Pin jupyter-notebook version

stack/base/Dockerfile

@@ -26,30 +26,35 @@ RUN if [ "$TARGETARCH" = "arm64" ]; then \
 WORKDIR /opt/
 
 ARG AIIDA_VERSION
-# Pin shared requirements in the base environment.
-# We pin aiida-core to the exact installed version,
-# to prevent accidental upgrade or downgrade, that might
+
+# Pin certain shared requirements in the base environment
+# so that user cannot change their version and accidently break themselves.
+# Pin aiida-core to the exact installed version
+# to prevent accidental upgrade or downgrade that might
 # induce DB migration or break shared dependencies of AiiDAlab Apps.
 RUN echo "aiida-core==${AIIDA_VERSION}" > /opt/requirements.txt
 
-# Install aiida-core and other shared requirements.
-RUN mamba install --yes \
-     mamba-bash-completion \
-     --file /opt/requirements.txt \
-     && mamba clean --all -f -y && \
-     fix-permissions "${CONDA_DIR}" && \
-     fix-permissions "/home/${NB_USER}"
+# Pin jupyter-notebook to prevent downgrades or upgrades to v7
+RUN echo "notebook==$(jupyter-notebook --version)" >> /opt/requirements.txt
 
-# Pin shared requirements in the conda base environment.
 RUN cat /opt/requirements.txt | xargs -I{} conda config --system --add pinned_packages {}
 
-# Upgrade pip to latest
-RUN pip install --upgrade --no-cache-dir pip
-# Configure pip to use requirements file as constraints file.
+# Configure pip to use the same requirements file as constraints file.
 ENV PIP_CONSTRAINT /opt/requirements.txt
 # Ensure that pip installs packages to ~/.local by default
 ENV PIP_USER 1
 
+# Upgrade pip to latest
+RUN mamba update -y pip && mamba clean --all -f -y
+
+# Install aiida-core and other shared requirements.
+RUN mamba install --yes \
+     aiida-core==${AIIDA_VERSION} \
+     mamba-bash-completion \
+     && mamba clean --all -f -y && \
+     fix-permissions "${CONDA_DIR}" && \
+     fix-permissions "/home/${NB_USER}"
+
 # Enable verdi autocompletion.
 RUN mkdir -p "${CONDA_DIR}/etc/conda/activate.d" && \
      echo 'eval "$(_VERDI_COMPLETE=bash_source verdi)"' >> "${CONDA_DIR}/etc/conda/activate.d/activate_aiida_autocompletion.sh" && \

tests/test_base.py

@@ -25,12 +25,34 @@ def test_prevent_installation_of_aiida(
         )
 
 
+@pytest.mark.parametrize("pkg_manager", ["pip", "mamba"])
+def test_prevent_notebook_upgrade(aiidalab_exec, nb_user, pkg_manager):
+    """jupyter-notebook is pinned to the exact version in the container,
+    test that both pip and mamba refuse to update to v7 of the notebook."""
+
+    incompatible_version = "7"
+    with pytest.raises(Exception):
+        aiidalab_exec(
+            f"{pkg_manager} install notebook=={incompatible_version}",
+            user=nb_user,
+        )
+
+
 def test_python_version(aiidalab_exec, python_version):
     info = json.loads(aiidalab_exec("mamba list --json --full-name python"))[0]
     assert info["name"] == "python"
     assert parse(info["version"]) == parse(python_version)
 
 
+def test_pip_version(aiidalab_exec):
+    """We update pip to latest version when building the image,
+    test that we're not using and old pip version"""
+
+    info = json.loads(aiidalab_exec("mamba list --json --full-name pip"))[0]
+    assert info["name"] == "pip"
+    assert parse(info["version"]) >= parse("24.0")
+
+
 def test_create_conda_environment(aiidalab_exec, nb_user):
     output = aiidalab_exec("conda create -y -n tmp", user=nb_user).strip()
     assert "conda activate tmp" in output