SageMath for NS8 – multi-user SageMath in the browser via JupyterHub (community module, hobby project)

App
1

Hi all,

Yes, I am a Nerd and I never stoped using systems like Maple V, Mathematica, R-Project or just sage. I know, AI is more feasible nowadays, but for pure Math freaks, Sage is pretty cool, so here is another hobby project from my repository: SageMath packaged for NethServer 8 as a multi-user, browser-based math environment.

What it does

It runs SageMath in the browser as a multi-user JupyterHub: users sign in with their Active Directory / LDAP account and each gets a private, persistent JupyterLab with the SageMath kernel — the classic “everyone has their own worksheets” experience, now on JupyterLab.

Why I built it

The official sagemath/sagemath image is a single-user Jupyter notebook with no login and no separation between users. This module wraps it into a small multi-user server so a whole team can log in with their existing AD accounts, without provisioning anything per user by hand.

Why self-host it?

  • AD/LDAP login. Users authenticate against your existing Active Directory (optionally restricted to a single AD group). The module never stores user passwords — only the read-only bind account.
  • Per-user persistence. Every user gets their own persistent home, so worksheets survive logout and container recreation.
  • Your data stays on your server. No external service, no accounts anywhere else.

NS8 integration

In one rootless container the module adds, on top of the official Sage image:

  • JupyterHub (with configurable-http-proxy) as the front door;
  • the LDAP/Active Directory authenticator for login against existing AD accounts;
  • a SimpleLocalProcessSpawner that gives every user their own persistent home under a named volume.

The hub is started via the base image’s sage -sh entrypoint, so the single-user servers it spawns inherit the Sage environment and the SageMath kernel works out of the box.

Container port 8000 is bound to 127.0.0.1 and published on the module’s FQDN through the node’s Traefik, which also forwards the notebook WebSocket upgrades. Two named volumes survive container recreation: sagemath-hub (hub database + cookie secret) and sagemath-userhomes (per-user notebook homes).

Installation

On a NethServer 8 node:

add-module ghcr.io/tebbiworld/sagemath:latest 1

Then open the module UI and set, on the Settings page:

  • the host name (FQDN, must resolve to the node) and TLS options;
  • AD/LDAP login: LDAPS URL (ldaps://ad.example.org:636), Base DN, a read-only bind/service account, and optionally an access group (use Load groups to pick one). LDAPS is required — AD refuses simple binds on plain :389.

Without AD/LDAP configured the hub still runs, but nobody can log in.

One caveat

SimpleLocalProcessSpawner runs each user’s server as the container’s own user in a separate HOME. It gives per-user files — suitable for a trusted group (e.g. one AD group) — but it is not OS-level sandboxing between users. Don’t expose it to untrusted parties as a hardened multi-tenant service.

Important disclaimer

This is a private hobby project, built for my own needs and shared as-is. No warranty, no guaranteed support, use at your own risk. It is an unofficial, community-built package, not affiliated with or endorsed by the SageMath project; “SageMath” is used only to identify the packaged software. The runtime image builds on the upstream sagemath/sagemath image; the module’s own code is GPL-3.0-or-later.

Feedback and bug reports are welcome via GitHub issues, but please don’t expect enterprise-level maintenance.

Have fun with it!