Docker-stacks: just installed the docker image-requesting sudo password for jovyan

[SemanticPrincess]

Hi, I had just installed the jupyter/datascience-notebook image.

Command: docker pull jupyter/datascience-notebook

When I executed command to run
docker run -d -p 8888:8888 -v /home/Paula/dockerNotebooks:/home/ds/notebooks
and
docker exec -it containerName /bin/bash

I get 'jovyan' instead of 'ds'. When I execute a sudo command it requires a password and I don't know what it is for jovyan...can you advise? For example, I tried to change file permissions on a file 'sudo chmod 777 filename' and I am requested to enter a password.

Thanks.
paula

[parente]

Hi @SemanticPrincess . The images here are configured to use the jovyan user by default. Using a different user name requires rebuilding the images.

The README in the datascience-notebook folder explains how to enable sudo within the container. See the section titled Docker Options.

[Niko-La]

docker run -d -v /src/work:/home/jovyan/work -e GRANT_SUDO=yes -p 8888:8888 jupyter/datascience-notebook start-notebook.sh --NotebookApp.token=''

is this correct? I am not seeing the my notebook up when i add this.

when i bash into it keeps printing out yes...

when i run it without GRANT_SUDO= yes and docker exec into it to create ipynb file it ask for jovyan password

-volume mount also is not working

i am on ubuntu linux

[parente]

There were some changes to the start scripts yesterday. If you've pulled the latest and are now getting that behavior there might be a regression. I'll try to reproduce sometime today.

[Niko-La]

docker run -d -v ~/src/work:/home/jovyan/work -p 8888:8888 jupyter/datascience-notebook start-notebook.sh --NotebookApp.token=''

this command worked for me for mounting. I assume if u need root access u can add the

-e GRANT_SUDO=yes

[parente]

@Niko-La is everything working for you now as expected?

[Niko-La]

@parente working perfectly on windows quickstart docker

in Ubuntu running the same command. are able to only get the notebook up, if I ommit -e flag.
but can not find the mounted volume and can only create new notebooks outside the work folder. Inside permission is denied.

can you provide a docker run command with mounted volume for linux system?

very strange/

[hristo-vrigazov]

+1, I am on Ubuntu and can't get this to work.

[parente]

If you mount a host directory as a volume within the container, you must make sure that the directory on the host gives write access to the NB_UID (notebook userid) which defaults to 1000 (https://github.com/jupyter/docker-stacks/blob/master/base-notebook/README.md#docker-options).

[Niko-La]

@parente I was able to get it working using the tensorflow offical image which also runs jupyter

sudo docker run -it -v /home/linux2332/notebooks:/notebooks -p 8888:8888 tensorflow/tensorflow:1.3.0

its a work around.

[parente]

Tested just now on my linux box:

# create a directory
mkdir work
# give the default jovyan (uid=1000) user ownership
sudo chown 1000 work
# start the container with the host work folder mounted
docker run -it --rm -p 8888:8888 -v `pwd`/work:/home/jovyan/work jupyter/datascience-notebook

The tensorflow/tensorflow notebook works without the permission change on the host volume because it runs the notebook server as root in the container. The images here run the notebook server as an unprivileged user jovyan by default for security reasons.

[anatoliykmetyuk]

Any news on what is the password for sudo?

[parente]

Setting the GRANT_SUDO environment variable when launching a container should cause the container startup script to grant the jovyan user passwordless sudo (see: https://github.com/jupyter/docker-stacks/blob/master/base-notebook/start.sh#L45). If that's not working for your use case, we should debug and fix it.

The jovyan user purposely does not have a password set with sudo access granted by default (i.e., without specifying GRANT_SUDO) to avoid the case where a user starts a container from these images on a public-facing host and is unaware that anyone in the world can obtain root in the container after finding the password here on GitHub.

