subj', '/C=XX/ST=XX/L=XX/O=generated/CN=generated', - '-keyout', PEM_FILE, '-out', PEM_FILE]) - # Restrict access to PEM_FILE - os.chmod(PEM_FILE, stat.S_IRUSR | stat.S_IWUSR) - c.NotebookApp.certfile = PEM_FILE - -# Set a password if PASSWORD is set -if 'PASSWORD' in os.environ: - from IPython.lib import passwd - c.NotebookApp.password = passwd(os.environ['PASSWORD']) - del os.environ['PASSWORD'] \ No newline at end of file +# Generate a self-signed certificate +if 'GEN_CERT' in os.environ: + dir_name = jupyter_data_dir() + pem_file = os.path.join(dir_name, 'notebook.pem') + try: + os.makedirs(dir_name) + except OSError as exc: # Python >2.5 + if exc.errno == errno.EEXIST and os.path.isdir(dir_name): + pass + else: + raise + # Generate a certificate if one doesn't exist on disk + subprocess.check_call(['openssl', 'req', '-new', + '-newkey', 'rsa:2048', + '-days', '365', + '-nodes', '-x509', + '-subj', '/C=XX/ST=XX/L=XX/O=generated/CN=generated', + '-keyout', pem_file, + '-out', pem_file]) + # Restrict access to the file + os.chmod(pem_file, stat.S_IRUSR | stat.S_IWUSR) + c.NotebookApp.certfile = pem_file diff --git a/datascience-notebook/README.md b/datascience-notebook/README.md index f9229f90..82e43f13 100644 --- a/datascience-notebook/README.md +++ b/datascience-notebook/README.md @@ -4,7 +4,7 @@ ## What it Gives You -* Jupyter Notebook 4.2.x +* Jupyter Notebook 4.3.x * Conda Python 3.x and Python 2.7.x environments * pandas, matplotlib, scipy, seaborn, scikit-learn, scikit-image, sympy, cython, patsy, statsmodel, cloudpickle, dill, numba, bokeh pre-installed * Conda R v3.3.x and channel @@ -14,21 +14,23 @@ * [tini](https://github.com/krallin/tini) as the container entrypoint and [start-notebook.sh](../base-notebook/start-notebook.sh) as the default command * A [start-singleuser.sh](../base-notebook/start-singleuser.sh) script useful for running a single-user instance of the Notebook server, as required by JupyterHub * A [start.sh](../base-notebook/start.sh) script useful for running alternative commands in the container (e.g. `ipython`, `jupyter kernelgateway`, `jupyter lab`) -* Options for HTTPS, password auth, and passwordless `sudo` +* Options for a self-signed HTTPS certificate and passwordless `sudo` ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/datascience-notebook +docker run -it --rm -p 8888:8888 jupyter/datascience-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Notebook Options The Docker container executes a [`start-notebook.sh` script](../base-notebook/start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/datascience-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -40,24 +42,45 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/datascience-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` +For example, to disable all authentication mechanisms (not a recommended practice): + +``` +docker run -d -p 8888:8888 jupyter/datascience-notebook start-notebook.sh --NotebookApp.token='' +``` + You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. ## Docker Options -You may customize the execution of the Docker container and the Notebook server it contains with the following optional arguments. +You may customize the execution of the Docker container and the command it is running with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/datascience-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/datascience-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: diff --git a/minimal-notebook/README.md b/minimal-notebook/README.md index 3e5dfc2e..05112f72 100644 --- a/minimal-notebook/README.md +++ b/minimal-notebook/README.md @@ -6,28 +6,30 @@ Small image for working in the notebook and installing your own libraries ## What it Gives You -* Fully-functional Jupyter Notebook 4.2.x +* Fully-functional Jupyter Notebook 4.3.x * Miniconda Python 3.x * No preinstalled scientific computing packages * Unprivileged user `jovyan` (uid=1000, configurable, see options) in group `users` (gid=100) with ownership over `/home/jovyan` and `/opt/conda` * [tini](https://github.com/krallin/tini) as the container entrypoint and [start-notebook.sh](../base-notebook/start-notebook.sh) as the default command * A [start-singleuser.sh](../base-notebook/start-singleuser.sh) script useful for running a single-user instance of the Notebook server, as required by JupyterHub * A [start.sh](../base-notebook/start.sh) script useful for running alternative commands in the container (e.g. `ipython`, `jupyter kernelgateway`, `jupyter lab`) -* Options for HTTPS, password auth, and passwordless `sudo` +* Options for a self-signed HTTPS certificate and passwordless `sudo` ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/minimal-notebook +docker run -it --rm -p 8888:8888 jupyter/minimal-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Notebook Options The Docker container executes a [`start-notebook.sh` script](../base-notebook/start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/minimal-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -39,24 +41,46 