AWS sagemaker documentation change
Summary
Restructured documentation to add health check requirements, URL specifications, and detailed Dockerfile examples for custom JupyterLab images. Added security-related configurations like token disabling and CORS settings.
Security assessment
Added documentation about authentication configurations (disabling tokens, allowing all origins) and security-related Dockerfile parameters, but no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/sagemaker/latest/dg/studio-updated-jl-admin-guide-custom-images.md b/sagemaker/latest/dg/studio-updated-jl-admin-guide-custom-images.md index 43e880c7d..98f49c0a1 100644 --- a//sagemaker/latest/dg/studio-updated-jl-admin-guide-custom-images.md +++ b//sagemaker/latest/dg/studio-updated-jl-admin-guide-custom-images.md @@ -5 +5 @@ -# Customize environments using custom images +Health check and URL for applicationsDockerfile examples @@ -7 +7 @@ -If you need functionality that is different than what's provided by SageMaker distribution, you can bring your own image with your custom extensions and packages. You can also use it to personalize the JupyterLab UI for your own branding or compliance needs. +# Custom images @@ -9 +9 @@ If you need functionality that is different than what's provided by SageMaker di -For a tutorial that helps you create an image that your users can run in their JupyterLab environment, see [Provide users with access to custom images](./studio-updated-jl-provide-users-with-images.html). +If you need functionality that is different than what's provided by SageMaker distribution, you can bring your own image with your custom extensions and packages. You can also use it to personalize the JupyterLab UI for your own branding or compliance needs. @@ -11 +11 @@ For a tutorial that helps you create an image that your users can run in their J -For requirements for your image, see [Dockerfile specifications](./studio-updated-jl-image-specifications.html). +The following page will provide JupyterLab-specific information and templates to create your own custom SageMaker AI images. This is meant to supplement the Amazon SageMaker Studio information and instructions on creating your own SageMaker AI image and bringing your own image to Studio. To learn about custom Amazon SageMaker AI images and how to bring your own image to Studio, see [Custom images](./studio-updated-byoi.html). @@ -15 +15,76 @@ For requirements for your image, see [Dockerfile specifications](./studio-update - * [Provide users with access to custom images](./studio-updated-jl-provide-users-with-images.html) + * Health check and URL for applications + + * Dockerfile examples + + + + +## Health check and URL for applications + + * `Base URL` – The base URL for the BYOI application must be `jupyterlab/default`. You can only have one application and it must always be named `default`. + + * `HealthCheck API` – SageMaker AI uses the health check endpoint at port `8888` to check the health of the JupyterLab application. `jupyterlab/default/api/status` is the endpoint for the health check. + + * `Home/Default URL` – The `/opt/.sagemakerinternal` and `/opt/ml` directories that are used by AWS. The metadata file in `/opt/ml` contains metadata about resources such as `DomainId`. + + * Authentication – To enable authentication for your users, turn off the Jupyter notebooks token or password based authentication and allow all origins. + + + + +## Dockerfile examples + +The following examples are `Dockerfile`s that meets the above information and [Custom SageMaker AI image specifications](./studio-updated-byoi-specs.html). + +Example Amazon Linux 2 Dockerfile + + +The following is a example Amazon Linux 2 Dockerfile that meets the above information and [Custom SageMaker AI image specifications](./studio-updated-byoi-specs.html). + + + FROM public.ecr.aws/amazonlinux/amazonlinux:2023 + + ARG NB_USER="sagemaker-user" + ARG NB_UID=1000 + ARG NB_GID=100 + + # Install Python3, pip, and other dependencies + RUN yum install -y \ + python3 \ + python3-pip \ + python3-devel \ + gcc \ + shadow-utils && \ + useradd --create-home --shell /bin/bash --gid "${NB_GID}" --uid ${NB_UID} ${NB_USER} && \ + yum clean all + + RUN python3 -m pip install --no-cache-dir \ + 'jupyterlab>=4.0.0,<5.0.0' \ + urllib3 \ + jupyter-activity-monitor-extension \ + --ignore-installed + + # Verify versions + RUN python3 --version && \ + jupyter lab --version + + USER ${NB_UID} + CMD jupyter lab --ip 0.0.0.0 --port 8888 \ + --ServerApp.base_url="/jupyterlab/default" \ + --ServerApp.token='' \ + --ServerApp.allow_origin='*' + +Example Amazon SageMaker Distribution Dockerfile + + +The following is a example Amazon SageMaker Distribution Dockerfile that meets the above information and [Custom SageMaker AI image specifications](./studio-updated-byoi-specs.html). + + + FROM public.ecr.aws/sagemaker/sagemaker-distribution:latest-cpu + ARG NB_USER="sagemaker-user" + ARG NB_UID=1000 + ARG NB_GID=100 + + ENV MAMBA_USER=$NB_USER + + USER root @@ -17 +92,2 @@ For requirements for your image, see [Dockerfile specifications](./studio-update - * [Dockerfile specifications](./studio-updated-jl-image-specifications.html) + RUN apt-get update + RUN micromamba install sagemaker-inference --freeze-installed --yes --channel conda-forge --name base @@ -18,0 +95 @@ For requirements for your image, see [Dockerfile specifications](./studio-update + USER $MAMBA_USER @@ -19,0 +97,2 @@ For requirements for your image, see [Dockerfile specifications](./studio-update + ENTRYPOINT ["jupyter-lab"] + CMD ["--ServerApp.ip=0.0.0.0", "--ServerApp.port=8888", "--ServerApp.allow_origin=*", "--ServerApp.token=''", "--ServerApp.base_url=/jupyterlab/default"] @@ -30 +109 @@ Detach Git repo URLs -Provide users with access to custom images +Update the SageMaker Distribution Image