From 150ad4dee6696cbac336695ada3a052a1626c11d Mon Sep 17 00:00:00 2001 From: Eric Charles Date: Sun, 1 Nov 2026 11:35:42 +0100 Subject: [PATCH] 1.11.4: a foreign image keeps no JupyterLab --- code_sandboxes/__version__.py | 2 +- code_sandboxes/environments/adapters/datalayer.py | 4 ++++ tests/test_environment_foreign_contract_layer.py | 8 ++++++++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/code_sandboxes/__version__.py b/code_sandboxes/__version__.py index b8045f5..00a903c 100644 --- a/code_sandboxes/__version__.py +++ b/code_sandboxes/__version__.py @@ -1 +1 @@ -__version__ = "1.11.3" +__version__ = "1.11.4" diff --git a/code_sandboxes/environments/adapters/datalayer.py b/code_sandboxes/environments/adapters/datalayer.py index e8fed0e..5475a9d 100644 --- a/code_sandboxes/environments/adapters/datalayer.py +++ b/code_sandboxes/environments/adapters/datalayer.py @@ -241,6 +241,10 @@ def _contract_user() -> list[str]: user, uid, gid, home = contract.user, contract.uid, contract.gid, contract.home reserved, reserved_parent = contract.reserved_path, str(Path(contract.reserved_path).parent) return [ + # `datalayer` brings JupyterLab, which a sandbox never serves: it starts + # `jupyter server`. Out, and with it Lab's bundle and staging lock, + # whose pins can block the scan with no fixed release to move to. + "RUN uv pip uninstall --system jupyterlab", f"RUN pwd > {TASK_WORKDIR_FILE} && chmod 0644 {TASK_WORKDIR_FILE} " f'&& if [ "$(pwd)" != / ]; then find "$(pwd)" -path {reserved} -prune ' f"-o ! -path {reserved_parent} ! -path / -exec chown -h {uid}:{gid} {{}} +; fi", diff --git a/tests/test_environment_foreign_contract_layer.py b/tests/test_environment_foreign_contract_layer.py index baf1a79..dc6f797 100644 --- a/tests/test_environment_foreign_contract_layer.py +++ b/tests/test_environment_foreign_contract_layer.py @@ -509,3 +509,11 @@ def test_the_kernel_runs_in_the_contracts_working_directory(): pinned = next(line for line in _contract_user() if "MappingKernelManager.root_dir" in line) assert "/home/datalayer" in pinned and "/usr/local/share/jupyter_config.py" in pinned + + +def test_a_foreign_image_keeps_no_jupyterlab(): + """A sandbox starts `jupyter server`. JupyterLab, which `datalayer` brings, is + taken out once the lock is installed, its bundle and staging lock with it.""" + from code_sandboxes.environments.adapters.datalayer import _contract_user + + assert "RUN uv pip uninstall --system jupyterlab" in _contract_user()