How to run isolated jupyterhub notebooks

Question

I'm running a jupyterhub using sudospawner on CentOS7 server. The purpose of jupyterhub is twofold

1. Ensure everyone has the exact same conda packages when we run production code
2. Allow people to use multiple instances of the same notebook (where we keep all our visualization tools) and not edit each other's local versions.

Initially when I was installing jupyterhub, someone told me that different users would be able to run isolated versions of the same notebook. In other words, if person A were to change a parameter in a master notebook from "foo" to "bar" this wouldn't cause B's single-user notebook to change, since each person is spawning a separate server.

However, now that it's actually installed, I find out that this is not the case. As long as I have the right permissions, I can change anyone's notebook, and this change is reflected across anyone who has the notebook open. This defeats point #2. I want persons A, B, C to all use the same notebook N without changes being reflected on each person's local machine.

Now I have thought of a solution where we keep a git repo of the master notebook and run some code to automatically pull the repo into each person's local dir upon logging in. However, is there a simpler way or more accepted way to accomplish the same thing with just jupyterhub configuration commands?

Answer 1

If you set up jupyterhub on a linux server then file permissions will take care of this. My setup using SudoSpawner and PAM authentication on a personal CENTOS 7 server:

1. Install anaconda in /opt/ with svc account as owner
2. Have service account create /opt/notebooks/{userid} for each userid with permissions 770 (full permission for owner and group, none for other)
3. Have jupyternotebooks spawn in /opt/notebooks/{userid} depending on userid
4. For each new notebook, set default permissions as 740 (full permission for owner, read only for group, none for other).
5. Only owner can save write and save his own notebooks. Others can see, edit, and execute code in another person's notebook, but cannot save changes. In theory you could create a notebook in someone else's folder but this would be heavily discouraged (not explicitly forbidden though).