{"action":"created","issue":{"url":"https://api.github.com/repos/jupyter/docker-stacks/issues/787","repository_url":"https://api.github.com/repos/jupyter/docker-stacks","labels_url":"https://api.github.com/repos/jupyter/docker-stacks/issues/787/labels{/name}","comments_url":"https://api.github.com/repos/jupyter/docker-stacks/issues/787/comments","events_url":"https://api.github.com/repos/jupyter/docker-stacks/issues/787/events","html_url":"https://github.com/jupyter/docker-stacks/pull/787","id":394831295,"node_id":"MDExOlB1bGxSZXF1ZXN0MjQxNDY3NzAy","number":787,"title":"[WIP] Have start.sh run through both user and root parts","user":{"login":"rkdarst","id":6877977,"node_id":"MDQ6VXNlcjY4Nzc5Nzc=","avatar_url":"https://avatars3.githubusercontent.com/u/6877977?v=4","gravatar_id":"","url":"https://api.github.com/users/rkdarst","html_url":"https://github.com/rkdarst","followers_url":"https://api.github.com/users/rkdarst/followers","following_url":"https://api.github.com/users/rkdarst/following{/other_user}","gists_url":"https://api.github.com/users/rkdarst/gists{/gist_id}","starred_url":"https://api.github.com/users/rkdarst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkdarst/subscriptions","organizations_url":"https://api.github.com/users/rkdarst/orgs","repos_url":"https://api.github.com/users/rkdarst/repos","events_url":"https://api.github.com/users/rkdarst/events{/privacy}","received_events_url":"https://api.github.com/users/rkdarst/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-12-29T23:00:20Z","updated_at":"2018-12-31T13:38:20Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/jupyter/docker-stacks/pulls/787","html_url":"https://github.com/jupyter/docker-stacks/pull/787","diff_url":"https://github.com/jupyter/docker-stacks/pull/787.diff","patch_url":"https://github.com/jupyter/docker-stacks/pull/787.patch"},"body":"I'm using docker-stacks in a jupyterhub deployment.  I run as uid=0, and set NB_UID, NB_USER, etc.  I do extensive local customization at run time.  I even have a switch to swap between running as uid=0 with NB_UID and NB_UID directly.\r\n\r\nOne problem is that sometimes the hooks may run as root, and sometimes they may run as the user.  This could be handled with conditionals, but I'd rather more built-in flexibility.\r\n\r\nThe bigger issue is that sometimes, as running with uid=0, I want to be able to run hooks as the user.  (example: filesystems are mounted from NFS with root_squash, so root *can't* access and do the necessary things at all).  I've hacked this by having the root hooks run sudo themselves, but I wish there was a better way.  There are many other hacks I am ending up doing and I just feel there has to be a better way.\r\n\r\nThis PR adds one hack to replace many (but is not ready to use yet).  If `start.sh` is running as root, instead of starting `jupyter` at the end using sudo, re-execute the same `start.sh` script using sudo.  This way, the user-specific setup gets run (in its current form, this does nothing, but in the future).\r\n\r\nAs an initial useful feature, there are now six forms of hooks: `start-notebook.d`, `start-notebook-root.d`, `start-notebook-user.d`, and `before-notebook-{,root,user}.d`.  If this was accepted, most of my current hacks could be replaced.  As another example of what could be done, instead of doing system setup in `jupyter_notebook_config.py` where it doesn't belong, umask can easily be set here regardless of if you run as user or root (this would have helped me a lot six months ago).  Similar for generating a certificate.\r\n\r\nBut there are problems:\r\n* This is a hack.  A much better way would be to split `start.sh` into a user and root part, maybe `start-singleuser.sh` could have some of this logic.\r\n* A larger rearrangement would make more use of this.\r\n* Is it worth making such a massive change for specialized use?  I think probably so, because it makes hooks more useful and thus ensure that special use cases are made easier, with fewer upstream changes, later.\r\n\r\nI would say do *not* accept this PR yet, but it serves as a basis for discussion to see if the concept is useful.  If useful, discuss the right implementation and do that instead.\r\n\r\n=====\r\n\r\nBefore, start.sh would run *either* its root or its user part.  If you\r\nwere running as uid=0 but wanted to run a user hook before starting,\r\nit can't easily be done.  Also scripts in start-notebook.d and\r\nbefore-notebook.d could be run as either the user or root, depending\r\non how things are run.\r\n\r\nThis is a simple, but unelegant solution, which re-invokes start.sh as\r\nthe user, if it was originally invoked as root."},"comment":{"url":"https://api.github.com/repos/jupyter/docker-stacks/issues/comments/450646852","html_url":"https://github.com/jupyter/docker-stacks/pull/787#issuecomment-450646852","issue_url":"https://api.github.com/repos/jupyter/docker-stacks/issues/787","id":450646852,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDY0Njg1Mg==","user":{"login":"rkdarst","id":6877977,"node_id":"MDQ6VXNlcjY4Nzc5Nzc=","avatar_url":"https://avatars3.githubusercontent.com/u/6877977?v=4","gravatar_id":"","url":"https://api.github.com/users/rkdarst","html_url":"https://github.com/rkdarst","followers_url":"https://api.github.com/users/rkdarst/followers","following_url":"https://api.github.com/users/rkdarst/following{/other_user}","gists_url":"https://api.github.com/users/rkdarst/gists{/gist_id}","starred_url":"https://api.github.com/users/rkdarst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkdarst/subscriptions","organizations_url":"https://api.github.com/users/rkdarst/orgs","repos_url":"https://api.github.com/users/rkdarst/repos","events_url":"https://api.github.com/users/rkdarst/events{/privacy}","received_events_url":"https://api.github.com/users/rkdarst/received_events","type":"User","site_admin":false},"created_at":"2018-12-31T13:38:20Z","updated_at":"2018-12-31T13:38:20Z","author_association":"CONTRIBUTOR","body":"Thank for the review.  I'm glad I'm not completely off here.\r\n\r\nSo, I've been using this on my own deployment and it seems to work.  I'm also a bit surprised that the tests are passing here.\r\n\r\nRealistically, I probably won't have time to make bigger changes - and I am probably not the best person to do it anyway since I don't have a good dev environment set up and am not sure how the tests work.  And I don't want to start a branch if I can't finish it quickly\r\n\r\nI think if I did do something, I would split `start.sh` into a user and root portion, root portion calls user portion, and then `start-notebook.sh` calls the right one depending on the current uid."}}
{"actor":{"display_login":"rkdarst"}}