JupyterLab

This example installs JupyterLab into a Python microVM, stores notebooks on a sized root disk, and exposes the server only on host loopback.

Run JupyterLab

Start JupyterLab

Set a temporary token in the host shell:

export JUPYTER_TOKEN="$(openssl rand -hex 24)"

$bytes = New-Object byte[] 24
$rng = [Security.Cryptography.RandomNumberGenerator]::Create()
$rng.GetBytes($bytes)
$rng.Dispose()
$env:JUPYTER_TOKEN = -join ($bytes | ForEach-Object { $_.ToString('x2') })

Create a startup script for the guest:

start-jupyter.sh

#!/bin/sh
set -eu

pip install --no-cache-dir jupyterlab==4.6.2
exec jupyter lab \
  --ip=0.0.0.0 \
  --port=8888 \
  --no-browser \
  --allow-root \
  --IdentityProvider.token="$JUPYTER_TOKEN"

Start the server:

msb run -d --name jupyter-demo --replace \
  --cpus 2 --memory 2G --root-disk 6G \
  -p 127.0.0.1:8888:8888 \
  -e JUPYTER_TOKEN="$JUPYTER_TOKEN" \
  --mkdir /workspace \
  --workdir /workspace \
  --script-path start-jupyter:./start-jupyter.sh \
  --entrypoint start-jupyter \
  python:3.13-slim

msb run -d --name jupyter-demo --replace `
  --cpus 2 --memory 2G --root-disk 6G `
  -p 127.0.0.1:8888:8888 `
  -e "JUPYTER_TOKEN=$env:JUPYTER_TOKEN" `
  --mkdir /workspace `
  --workdir /workspace `
  --script-path start-jupyter:./start-jupyter.sh `
  --entrypoint start-jupyter `
  python:3.13-slim

Open http://127.0.0.1:8888/lab?token=<token> in your browser and replace <token> with the value generated above.

Verify the service

Check the authenticated API from the host:

curl -sS "http://127.0.0.1:8888/api?token=$JUPYTER_TOKEN" | head

curl.exe -sS "http://127.0.0.1:8888/api?token=$env:JUPYTER_TOKEN" | Select-Object -First 10

Then inspect the recent server output:

msb logs --tail 20 jupyter-demo

The logs show Jupyter Server listening on guest port 8888. Notebooks saved under /workspace remain on the root disk when the sandbox stops and starts.

The token is visible to the guest and to processes that can inspect the host command environment. Use the secrets workflow for production credentials, retain the loopback bind, and place a TLS-terminating authenticated proxy in front of any remote deployment.

Clean up

Remove the sandbox:

msb rm -f jupyter-demo

Clear the token from the host shell:

rm -f start-jupyter.sh
unset JUPYTER_TOKEN

Remove-Item start-jupyter.sh
Remove-Item Env:JUPYTER_TOKEN

Copy any notebooks you want to keep to the host before removing the sandbox.

⌘I

Agents

CI/CD

Docker

Sandbox Workflows

Automation & Tooling

Data & Observability

Run JupyterLab

​Run JupyterLab

Run JupyterLab