truebyteinnovationllp/jupyterhub

•Updated 3 months ago

Hardened JupyterHub from source — Debian 13, Python 3.13+Node 22, 0 CVEs, Cosign

Image

10K+

truebyteinnovationllp/jupyterhub repository overview

⁠JupyterHub — Hardened, Source-Built Image

Minimal, security-hardened JupyterHub on Debian 13 — built entirely from source following the same hardening approach as Docker Hardened Images (DHI). A four-stage build clones the pinned upstream commits, compiles configurable-http-proxy from Node 22, installs JupyterHub into an isolated Python 3.12 venv, and ships a lean non-root runtime image with the package manager removed.

⁠Why this image?

Feature	Official `jupyterhub/jupyterhub`	This image
Base OS	Ubuntu	Debian 13 (trixie-slim)
OS CVEs	Multiple HIGH	0 HIGH/CRITICAL — `apt upgrade` + no package manager
Python version	varies	Python 3.12 (Trixie default — builder matches runtime)
Python venv isolation	No	Yes — deps can't bleed into OS Python
Package manager at runtime	Yes (apt)	Removed — no new packages can be installed
pycurl excluded	No	Yes — avoids libcurl+krb5+gnutls CVE surface
Non-root	No	Yes — uid/gid 65532 (DHI convention)
Cosign signed	No	Yes
SBOM + provenance	No	Yes
Multi-arch	amd64, arm64	amd64, arm64

⁠Tags

Tag	JupyterHub version	Platforms
`5.5.0`, `latest`	JupyterHub 5.5.0 + configurable-http-proxy 5.2.0	`linux/amd64` · `linux/arm64`

⁠Quick start

docker run -d --name jupyterhub \
  -p 8000:8000 \
  -v jupyterhub-data:/srv/jupyterhub \
  truebyteinnovationllp/jupyterhub:5.5.0

Open http://localhost:8000⁠ and log in with any local system user (PAM authenticator is the default). To use a dummy authenticator for testing:

docker run -d --name jupyterhub \
  -p 8000:8000 \
  -e JUPYTERHUB_AUTHENTICATOR=jupyterhub.auth.DummyAuthenticator \
  -e JUPYTERHUB_DUMMY_PASSWORD=test \
  truebyteinnovationllp/jupyterhub:5.5.0

⁠Configuration

Mount your own jupyterhub_config.py at /etc/jupyterhub/jupyterhub_config.py:

docker run -d --name jupyterhub \
  -p 8000:8000 \
  -v $(pwd)/jupyterhub_config.py:/etc/jupyterhub/jupyterhub_config.py:ro \
  -v jupyterhub-data:/srv/jupyterhub \
  truebyteinnovationllp/jupyterhub:5.5.0

Common configuration options via environment variables:

Variable	Purpose
`JUPYTERHUB_CRYPT_KEY`	Cookie encryption key (generate with `openssl rand -hex 32`)
`JUPYTERHUB_PROXY_AUTH_TOKEN`	Token for the configurable-http-proxy REST API
`CONFIGPROXY_AUTH_TOKEN`	Alternative proxy token variable

See the JupyterHub configuration reference⁠ for all options.

⁠Kubernetes / Helm

Use with the official Zero to JupyterHub Helm chart⁠ by overriding the hub image:

hub:
  image:
    name: truebyteinnovationllp/jupyterhub
    tag: "5.5.0"

The image runs as uid/gid 65532 and is compatible with Kubernetes runAsNonRoot: true and the restricted PodSecurityAdmission profile.

⁠Ports

Port	Purpose
`8000`	JupyterHub public HTTP interface
`8001`	JupyterHub internal API (spawners, services)
`8081`	configurable-http-proxy REST API

⁠Verifying the signature

curl -sSfL https://gitlab.truebyteinnovation.com/internal-docker/docker-images/-/raw/main/assets/cosign.pub \
  -o cosign.pub
cosign verify --key cosign.pub truebyteinnovationllp/jupyterhub:5.5.0

⁠Vulnerability status

Scanned with Trivy and Docker Scout on every build. CVEs suppressed via OpenVEX (jupyterhub.openvex.json):

CVE	Package	Severity	Justification
CVE-2026-53612	`util-linux`	N/A	Privileged OS utilities unused at runtime (non-root, no package manager) — same CVE accepted by DHI
CVE-2026-53613	`util-linux`	N/A	Same reasoning
CVE-2026-53614	`util-linux`	N/A	Same reasoning
CVE-2026-53615	`util-linux`	N/A	Same reasoning

All suppressions match the Docker Hardened Images (DHI) vulnerability profile for JupyterHub 5.5.x (fips).

⁠Build approach

Four-stage Dockerfile following DHI hardening principles:

source — pinned git clone of JupyterHub 97b3154 and CHP da6e57a, commit-verified
node-builder — npm ci --omit=dev for configurable-http-proxy (no pkg bundler)
py-builder — debian:trixie-slim base (Python 3.12 matching runtime), isolated venv, pip install jupyterhub==5.5.0, pycurl excluded, test dirs stripped
runtime — debian:trixie-slim, apt-get upgrade, minimal packages, apt/dpkg removed, uid 65532

⁠Source

Image source: https://gitlab.truebyteinnovation.com/internal-docker/docker-images⁠
Upstream: https://github.com/jupyterhub/jupyterhub⁠
License: BSD-3-Clause⁠

Maintained by TrueByte Innovation⁠.

Tag summary

Recent tags

Content type

Image

Digest

sha256:847601d63…

Size

112.1 MB

Last updated

3 months ago

docker pull truebyteinnovationllp/jupyterhub