truebyteinnovationllp/jupyterhub-k8s repository overview

⁠jupyterhub-k8s — Hardened JupyterHub for Kubernetes

Production-ready JupyterHub image for Kubernetes, built on the hardened truebyteinnovationllp/jupyterhub:5.5.0 base and extended with the full Kubernetes spawner stack.

⁠What's included

⁠Security properties

Inherited from truebyteinnovationllp/jupyterhub:5.5.0:

• Debian 13 (trixie-slim) runtime — all OS packages upgraded on build
• uid/gid 65532 (nonroot) — compatible with runAsNonRoot: true and restricted PSA
• No package manager in runtime layer (apt, apt-get removed)
• No perl — binaries and dpkg entry removed; 0 perl CVEs
• 0 OS CVEs — confirmed by Docker Scout and Trivy on every release
• Cosign-signed — verify with assets/cosign.pub
• Multi-arch — linux/amd64 + linux/arm64
• SBOM + provenance attestations on every push

⁠Quick start (Helm chart)

helm repo add truebyteinnovation oci://registry-1.docker.io/truebyteinnovationllp
helm install jupyterhub truebyteinnovation/jupyterhub-chart \
  --namespace jupyterhub --create-namespace \
  --set auth.type=github \
  --set auth.github.clientId=YOUR_CLIENT_ID \
  --set auth.github.clientSecret=YOUR_CLIENT_SECRET \
  --set auth.github.callbackUrl=https://hub.example.com/hub/oauth_callback \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=hub.example.com \
  --set database.type=postgresql \
  --set database.postgresql.host=postgres.default.svc.cluster.local \
  --set database.postgresql.password=YOUR_DB_PASSWORD

⁠Verify the image signature

cosign verify \
  --key https://gitlab.truebyteinnovation.com/internal-docker/docker-images/-/raw/main/assets/cosign.pub \
  truebyteinnovationllp/jupyterhub-k8s:5.5.0

⁠Kernel environments (profile list)

This image spawns user pods — it does not include kernel images. Notebook environments are specified in the Helm chart spawner.profileList and pulled on demand by KubeSpawner:

⁠Source & provenance

Built from source at gitlab.truebyteinnovation.com/internal-docker/docker-images⁠ under the BSD-3-Clause license.