Catalog / Developer platforms

JupyterHub

Multi-user notebook server for data science teams

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace5.5.2↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
5.5.2$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-07Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseBSD-3-Clause
UpstreamProject Jupyter
Machine-readableproduct.json · catalog.json
What is JupyterHub

JupyterHub is a multi-user server for Jupyter notebooks: it gives each user their own, independent JupyterLab notebook server behind a single entry point. This build runs the Hub as a Python application (JupyterHub 5.5.0 with the JupyterLab 7 single-user server) and uses systemdspawner to launch every user's server inside its own systemd unit with cgroup isolation. Authentication is PAM, so users log in with their real Linux account password - no external identity provider required. The public-facing proxy (configurable-http-proxy) is bound to loopback and fronted by nginx for TLS. Per-user notebooks, kernels, and files persist on the instance disk. BSD-3-Clause license, no vendor lock-in. Self-hosted on your own EC2 instance, your notebooks and data never leave your AWS account.

What the Lynxroute image adds

Security hardening:

  • PAM authentication; an admin user with a strong password generated at first boot (written to /root/jupyterhub-credentials.txt)
  • Login restricted to an explicit allow-list - new users are added deliberately, not open by default
  • Each user's notebook server runs in its own systemd cgroup (systemdspawner) with a private temp directory
  • The Hub and its proxy bind to 127.0.0.1 only; host nginx terminates TLS on port 443
  • One-command HTTPS: certbot --nginx (Certbot and the nginx plugin are pre-installed)
  • UFW firewall pre-configured (ports 22 and 443 only)
  • fail2ban, auditd, AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/jupyterhub-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer jupyterhub --plan payg-gen2
az vm create -g my-rg -n jupyterhub --size Standard_D2s_v3 \
  --image lynxroute:jupyterhub:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

No release notes recorded yet.