RDP/VNC page not loading since vnmd/neurodesktop:2025-07-15

[wieluk]

Hey we are having problems with newer versions:

on startup:

ln: failed to create symbolic link '/etc/guacamole/user-mapping.xml': Permission denied
grep: /etc/guacamole/user-mapping.xml: No such file or directory
sed: can't read /etc/guacamole/user-mapping.xml: No such file or directory

when trying to open the page:

touch: cannot touch '/usr/local/tomcat/logs/catalina.out': Permission denied
/usr/local/tomcat/bin/catalina.sh: 513: cannot create /usr/local/tomcat/logs/catalina.out: Permission denied
vncserver: No matching VNC server running for this user!

You will require a password to access your desktops.

getpassword error: Inappropriate ioctl for device
xset:  unable to open display ":1"
guacd[591]: INFO:       Guacamole proxy daemon (guacd) version 1.5.5 started
Password:    Running guacamole

This might be a Issue on our side with a multi-user jupyterhub setup. Do you know how we can fix this?

vnmd/neurodesktop:2025-07-11 and everything before works.

[stebo85]

Dear @wieluk,

@aswinnarayanan changed the permissions to be more secure and not require root. Aswin do you see why it could cause that?

[stebo85]

Dear @wieluk - in addition, our latest release is: 2025-06-10 (https://neurodesk.org/docs/overview/release-history/)

You should not use anything newer than that because it's not tested widely.

[wieluk]

Right, I just went with the Docker tags. Usually latest is the latest stable. Maybe you could consider adding a dev/development/nightly tag, and keep latest pointing to the latest stable?

Or a stable tag that points to the latest release. This would simplify automatic updates with docker containers.

[aswinnarayanan]

Hi @wieluk, what environment is this running it?
Does the jupyter notebooks have sudo?

Right, I just went with the Docker tags. Usually latest is the latest stable. Maybe you could consider adding a dev/development/nightly tag, and keep latest pointing to the latest stable?

Or a stable tag that points to the latest release. This would simplify automatic updates with docker containers.

Will have a look into this. We're currently using the latest tag in our auto-build pipeline, so it needs a bit of rework for this change. But even if patched, we don't recommend using the latest tag in a production system. It's always safer to use the an explicit tag

[wieluk]

Docker containers spawned by jupyterhub.
Yes, they do have sudo access. It doesn't seem possible to run Neurodesktop in a Docker container without it.

You're right. I listed all available tags so users could choose, but since the newest is always at the top, they tend to pick that by default. I'll just manually limit the list to the current release. That said, having a specific tag would definitely make things simpler.

[aswinnarayanan]

Hi @wieluk. Do you have a screenshot of this version selector you're using

[wieluk]

def get_neurodesktop_tags():
    repo_name = "vnmd/neurodesktop"
    base_url = f"https://hub.docker.com/v2/repositories/{repo_name}/tags"

    fixed_top_tags = ["vnmd/neurodesktop:2025-07-11"]
    tags = set()
    url = base_url

    try:
        while url:
            response = requests.get(url, timeout=2)
            if response.status_code == 200:
                data = response.json()
                for tag_info in data.get('results', []):
                    tag_name = tag_info['name']
                    if tag_name.lower() != "latest":
                        full_tag = f"{repo_name}:{tag_name}"
                        if full_tag not in fixed_top_tags:
                            tags.add(full_tag)
                url = data.get('next')
            else:
                break
    except Exception:
        pass

    sorted_tags = sorted(tags, reverse=True)
    return fixed_top_tags + sorted_tags

# Dynamically fetch available images (with hardcoded preferred at top)
c.DockerSpawner.allowed_images = get_neurodesktop_tags()

I just wrote a Python function in jupyterhub that gets all tags from dockerhub sorts them in reverse order and adds one at the top. It used to be latest at top but since it does not work anymore for us I hardcoded the latest working one. But a dynamic top tag or even cutoff for not released versions would be better i guess.

If there are more users it would probably be good to add some caching to prevent rate limits by dockerhub.
Edit: Jupyterhub only calls the function once at startup.