Jupyter Notebook module

[bpmct]

A discussion dedicated to the Jupyter Notebook module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	18 / 25	20 / 20	0 / 20	8 / 10	71 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Two documented examples: default loopback mode and external network access mode with explicit host = "0.0.0.0". Each has sensible defaults and clear use-case framing.
Coder-context framing	8	8	README explicitly states "adds Jupyter Notebook in your Coder template" and explains that it "listens on 127.0.0.1 by default so that unauthenticated traffic must pass through Coder's application proxy." Names both Coder and Jupyter Notebook, shows Coder's role in the flow.
Visual preview	5	5	README includes  image.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper url, subdomain, share, order, and group configuration.
Managed configuration	6	6	Documented support for managed configuration via requirements_path and pip_install_extra_packages variables to preinstall packages.
Configurable folder or workdir	6	0	No documented support for opening or starting in a configured folder or workdir. Jupyter starts but does not configure a working directory.
Pre-installed extensions	6	5	Documented support for pre-installing packages (Python packages via pip, which are Jupyter's extension mechanism) through requirements_path and pip_install_extra_packages. Half point deducted because these are packages rather than Jupyter-specific extensions/kernels, though this is the standard extension mechanism for Jupyter. Actually, reconsidering: these ARE the proper extension mechanism for Jupyter Notebook. Full credit. Score: 6.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. Jupyter is configured with --ServerApp.token='' --ServerApp.password='' (no auth, relying on Coder proxy). README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Authentication is handled entirely by Coder's application proxy; Jupyter runs without its own auth. This is a documented architectural choice that avoids credential management.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the source URL for downloading Jupyter Notebook. The module uses pipx install -q notebook with a hardcoded package name.
Bring-your-own binary	5	0	No documented way to disable installation when Jupyter is already in the image. The script checks if ! command -v jupyter-notebook but still requires pipx and will attempt installation if the binary is missing. No skip-install variable.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The PyPI endpoint for pipx install notebook is inferable but not documented.
Runs without sudo	2	0	The script requires pipx and installs to $HOME/.local/bin, which works without sudo. However, the script exits with error if pipx is missing rather than providing a fallback. Inspecting run.sh: no sudo invocations, installs to user directory. Actually, this runs entirely without sudo. Full credit. Score: 2.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: log_path, host = "127.0.0.1", port = 19999, share = "owner". Validation on host (regex for safe characters) and share (enum check).
Test coverage	4	2	.tftest.hcl covers secure defaults, explicit external host, IPv6 loopback, and unsafe host rejection. TypeScript tests in main.test.ts cover loopback binding, external host rendering, IPv6, and injection attacks with container execution. However, the TypeScript tests do not cover end-to-end Jupyter Notebook behavior (actual server startup, package installation). Half credit for partial coverage.

Overall — 71 / 100

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.