Jupyter Notebook module

[bpmct]

A discussion dedicated to the Jupyter Notebook module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	7 / 25	0 / 20	7 / 20	10 / 10	38 / 100

Drilldown

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows two binding modes (default loopback and explicit host = "0.0.0.0" external access) with a warning about security tradeoffs, but other configurable modes (requirements_path, pip_install_extra_packages, share values) have no dedicated examples.
Visual preview	5	5	README embeds ../../.images/jupyter-notebook.png, verified to exist (414.0 KB).

Credential Hygiene — 0 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	0	Module has no credential/secret inputs at all; no sensitive = true usage exists and this isn't an "if applicable" tagged theme, so absence scores zero per the rubric's N/A handling rule.
Non-hardcoded auth path	4	0	No auth mechanism (ServiceAccount, OAuth, API key helper, etc.) is documented; notebook token/password are explicitly disabled (--ServerApp.token='', --ServerApp.password=''), relying solely on Coder's app proxy, which is not documented as an auth path.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh installs via pipx install -q notebook, pulling from PyPI with no module variable overriding the install source URL. No such variable exists in main.tf.
Bring-your-own binary	10	5	Script checks command -v jupyter-notebook and skips install if already present, effectively allowing baked-in binaries — but this behavior is undocumented in the README, so it's a code-only, under-documented path.
Egress transparency	3	0	No dedicated network/offline/air-gapped section in the README; PyPI/pipx network dependency is not called out anywhere.
Runs without sudo	2	2	run.sh never invokes sudo; pipx install, kernel start, and package installs all run as the invoking user. Verified from script contents alone.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have descriptions; host and share have validation blocks (including a regex guarding against shell injection in host); sensible defaults (port = 19999, host = "127.0.0.1", share = "owner").
Test coverage	4	4	main.tftest.hcl covers business logic (default binding, explicit host, IPv6 loopback, unsafe host rejection) and main.test.ts adds end-to-end container-based verification of rendered scripts and injection-safety, a solid combined test story.

IDE Integration — 7 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource is defined with subdomain = true, correct url, icon, share, order, and group support — a complete, built-in dashboard entry.
Managed configuration	6	0	No documented support for managing Jupyter settings/config (e.g., kernel config, server config files); only ad-hoc pip package installation is exposed.
Configurable folder or workdir	6	0	No variable exposes a notebook root directory or workdir to open on launch.
Pre-installed extensions (web IDE)	6	0	pip_install_extra_packages/requirements_path install arbitrary Python packages but are not documented as an extension-installation mechanism for Jupyter.

Overall — 38 / 100

Raw 35 / 92 → round(35 / 92 × 100) = 38

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.