summarylogtreecommitdiffstats
path: root/jupyterhub.service
blob: 8de7eb6d94835527c686e34edd2e65f75da15e23 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
[Unit]
Description=JupyterHub server
After=network.target
Documentation=https://jupyterhub.readthedocs.io/en/stable/

[Service]
# Where the PID and other runtime files will be placed.
RuntimeDirectory=jupyterhub
RuntimeDirectoryMode=0755

# Paths in the configuration are relative to the working directory.
WorkingDirectory=/etc/jupyterhub

# The actual command to run. Note this service doesn't need the PID files, but
# JupyterHub does use them internally.
ExecStart=/usr/bin/jupyterhub \
          -f /etc/jupyterhub/jupyterhub_config.py \
          --pid-file=/run/jupyterhub/jupyterhub.pid \
          --ConfigurableHTTPProxy.pid_file=/run/jupyterhub/jupyterhub-proxy.pid

# Apply some service hardening.
# The default LocalProcess spawner needs SETUID and SETGID to run the
# single-user servers. For other spawners you could probably remove these.
CapabilityBoundingSet=CAP_SETUID CAP_SETGID
LockPersonality=true
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=full
ReadWritePaths=/etc/jupyterhub
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service

# Some other hardening that could be enabled for specific setups.
# PrivateUsers=true            # Not with LocalSpawner
# MemoryDenyWriteExecute=true  # Not with configurable-http-proxy

[Install]
WantedBy=multi-user.target