Terminal launcher from Collab launches at wrong place and unidentifiable user

Launching a new terminal from any collab puts the shell at /opt/app-root/src under the user jovyan.

Example:

jovyan@jupyterhub-nb-baumbach:/opt/app-root/src$

This means that at least by default commands executed there affect not only the storage from the collab the user started from but can affect everyone (I haven't tried which permissions I really have).

At least the default starting location should be the root of the collab-local storage rather the root of the storage of all collabs. I personally think that also the user should correspond to the EBRAINS account name and the host should either be hidden or something a user can identify with, but those two are cosmetics. The default location meant that I cloned a git repo to a place where I don't have any reason writing stuff to. Note: I'm not sure if tightening filesystem permissions is advisable, I can imagine scenarios where I want to have read and write access outside of the collab I'm currently in. But that should be something that I intentionally initiate. I.e. a sequence of "start Terminal and execute rm -rf *" should only affect my own local stuff rather than (potentially) everyone else.

At least the default starting location should be the root of the collab-local storage rather the root of the storage of all collabs.

This particular location is "ephemeral" storage, i.e. only there as long as the container instance is running. This also means, that this storage is not visible to other running container instances (e.g. of other users). drive/ and shared/, which are mounted below are different, as those locations provide personal, group-shared, and world-shared access to collabs and the drive thingy. (I'm no expert in this…)

I personally think that also the user should correspond to the EBRAINS account name and the host should either be hidden or something a user can identify with, but those two are cosmetics.

I think that's something the official jupyter container is also doing… and we didn't touch it? But I'm not the expert in this. (Some upstream discussion…)

The default location meant that I cloned a git repo to a place where I don't have any reason writing stuff to.

Technically, placing every user at the same point into the filesystem (in terms of file system hierarchy) simplifies some activities (like testing).

Note: I'm not sure if tightening filesystem permissions is advisable, I can imagine scenarios where I want to have read and write access outside of the collab I'm currently in. But that should be something that I intentionally initiate. I.e. a sequence of "start Terminal and execute rm -rf *" should only affect my own local stuff rather than (potentially) everyone else.

I hope for reasonable permissions for persistent storage (i.e. drive/ and shared/)… but for non-persistent storage, personally, I don't care.

I can try rm -rf * if you insist. I'm pretty sure the fallout will be non-zero.

Sure, because it recursively deletes things below your $PWD… so your suggestion is to have the persistent mount points mounted somewhere else? Like /mnt/{drive,shared}/? Then rm -rf /{,mnt{,/drive,/shared} would be needed to delete stuff where you have write access to… shared collabs, etc. But I'm not sure if we still can list those things (outside of $HOME) in JupyerLab's file/directory browser…

(There was some offline discussion about "Terminal" not starting in file browser $CWD, but in $HOME → this would be probably "fixed" in a newer version of Jupyter, cf. upstream #1366 — something merged in April 2022.)

assigned to @elmath