The excellent jupyter-remote-desktop-proxy enables you to run arbitrary Linux desktop applications in mybinder.org or on your own JupyterHub! Here are a few fun examples:
qgis, a very popular Geospatial application (via @giswqs)
Basically anything you can run on a Linux desktop can run inside your browser, with fairly usable latencies. This is extremely helpful when part of your workflow might involve pre-developed scientific software that is not really web friendly. Itās also cool, so thereās that.
Iāve developed a template repository with instructions on how you can make your own binderable repo that can run any desktop app you want. Thereās more work to be done in the upstream library, but this should hopefully help you play with unlocking new scientific and educational workflows that were not possible before.
Special thanks to my friend Sanjay Bhangar for recent encouragement!
User feedback is interesting, since this can make it possible for them to do solve subtle edge case problems. E.g., often people run Firefox this way, or a random obscure ancient Java UI library for some scientific application.
Wow, https://xpra.org/ looks super cool, @William_Stein! Thank you for sharing that! Have you had experience with people running stuff that requires GL / GPUs on it? How has that been?
This has really been a great help for my students, so thank you for your work on this @yuvipanda ! We have been using it for the last month or so on our JHub/JLab servers. We have had to check over network policy and ensure traffic is limited to prevent intruder access, but thatās all very reasonable for something like this.
One issue Iāve found with a lot of remote web desktops is that video can be choppy and audio support either not available or a hassle to try to figure outā¦ (RDP tends to work a bit better, IIRC.)
@manics - re: RDP; that could be interesting:-) I donāt think I ever tried to get RDP sessions running from MyBinder; I think I (re)used a Linux-RDP container on hosting elsewhere with all my RDP experiments.
I am looking at Guacamole as well but in a slightly different context. I have been working on Trusted Research Environments for the past few years and z2jh has been a central part of it.
However, this is currently served through a remote desktop environment with additional safeguards against downloading, copy+paste, etc.
I was wondering if there was a way to serve the remote desktop environment (preferably through Apache Guacamole) through JupyterHub (either the same z2jh instance or a separate one) and make the actual analytics workspace with sensitive data available through this.
ie. The first singleuser_server brings up Guacamole and the actual analytics workspace pod is only acccessible from within Guacamole. And, this could be enforced through network policies (eg. Calico).
And, if we set it up so that any time a user requests a āworkspaceā aka āserverā, the following happens:
2 containers get spun up - ideally as 2 separate pods (rather than 2 containers in a pod)
Pod A: Lightweight, Linux desktop environment with limited tools and a modern browser, wrapped in Guacamole.
Pod B: The usual single user server with a choice of interfaces running on customisable compute, etc.
Pod A and Pod B can potentially be scheduled to run on different node pools with different resources, etc.
Pod B is only accessible from Pod A - enforced through network policy ?Calico.
Persistent storage is disabled on Pod A so that even if the user downloads data from JupyterLab served via Pod B - this ends up in Pod A which is entirely ephemeral and is lost when the user has to shutdown the server to access a different workspace. Pod A (Guacamole) prevents removal of data from the desktop environment.
Pod B gets its persistence storage through PV/PVC, in our case Azure File storage.
This prevents moving data from one workspace to another. Letās discuss when we talk on Wednesday.
Will be great to get your thoughts. NHS England has budgeted Ā£100m for Secure Data Environments and seeing that a major chunk of data science happens within the Jupyter universe, will be good to discover what is possible and what has already been done. I love z2jh and will be great to see what others are doing in this space.
Iāve worked around the need to block/limit copy/paste/download by using Apache Guacamole to provide access to a Jupyter desktop. The advantage of guacamole over NoVNC is it runs separately from the desktop so you donāt need a custom image, and you can disable the clipboard server-side:
Thereās an example Z2JH config in there.
You can also use Guacamole to access Windows cloud desktops launched with a custom JupyterHub spawner if you really want
@manics Oohā¦ a spawner for fully blown VMs? Interestingā¦ Do you know if thereās a docker-compose spawner anywhere that lets you deploy a set of networked containers?