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/minimal-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` +For example, to disable all authentication mechanisms (not a recommended practice): + +``` +docker run -d -p 8888:8888 jupyter/minimal-notebook start-notebook.sh --NotebookApp.token='' +``` + You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. + ## Docker Options You may customize the execution of the Docker container and the Notebook server it contains with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/minimal-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/minimal-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: diff --git a/pyspark-notebook/README.md b/pyspark-notebook/README.md index 9afe8c32..a8fe2f9b 100644 --- a/pyspark-notebook/README.md +++ b/pyspark-notebook/README.md @@ -4,7 +4,7 @@ ## What it Gives You -* Jupyter Notebook 4.2.x +* Jupyter Notebook 4.3.x * Conda Python 3.x and Python 2.7.x environments * pyspark, pandas, matplotlib, scipy, seaborn, scikit-learn pre-installed * Spark 2.0.2 with Hadoop 2.7 for use in local mode or to connect to a cluster of Spark workers @@ -13,16 +13,18 @@ * [tini](https://github.com/krallin/tini) as the container entrypoint and [start-notebook.sh](../base-notebook/start-notebook.sh) as the default command * A [start-singleuser.sh](../base-notebook/start-singleuser.sh) script useful for running a single-user instance of the Notebook server, as required by JupyterHub * A [start.sh](../base-notebook/start.sh) script useful for running alternative commands in the container (e.g. `ipython`, `jupyter kernelgateway`, `jupyter lab`) -* Options for HTTPS, password auth, and passwordless `sudo` +* Options for a self-signed HTTPS certificate and passwordless `sudo` ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/pyspark-notebook +docker run -it --rm -p 8888:8888 jupyter/pyspark-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Using Spark Local Mode This configuration is nice for using Spark on small, local data. @@ -100,7 +102,7 @@ Connection to Spark Cluster on Standalone Mode requires the following set of ste The Docker container executes a [`start-notebook.sh` script](../base-notebook/start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/pyspark-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -112,25 +114,45 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/pyspark-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` +For example, to disable all authentication mechanisms (not a recommended practice): + +``` +docker run -d -p 8888:8888 jupyter/pyspark-notebook start-notebook.sh --NotebookApp.token='' +``` + You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. ## Docker Options -You may customize the execution of the Docker container and the Notebook server it contains with the following optional arguments. +You may customize the execution of the Docker container and the command it is running with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. -* `-p 4040:4040` - Opens the default port for the [Spark Monitoring and Instrumentation UI](http://spark.apache.org/docs/latest/monitoring.html). Note every new Spark context that is created is put onto an incrementing port (ie. 4040, 4041, 4042, etc.) by default, and it might be necessary to open multiple ports using a command like `docker run -d -p 8888:8888 -p 4040:4040 -p 4041:4041 jupyter/pyspark-notebook`. You can also control the port Spark uses for its web UI with the `spark.ui.port` config option. ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/pyspark-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/pyspark-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: @@ -138,6 +160,9 @@ For additional information about using SSL, see the following: * The [jupyter_notebook_config.py](jupyter_notebook_config.py) file for how this Docker image generates a self-signed certificate. * The [Jupyter Notebook documentation](https://jupyter-notebook.readthedocs.io/en/latest/public_server.html#using-ssl-for-encrypted-communication) for best practices about running a public notebook server in general, most of which are encoded in this image. + + + ## Conda Environments The default Python 3.x [Conda environment](http://conda.pydata.org/docs/using/envs.html) resides in `/opt/conda`. A second Python 2.x Conda environment exists in `/opt/conda/envs/python2`. You can [switch to the python2 environment](http://conda.pydata.org/docs/using/envs.html#change-environments-activate-deactivate) in a shell by entering the following: diff --git a/r-notebook/README.md b/r-notebook/README.md index 38684b07..66a69463 100644 --- a/r-notebook/README.md +++ b/r-notebook/README.md @@ -4,28 +4,30 @@ ## What it Gives You -* Jupyter Notebook 4.2.x +* Jupyter Notebook 4.3.x * Conda R v3.3.x and channel * plyr, devtools, dplyr, ggplot2, tidyr, shiny, rmarkdown, forecast, stringr, rsqlite, reshape2, nycflights13, caret, rcurl, and randomforest pre-installed * Unprivileged user `jovyan` (uid=1000, configurable, see options) in group `users` (gid=100) with ownership over `/home/jovyan` and `/opt/conda` * [tini](https://github.com/krallin/tini) as