1.11.4: a foreign image keeps no JupyterLab

code_sandboxes/__version__.py

@@ -1 +1 @@
-__version__ = "1.11.3"
+__version__ = "1.11.4"

code_sandboxes/environments/adapters/datalayer.py

@@ -241,6 +241,10 @@ def _contract_user() -> list[str]:
     user, uid, gid, home = contract.user, contract.uid, contract.gid, contract.home
     reserved, reserved_parent = contract.reserved_path, str(Path(contract.reserved_path).parent)
     return [
+        # `datalayer` brings JupyterLab, which a sandbox never serves: it starts
+        # `jupyter server`. Out, and with it Lab's bundle and staging lock,
+        # whose pins can block the scan with no fixed release to move to.
+        "RUN uv pip uninstall --system jupyterlab",
         f"RUN pwd > {TASK_WORKDIR_FILE} && chmod 0644 {TASK_WORKDIR_FILE} "
         f'&& if [ "$(pwd)" != / ]; then find "$(pwd)" -path {reserved} -prune '
         f"-o ! -path {reserved_parent} ! -path / -exec chown -h {uid}:{gid} {{}} +; fi",

tests/test_environment_foreign_contract_layer.py

@@ -509,3 +509,11 @@ def test_the_kernel_runs_in_the_contracts_working_directory():
 
     pinned = next(line for line in _contract_user() if "MappingKernelManager.root_dir" in line)
     assert "/home/datalayer" in pinned and "/usr/local/share/jupyter_config.py" in pinned
+
+
+def test_a_foreign_image_keeps_no_jupyterlab():
+    """A sandbox starts `jupyter server`. JupyterLab, which `datalayer` brings, is
+    taken out once the lock is installed, its bundle and staging lock with it."""
+    from code_sandboxes.environments.adapters.datalayer import _contract_user
+
+    assert "RUN uv pip uninstall --system jupyterlab" in _contract_user()