[sinramyeon]

@anatoliykmetyuk

how'about try

docker run -it --rm \
-p 8888:8888 \
--user root \
-e NB_GID=100 \
-e GEN_CERT=yes \
-e GRANT_SUDO=yes \
jupyter/pyspark-notebook

[asanchez75]

Here, there is an example for a Dockerfile

`
FROM jupyter/datascience-notebook
MAINTAINER Adam Sanchez [e-mail]

USER root
RUN apt-get update && apt-get install -y graphviz git

USER jovyan
RUN cd /tmp && \
git clone https://github.com/asanchez75/sparql-kernel.git && \
cd /tmp/sparql-kernel && \
python setup.py install

RUN jupyter sparqlkernel install --user && \
pip install graphviz && \
pip install ipython-sql && \
pip install psycopg2 && \
pip install gastrodon

`

[parente]

This issue has been inactive for a while now, has an explanation for why there's no password set for the jovyan user by default, and has a couple examples of how to install packages in this setup. I'm going to close out this issue. If there's further questions, we should address them in #538 and future documentation PRs.

[anatoliykmetyuk]

@parente ,

Setting the GRANT_SUDO environment variable when launching a container should cause the container startup script to grant the jovyan user passwordless sudo (see: https://github.com/jupyter/docker-stacks/blob/master/base-notebook/start.sh#L45). If that's not working for your use case, we should debug and fix it.

Nope, setting the environment variable did not grant passwordless sudo. When I do sudo, I am asked for password. When I just press Enter without entering the password, I get "Sorry, try again".

[anatoliykmetyuk]

Figured out the problem. Originally, I was starting the container via docker-compose and then executed bash on it directly via sudo docker exec -ti container_name bash. Turns out you need to run the start.sh script first and under --user root like this: sudo docker exec -ti --user root container_name start.sh.

[untaljohanperez]

Try this

docker exec -it -u root container_id bash

[jediwarpraptor]

Try this

docker exec -it -u root container_id bash

Why didn't @parente just say this a year ago? smh

[ericdill]

Why didn't @parente just say this a year ago? smh

Are you really complaining that some person on the internet that you dont know didn't help you in the way that you wanted to be helped for free? Your negativity and, quite frankly, your feelings of entitlement to free help on the internet are unhelpful and reflects very poorly on you. Please try to be more polite in the future.

[jediwarpraptor]

LOL - this is not a scathing 3 paragraph rant. It's just an
obvservation... Look back at the thread... dude keeps on repeating the same
thing over and over again and people keep coming back saying I can't
sudo. Hindsight is 20/20 but looking back - a huge chunk of this thread
would have been made unnecessary with that one comment.

On Fri, Jan 11, 2019 at 9:00 AM Eric Dill [e-mail] wrote:

Why didn't @parente https://github.com/parente just say this a year
ago? smh

Are you really complaining that some person on the internet that you dont
know didn't help you in the way that you wanted to be helped for free? Your
negativity and, quite frankly, your feelings of entitlement to free help on
the internet are unhelpful and reflects very poorly on you. Please try to
be more polite in the future.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/jupyter/docker-stacks/issues/408#issuecomment-453525406,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AQPTEAioi0MN4QMAbUuTiyheyPAKVoxFks5vCJkLgaJpZM4OHUb4
.

--
Jay L. Stevens
jay@mandarincreativegroup. [e-mail]

[hemangjoshi37a]

Has anyone found any password yet for jovyan??

please help.

[romainx]

Hello @hemangjoshi37a if you want jovyan to be sudoer you have to use launch the container as root and to use a specific option (GRANT_SUDO=yes) to launch it as explained in the documentation. With this option you will be able to perform passwordless sudo with jovyan.

For example

$ docker run -p 8888:8888 --user root -e GRANT_SUDO=yes jupyter/base-notebook

# Then in the notebook for example
jovyan@8e51268386cf:~$ sudo -s
root@8e51268386cf:~#

As a reminder please note

⚠️ You should only enable sudo if you trust the user or if the container is running on an isolated host.