the container entrypoint and [start-notebook.sh](../base-notebook/start-notebook.sh) as the default command * A [start-singleuser.sh](../base-notebook/start-singleuser.sh) script useful for running a single-user instance of the Notebook server, as required by JupyterHub * A [start.sh](../base-notebook/start.sh) script useful for running alternative commands in the container (e.g. `ipython`, `jupyter kernelgateway`, `jupyter lab`) -* Options for HTTPS, password auth, and passwordless `sudo` +* Options for a self-signed HTTPS certificate and passwordless `sudo` ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/r-notebook +docker run -it --rm -p 8888:8888 jupyter/r-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Notebook Options The Docker container executes a [`start-notebook.sh` script](../base-notebook/start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/r-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -37,24 +39,45 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/r-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` +For example, to disable all authentication mechanisms (not a recommended practice): + +``` +docker run -d -p 8888:8888 jupyter/r-notebook start-notebook.sh --NotebookApp.token='' +``` + You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. ## Docker Options -You may customize the execution of the Docker container and the Notebook server it contains with the following optional arguments. +You may customize the execution of the Docker container and the command it is running with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/r-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/r-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: @@ -62,6 +85,7 @@ For additional information about using SSL, see the following: * The [jupyter_notebook_config.py](jupyter_notebook_config.py) file for how this Docker image generates a self-signed certificate. * The [Jupyter Notebook documentation](https://jupyter-notebook.readthedocs.io/en/latest/public_server.html#using-ssl-for-encrypted-communication) for best practices about running a public notebook server in general, most of which are encoded in this image. + ## Alternative Commands ### start-singleuser.sh diff --git a/scipy-notebook/README.md b/scipy-notebook/README.md index 255d05bb..6cd83a46 100644 --- a/scipy-notebook/README.md +++ b/scipy-notebook/README.md @@ -4,7 +4,7 @@ ## What it Gives You -* Jupyter Notebook 4.2.x +* Jupyter Notebook 4.3.x * Conda Python 3.x and Python 2.7.x environments * pandas, matplotlib, scipy, seaborn, scikit-learn, scikit-image, sympy, cython, patsy, statsmodel, cloudpickle, dill, numba, bokeh, vincent, beautifulsoup, xlrd pre-installed * Unprivileged user `jovyan` (uid=1000, configurable, see options) in group `users` (gid=100) with ownership over `/home/jovyan` and `/opt/conda` @@ -15,17 +15,19 @@ ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/scipy-notebook +docker run -it --rm -p 8888:8888 jupyter/scipy-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Notebook Options The Docker container executes a [`start-notebook.sh` script](../base-notebook/start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/scipy-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -37,6 +39,12 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/scipy-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` +For example, to disable all authentication mechanisms (not a recommended practice): + +``` +docker run -d -p 8888:8888 jupyter/scipy-notebook start-notebook.sh --NotebookApp.token='' +``` + You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. @@ -44,18 +52,33 @@ You can sidestep the `start-notebook.sh` script and run your own commands in the You may customize the execution of the Docker container and the Notebook server it contains with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/scipy-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/scipy-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: diff --git a/tensorflow-notebook/README.md b/tensorflow-notebook/README.md index 13a3a601..2014e724 100644 --- a/tensorflow-notebook/README.md +++ b/tensorflow-notebook/README.md @@ -7,15 +7,16 @@ * Everything in [Scipy Notebook](https://github.com/jupyter/docker-stacks/tree/master/scipy-notebook) * Tensorflow for Python 2.7 and 3.5 (without GPU support) - ## Basic Use -The following command starts a container with the Notebook server listening for HTTP connections on port 8888 without authentication configured. +The following command starts a container with the Notebook server listening for HTTP connections on port 8888 with a randomly generated authentication token configured. ``` -docker run -d -p 8888:8888 jupyter/tensorflow-notebook +docker run -it --rm -p 8888:8888 jupyter/tensorflow-notebook ``` +Take note of the authentication token included in the notebook startup log messages. Include it in the URL you visit to access the Notebook server or enter it in the Notebook login form. + ## Tensorflow Single Machine Mode As distributed tensorflow is