How to Run JupyterLab on an HTTPS URL in a Cloud Sandbox

sbx new --name jupyterlab --type small
id=sb_dw3osvm3vw    # the id that sbx new printed

sbx exec $id --timeout 600 "uv venv --seed ~/jlab --python 3.12 -q && \
  VIRTUAL_ENV=~/jlab uv pip install -q jupyterlab && \
  ~/jlab/bin/jupyter lab --version && ~/jlab/bin/pip --version"

4.6.4
pip 26.2.2 from /home/user/jlab/lib/python3.12/site-packages/pip (python 3.12)

/home/user/jlab/bin/python: No module named pip

sbx exec $id "mkdir -p ~/notebooks && sudo tee /etc/systemd/system/jupyterlab.service >/dev/null <<EOF
[Unit]
Description=JupyterLab
After=network-online.target

[Service]
User=user
WorkingDirectory=/home/user/notebooks
ExecStart=/home/user/jlab/bin/jupyter lab --no-browser --ip=0.0.0.0 --port=8888 --IdentityProvider.token=
Restart=always

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload && sudo systemctl enable --now jupyterlab && sleep 4 && \
systemctl is-active jupyterlab && curl -s -o /dev/null -w '%{http_code}\n' localhost:8888/api/status"

active
200

sbx host $id 8888 --title JupyterLab

https://rosy-zany-sequoia-8888.box.sandboxer.com?_token=<token>

curl -s -o /dev/null -w "%{http_code}\n" https://rosy-zany-sequoia-8888.box.sandboxer.com/lab
curl -s -o /dev/null -w "%{http_code}\n" https://rosy-zany-sequoia-8888.box.sandboxer.com/api/status

401
401

HTTP/2 302
location: /
set-cookie: __sbx_auth=<cookie>; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Lax

HTTP/2 302
location: /lab?

<title>JupyterLab</title>

// node jlab-run.mjs "<private hosted URL with ?_token=…>" "<cell 1>" ["<cell 2>" …]
// Set KERNEL_ID to reuse a running kernel instead of starting one.
const start = new URL(process.argv[2]);
const cells = process.argv.slice(3);
const jar = new Map();
const keep = (res) => {
  for (const c of res.headers.getSetCookie()) {
    const [kv] = c.split(";");
    const i = kv.indexOf("=");
    jar.set(kv.slice(0, i), kv.slice(i + 1));
  }
};
const cookie = () => [...jar].map(([k, v]) => `${k}=${v}`).join("; ");
const base = `${start.protocol}//${start.host}`;

// 1. Trade the hosted-URL token for the __sbx_auth cookie.
keep(await fetch(start, { redirect: "manual" }));
// 2. Load the Lab page; Jupyter sets its _xsrf cookie.
const lab = await fetch(`${base}/lab`, { headers: { Cookie: cookie() } });
keep(lab);
console.log("GET /lab", lab.status);
// 3. Start a kernel through the REST API (or reuse one).
const t0 = performance.now();
let kernelId = process.env.KERNEL_ID;
if (!kernelId) {
  const r = await fetch(`${base}/api/kernels`, {
    method: "POST",
    headers: { Cookie: cookie(), "X-XSRFToken": jar.get("_xsrf"), "Content-Type": "application/json" },
    body: JSON.stringify({ name: "python3" }),
  });
  const kernel = await r.json();
  console.log("POST /api/kernels", r.status, kernel.id ?? kernel);
  kernelId = kernel.id;
}
// 4. Open the kernel websocket and run the cells in order.
const ws = new WebSocket(`wss://${start.host}/api/kernels/${kernelId}/channels`, { headers: { Cookie: cookie() } });
const session = crypto.randomUUID();
let msgId;
const run = () => {
  const code = cells.shift();
  if (code === undefined) { console.log(`done in ${Math.round(performance.now() - t0)} ms`); process.exit(0); }
  msgId = crypto.randomUUID();
  ws.send(JSON.stringify({
    header: { msg_id: msgId, msg_type: "execute_request", username: "", session, version: "5.3", date: new Date().toISOString() },
    parent_header: {}, metadata: {}, channel: "shell",
    content: { code, silent: false, store_history: true, user_expressions: {}, allow_stdin: false, stop_on_error: true },
  }));
};
ws.onopen = run;
ws.onerror = (e) => { console.log("websocket error", e.message ?? e); process.exit(1); };
ws.onmessage = (e) => {
  const m = JSON.parse(e.data);
  if (m.parent_header?.msg_id !== msgId) return;
  const t = m.header.msg_type;
  if (t === "stream") process.stdout.write(m.content.text);
  if (t === "execute_result") console.log(m.content.data["text/plain"]);
  if (t === "error") console.log(m.content.ename, m.content.evalue);
  if (t === "execute_reply") { console.log(`[${m.content.execution_count}] ${m.content.status}`); run(); }
};

node jlab-run.mjs "$URL" "%pip install -q humanize" \
  "import humanize; humanize.naturalsize(3_500_000_000)" "import sys; sys.executable"

GET /lab 200
POST /api/kernels 201 881945a3-7fe0-4232-896a-447045e2a2bf
Note: you may need to restart the kernel to use updated packages.
[1] ok
'3.5 GB'
[2] ok
'/home/user/jlab/bin/python'
[3] ok
done in 2899 ms