I wonder if there is an existing OnDemand interactive app that could be used to launch Python web apps by running say an ASGI server. If not, I might be able to find time to write one. I want an app that isn’t tied to a specific web application and instead is flexible enough to run basically anything Python, so that users can use it for hosting web apps on Slurm.
I’m imagining that you would provide the app either as an HPC filesystem path, or a GitHub repository, or a URL, and the app would clone it and launch the server. Would this be useful to others? Are there any particular security risks posed by this flexibility?
I think it comes down to the app being launched not necessarily this methodology. You never know what an app may do on purpose or open the user up to by accident (i.e., no authentication so anyone at your site can connect to it).
You could boot the app in a network namespace so that, for example, it doesn’t have internet access. You could also boot it in a filesystem namespace so certain directories (like ~/.ssh) don’t aren’t there at all. bubblewrap is quite nice for this but there’s also unshare.
You could even provide a small proxy in front of it to enforce authentication in case the app itself doesn’t have one.