still immature, we currently only provide the single machine mode. @@ -36,7 +37,7 @@ sess.run(hello) The Docker container executes a [`start-notebook.sh` script](../base-notebook/start-notebook.sh) script by default. The `start-notebook.sh` script handles the `NB_UID` and `GRANT_SUDO` features documented in the next section, and then executes the `jupyter notebook`. -You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a password hashed using `IPython.lib.passwd()`, run the following: +You can pass [Jupyter command line options](https://jupyter.readthedocs.io/en/latest/projects/jupyter-command.html) through the `start-notebook.sh` script when launching the container. For example, to secure the Notebook server with a custom password hashed using `IPython.lib.passwd()` instead of the default token, run the following: ``` docker run -d -p 8888:8888 jupyter/tensorflow-notebook start-notebook.sh --NotebookApp.password='sha1:74ba40f8a388:c913541b7ee99d15d5ed31d4226bf7838f83a50e' @@ -48,25 +49,45 @@ For example, to set the base URL of the notebook server, run the following: docker run -d -p 8888:8888 jupyter/tensorflow-notebook start-notebook.sh --NotebookApp.base_url=/some/path ``` -You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. +For example, to disable all authentication mechanisms (not a recommended practice): +``` +docker run -d -p 8888:8888 jupyter/tensorflow-notebook start-notebook.sh --NotebookApp.token='' +``` + +You can sidestep the `start-notebook.sh` script and run your own commands in the container. See the *Alternative Commands* section later in this document for more information. ## Docker Options -You may customize the execution of the Docker container and the Notebook server it contains with the following optional arguments. +You may customize the execution of the Docker container and the command it is running with the following optional arguments. -* `-e PASSWORD="YOURPASS"` - Configures Jupyter Notebook to require the given plain-text password. Should be combined with `USE_HTTPS` on untrusted networks. **Note** that this option is not as secure as passing a pre-hashed password on the command line as shown above. -* `-e USE_HTTPS=yes` - Configures Jupyter Notebook to accept encrypted HTTPS connections. If a `pem` file containing a SSL certificate and key is not provided (see below), the container will generate a self-signed certificate for you. +* `-e GEN_CERT=yes` - Generates a self-signed SSL certificate and configures Jupyter Notebook to use it to accept encrypted HTTPS connections. * `-e NB_UID=1000` - Specify the uid of the `jovyan` user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adjusting the user id.) * `-e GRANT_SUDO=yes` - Gives the `jovyan` user passwordless `sudo` capability. Useful for installing OS packages. For this option to take effect, you must run the container with `--user root`. (The `start-notebook.sh` script will `su jovyan` after adding `jovyan` to sudoers.) **You should only enable `sudo` if you trust the user or if the container is running on an isolated host.** * `-v /some/host/folder/for/work:/home/jovyan/work` - Host mounts the default working directory on the host to preserve work even when the container is destroyed and recreated (e.g., during an upgrade). -* `-v /some/host/folder/for/server.pem:/home/jovyan/.local/share/jupyter/notebook.pem` - Mounts a SSL certificate plus key for `USE_HTTPS`. Useful if you have a real certificate for the domain under which you are running the Notebook server. ## SSL Certificates -The notebook server configuration in this Docker image expects the `notebook.pem` file mentioned above to contain a base64 encoded SSL key and at least one base64 encoded SSL certificate. The file may contain additional certificates (e.g., intermediate and root certificates). +You may mount SSL key and certificate files into a container and configure Jupyter Notebook to use them to accept HTTPS connections. For example, to mount a host folder containing a `notebook.key` and `notebook.crt`: -If you have your key and certificate(s) as separate files, you must concatenate them together into the single expected PEM file. Alternatively, you can build your own configuration and Docker image in which you pass the key and certificate separately. +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder:/etc/ssl/notebook \ + jupyter/tensorflow-notebook start-notebook.sh \ + --NotebookApp.keyfile=/etc/ssl/notebook/notebook.key + --NotebookApp.certfile=/etc/ssl/notebook/notebook.crt +``` + +Alternatively, you may mount a single PEM file containing both the key and certificate. For example: + +``` +docker run -d -p 8888:8888 \ + -v /some/host/folder/notebook.pem:/etc/ssl/notebook.pem \ + jupyter/tensorflow-notebook start-notebook.sh \ + --NotebookApp.certfile=/etc/ssl/notebook.pem +``` + +In either case, Jupyter Notebook expects the key and certificate to be a base64 encoded text file. The certificate file or PEM may contain one or more certificates (e.g., server, intermediate, and root). For additional information about using SSL, see the following: