refactor: split Jupyter isolation into a separate change

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Author: devin-ai-integration[bot]

.github/workflows/lint.yml

@@ -57,7 +57,7 @@ jobs:
         run: |
           pnpm run lint
 
-      - name: Test interpreter authentication and Jupyter transport
+      - name: Test interpreter server
         run: uv run --with-requirements template/requirements-test.txt pytest template/tests
 
       - name: Run formatting

template/README.md

@@ -1,32 +1,5 @@
 # Code Interpreter
 
-## Authentication and networking
-
-The template requires envd 0.9.1 or later with the local token delivery socket.
-The server receives a SHA-512 token verifier over `/run/e2b-auth/token.sock` and
-validates `X-Access-Token` locally. It rejects requests before provisioning and
-after disconnecting. `/health` needs no bearer token, but remains unavailable
-until the auth connection is established. Tokenless sandboxes cannot execute code.
-
-The systemd service creates `/etc/e2b/code-interpreter-auth` when first started.
-This marker contains no credentials; it makes envd wait for token delivery to be
-acknowledged during initialization, including resume and fork. The auth connection
-is also reestablished after an interpreter or envd restart.
-
-Jupyter listens only on `/run/e2b-jupyter/server.sock` (mode `0600`, directory
-mode `0700`), including kernel WebSocket channels. Port `49999` remains the
-authenticated interpreter API; Jupyter no longer listens on port `8888`.
-
-Deploy envd and SDK context-auth updates before rebuilding this template. Local
-Docker development explicitly sets `E2B_LOCAL=true`, which disables auth; do not
-use that setting in deployed templates.
-
-Run the server tests locally with:
-
-```sh
-uv run --with-requirements template/requirements-test.txt pytest template/tests
-```
-
 ## Building the production template
 
