Jupyter Notebook module

[bpmct]

A discussion dedicated to the Jupyter Notebook module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	18 / 25	20 / 20	0 / 20	8 / 10	71 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Two documented examples: default loopback mode and external network access mode with explicit host = "0.0.0.0" configuration. Each has sensible defaults and clear use-case framing.
Coder-context framing	8	8	README explicitly states "adds Jupyter Notebook in your Coder template" and explains that "Jupyter Notebook listens on 127.0.0.1 by default so that unauthenticated traffic must pass through Coder's application proxy." Names both Coder and Jupyter Notebook, shows Coder's role in the flow.
Visual preview	5	5	README includes  image embed.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource present with proper url, subdomain, share, order, and group configuration.
Managed configuration	6	6	Documented support for managed configuration via requirements_path and pip_install_extra_packages variables to preinstall packages.
Configurable folder or workdir	6	0	No documented support for opening or starting in a configured folder or workdir. Jupyter starts but does not configure a working directory.
Pre-installed extensions	6	5	Supports pre-installing packages (Python packages for Jupyter) via requirements_path and pip_install_extra_packages. While these are packages rather than Jupyter extensions per se, they serve the analogous role for this web IDE. Slightly under-documented as extension installation mechanism.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. Jupyter is configured with --ServerApp.token='' and --ServerApp.password='' (no auth), relying on Coder's application proxy. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Authentication is handled entirely by Coder's application proxy; no API keys or secrets required. The module explicitly disables Jupyter's native auth to rely on Coder.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the source URL for installing Jupyter Notebook. The run.sh script uses pipx install -q notebook with no URL override mechanism.
Bring-your-own binary	5	0	No documented way to disable installation when Jupyter is already present. The script checks if ! command -v jupyter-notebook but still requires pipx and will attempt installation if the command is not found. No skip-install variable.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The PyPI endpoint for pipx install notebook is inferable but not documented.
Runs without sudo	2	0	The run.sh script never invokes sudo and installs to user space via pipx ($HOME/.local/bin/jupyter-notebook). However, the script exits with error if pipx is not installed, stating "Please install pipx in your Dockerfile/VM image before using this module" - this is a hard requirement but not a sudo requirement. Full credit earned from code inspection. Correction: Re-reading the script, it does run without sudo successfully when pipx is present. Earns full 2 points.

Correction to Restricted-Environment Readiness:

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the source URL for installing Jupyter Notebook. The run.sh script uses pipx install -q notebook with no URL override mechanism.
Bring-your-own binary	5	0	No documented way to disable installation when Jupyter is already present. The script checks if ! command -v jupyter-notebook but still requires pipx and will attempt installation if the command is not found. No skip-install variable.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The PyPI endpoint for pipx install notebook is inferable but not documented.
Runs without sudo	2	2	The run.sh script never invokes sudo. Installs to user space via pipx ($HOME/.local/bin/jupyter-notebook). Runs entirely as unprivileged user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults present (host = "127.0.0.1", port = 19999, log_path, etc.). Validation present on host (regex pattern) and share (enum check).
Test coverage	4	2	.tftest.hcl covers secure defaults, explicit external host, IPv6 loopback, and unsafe host rejection. TypeScript tests in main.test.ts cover end-to-end behavior including container execution and argument verification. However, TypeScript tests are somewhat limited in scope (primarily argument rendering). Partial credit for adequate but not comprehensive coverage.

Overall — 71 / 100

---

Scored against SCORECARD.md on 2026-08-12 with claude-sonnet-4-5.