Run workspace as non root

[sigmarkarl]

Jira ticket

https://spotinst.atlassian.net/browse/BGD-4766

Description

Our workspace jupyterlab image is based on the https://quay.io/repository/jupyter/base-notebook image, which has userid 1000 for user jovyan and groupid 100 for group users.

It is recommended to use the start-notebook.py instead of the shell script to launch the jupyterlab process, see.

cat start-notebook.sh 
#!/bin/bash
# Shim to emit warning and call start-notebook.py
echo "WARNING: Use start-notebook.py instead"

exec /usr/local/bin/start-notebook.py "$@"

Demo

Opening a terminal in the workspace notebook no longer runs as root. Also new notebook files are successfully saved on the mounted drive and owned by the jovyan user.

Checklist

• I have added a Jira ticket link
• I have filled in the test plan
• I have executed the tests and filled in the test results
• I have updated/created relevant documentation

How to test

Create a workspace. Edit the deployment and replace the runAsUser: 0 and fsGroup: 0 with 1000 and 100 respectively. Remove the --allow-root and replace start-notebook.sh with start-notebook.py. Launch a notebook from the workspace and run a spark query. Open a terminal in jupyterlab and touch a file to see if the mount is writable.

Test plan and results

Feel free to add screenshots showing test results

Test	Description	Result	Notes
1	Launch a notebook and run spark.sql("select random()").show()	Pass	The created notebook file is successfully saved under /home/jovyan
2	Open a terminal, touch file.txt	Pass	Mounted user folder is writable