 To build the official `code-interpreter-v1` template from this repo, use
@@ -149,3 +122,28 @@ Inside a running sandbox you can also inspect things directly:
 journalctl -u jupyter -u code-interpreter
 systemctl status code-interpreter
 ```
+
+## Interpreter authentication
+
+The template requires envd 0.9.1 or later with the local token delivery socket.
+The server receives a SHA-512 token verifier over `/run/e2b-auth/token.sock` and
+validates `X-Access-Token` locally. It rejects requests before provisioning and
+after disconnecting. `/health` needs no bearer token, but remains unavailable
+until the auth connection is established. Tokenless sandboxes cannot execute code.
+
+The systemd service creates `/etc/e2b/code-interpreter-auth` when first started.
+This marker contains no credentials; it makes envd wait for token delivery to be
+acknowledged during initialization, including resume and fork. The auth connection
+is also reestablished after an interpreter or envd restart.
+
+Deploy envd and SDK context-auth updates before rebuilding this template. Local
+Docker development explicitly sets `E2B_LOCAL=true`, which disables auth; do not
+use that setting in deployed templates. Authentication protects the interpreter
+API on port `49999`; it does not change Jupyter's listener or secure direct
+access to Jupyter. Jupyter isolation is a separate transport change.
+
+Run the authentication tests locally with:
+
+```sh
+uv run --with-requirements template/requirements-test.txt pytest template/tests/test_auth.py
+```

template/jupyter-healthcheck.sh

@@ -6,7 +6,7 @@ MAX_RETRIES=50
 RETRY_INTERVAL=0.2
 
 for i in $(seq 1 $MAX_RETRIES); do
-    status_code=$(curl --unix-socket /run/e2b-jupyter/server.sock -s -o /dev/null -w "%{http_code}" "http://localhost/api/status")
+    status_code=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:8888/api/status")
 
     if [ "$status_code" -eq 200 ]; then
         echo "Jupyter Server is healthy"

template/jupyter_server_config.py

@@ -2,9 +2,6 @@
 
 c = get_config()  # noqa
 
-c.ServerApp.sock = "/run/e2b-jupyter/server.sock"
-c.ServerApp.sock_mode = "0600"
-
 
 # Pin the contents root directory.
 #
@@ -25,7 +22,7 @@
 #
 #          Takes precedence over allow_origin_pat.
 #  Default: ''
-c.ServerApp.allow_origin = ""
+c.ServerApp.allow_origin = "*"
 
 
 # Allow requests where the Host header doesn't point to a local server
@@ -41,7 +38,7 @@
 #         Local IP addresses (such as 127.0.0.1 and ::1) are allowed as local,
 #         along with hostnames configured in local_hostnames.
 #  Default: False
-c.ServerApp.allow_remote_access = False
+c.ServerApp.allow_remote_access = True
 
 # Disable cross-site-request-forgery protection
 #

template/server/consts.py

@@ -1,2 +1 @@
-JUPYTER_SOCKET_PATH = "/run/e2b-jupyter/server.sock"
-JUPYTER_BASE_URL = "http://localhost"
+JUPYTER_BASE_URL = "http://localhost:8888"

template/server/main.py

@@ -14,7 +14,7 @@
 from api.models.create_context import CreateContext
 from api.models.execution_request import ExecutionRequest
 from auth import AccessToken, EnvdAuthMiddleware
-from consts import JUPYTER_BASE_URL, JUPYTER_SOCKET_PATH
+from consts import JUPYTER_BASE_URL
 from contexts import create_context, normalize_language
 from envs import LOCAL
 from messaging import ContextWebSocket
@@ -37,9 +37,7 @@
 async def lifespan(app: FastAPI):
     global client
     auth_task = None if LOCAL else asyncio.create_task(access_token.subscribe())
-    client = httpx.AsyncClient(
-        transport=httpx.AsyncHTTPTransport(uds=JUPYTER_SOCKET_PATH), trust_env=False
-    )
+    client = httpx.AsyncClient()
 
     try:
         python_context = await create_context(

template/server/messaging.py

@@ -13,7 +13,7 @@
     Union,
 )
 from pydantic import StrictStr
-from websockets.client import WebSocketClientProtocol, unix_connect
+from websockets.client import WebSocketClientProtocol, connect
 from websockets.exceptions import (
     ConnectionClosedError,
     WebSocketException,
@@ -28,7 +28,7 @@
     OutputType,
     UnexpectedEndOfExecution,
 )
-from consts import JUPYTER_BASE_URL, JUPYTER_SOCKET_PATH
+from consts import JUPYTER_BASE_URL
 from errors import ExecutionError
 from envs import get_envs
 
@@ -67,7 +67,7 @@ def __init__(self, context_id: str, session_id: str, language: str, cwd: str):
         self.language = language
         self.cwd = cwd
         self.context_id = context_id
-        self.url = f"ws://localhost/api/kernels/{context_id}/channels"
+        self.url = f"ws://localhost:8888/api/kernels/{context_id}/channels"
         self.session_id = session_id
         self._executions: Dict[str, Execution] = {}
         self._lock = asyncio.Lock()
@@ -87,9 +87,8 @@ async def connect(self):
         ws_logger = logger.getChild("websockets.client")
         ws_logger.setLevel(logging.ERROR)
 
-        self._ws = await unix_connect(
-            JUPYTER_SOCKET_PATH,
-            uri=self.url,
+        self._ws = await connect(
+            self.url,
             ping_timeout=PING_TIMEOUT,
             max_size=None,
             max_queue=None,
@@ -105,10 +104,7 @@ async def connect(self):
     async def interrupt(self):
         """Interrupt the current kernel execution via the Jupyter REST API."""
         try:
-            async with httpx.AsyncClient(
-                transport=httpx.AsyncHTTPTransport(uds=JUPYTER_SOCKET_PATH),
-                trust_env=False,
-            ) as client:
+            async with httpx.AsyncClient() as client:
                 response = await client.post(
                     f"{JUPYTER_BASE_URL}/api/kernels/{self.context_id}/interrupt"
                 )

template/start-up.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
 
-install -d -m 0700 /run/e2b-jupyter
-
 function start_code_interpreter() {
 	/root/.jupyter/jupyter-healthcheck.sh
 	if [ $? -ne 0 ]; then

template/systemd/jupyter.service

@@ -6,8 +6,6 @@ StartLimitBurst=0
 
 [Service]
 Type=simple
-RuntimeDirectory=e2b-jupyter
-RuntimeDirectoryMode=0700
 Environment=MATPLOTLIBRC=/root/.config/matplotlib/.matplotlibrc
 ExecStart=/usr/local/bin/jupyter server --IdentityProvider.token=""
 ExecStartPost=-/usr/bin/systemctl reset-failed code-interpreter