Best

[hemangjoshi37a]

But sir, I am using docker from kubernetes cluster and I don't have any
idea how to run kubernete container with sudo access. Please help me.

On Fri, 5 Jun 2020 at 09:51, Romain [e-mail] wrote:

Hello @hemangjoshi37a https://github.com/hemangjoshi37a if you want
jovyan to be sudoer you have to use launch the container as root and to
use a specific option (GRANT_SUDO=yes) to launch it as explained in the
documentation
https://jupyter-docker-stacks.readthedocs.io/en/latest/using/common.html#docker-options.
With this option you will be able to perform passwordless sudo with jovyan
.

For example

$ docker run -p 8888:8888 --user root -e GRANT_SUDO=yes jupyter/base-notebook

Then in the notebook for example

jovyan@8e51268386cf:~$ sudo -s

root@8e51268386cf:~#

As a reminder please note

⚠️ You should only enable sudo if you trust the user or if the container
is running on an isolated host.

Best

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/jupyter/docker-stacks/issues/408#issuecomment-639249211,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AC6RPGNYQKKYVA7TQ7VFUZTRVBXC5ANCNFSM4DQ5I34A
.

--
Regards,
Hemang Joshi,
Email : [email protected]
mobile : [phone]

[romainx]

@hemangjoshi37a I'm afraid you cannot if the GRANT_SUDO environment variable is not set, see https://github.com/jupyterhub/zero-to-jupyterhub-k8s/issues/562.

jovyan is only added to the sudoers if this condition is met.

https://github.com/jupyter/docker-stacks/blob/76402a27fd13e649a3166b1da5a162ac476912bf/base-notebook/start.sh#L90-L93

Best.

[sanidhya-singh]

Try this

docker exec -it -u root container_id bash

This worked for me

[JamesTownend]

This Dockerfile worked for me to provide user jovyan password-less sudo:

FROM jupyter/tensorflow-notebook:latest

USER root

# Provide password-less sudo to NB_USER
RUN \
    sed -i /etc/sudoers -re 's/^%sudo.*/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g' && \
    sed -i /etc/sudoers -re 's/^root.*/root ALL=(ALL:ALL) NOPASSWD: ALL/g' && \
    sed -i /etc/sudoers -re 's/^#includedir.*/## **Removed the include directive** ##"/g' && \
    echo "${NB_USER} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \  
    chmod g+w /etc/passwd

USER $NB_UID

CMD bash

Build and run with:

docker image build -t jupyter_tf .

docker run -v ~/vol:/home/jovyan/vol -p 8888:8888 -it jupyter_tf

[RichardBronosky]

@hemangjoshi37a I'm afraid you cannot if the GRANT_SUDO environment variable is not set, see jupyterhub/zero-to-jupyterhub-k8s#562.

jovyan is only added to the sudoers if this condition is met.

https://github.com/jupyter/docker-stacks/blob/76402a27fd13e649a3166b1da5a162ac476912bf/base-notebook/start.sh#L90-L93

Best.

I came here to say the same thing. https://github.com/jupyter/docker-stacks/blob/master/base-notebook/start.sh#L89-L93

I will add that if the way the maintainers have chosen to handle users and password, you can change it in a Dockerfile. I explain how to add/change user/password in https://askubuntu.com/a/1307156/146273

username=jovyan
password=jovyan

adduser --gecos "" --disabled-password $username
chpasswd <<<"$username:$password"

This would also work if username=root, but you will need to prevent pam from denying use of su (default behavior in base-notebook). I do this in my Dockerfile like so:

sed -Ei 's/(.*pam_deny.so)/# \1/' /etc/pam.d/su 

[LYU-Daliang]

-e GRANT_SUDO=yes must be used with -u root at the same time. Otherwise will get Container must be run as root to grant sudo permissions.

[apoorvvyavahare]

docker exec -itu 0 containerName bash