Add UNIX socket support to notebook server.

[kwlzn]

This change permits the notebook server to bind to a configurable UNIX socket for cases where UNIX filesystem permissions may be useful to help guard access to the notebook server instance (e.g. such as a shared shell machine). This is mainly useful when paired with SSH tunneling, which directly supports binding TCP ports to UNIX sockets via either of these two option forms:

     -L [bind_address:]port:remote_socket
     -L local_socket:remote_socket

running the notebook server against a test socket:

[omerta ~]$ jupyter notebook --sock /tmp/test.sock --no-browser
[I 22:57:52.941 NotebookApp] It looks like you're running the notebook from source.
        If you're working on the Javascript of the notebook, try running
    
        npm run build:watch
    
        in another terminal window to have the system incrementally
        watch and build the notebook's JavaScript for you, as you make changes.
[I 22:57:53.151 NotebookApp] Serving notebooks from local directory: /Users/kwilson
[I 22:57:53.151 NotebookApp] The Jupyter Notebook is running at:
[I 22:57:53.151 NotebookApp] http+unix://%2Ftmp%2Ftest.sock/
[I 22:57:53.151 NotebookApp] Use Control-C to stop this server and shut down all kernels (twice to skip confirmation).
[I 22:57:53.151 NotebookApp] Welcome to Project Jupyter! Explore the various tools available and their corresponding documentation. If you are interested in contributing to the platform, please visit the communityresources section at https://jupyter.org/community.html.
[C 22:57:53.155 NotebookApp] 
    
    Notebook is listening on http+unix://%2Ftmp%2Ftest.sock/
    
    UNIX sockets are not browser-connectable, but you can tunnel to the instance via e.g.`ssh -L 8888:/tmp/test.sock -N user@this_host` and then opening e.g. http://localhost:8888/?token=0c29e0eb0de85fff9f5d8367d74b58155771fc7df10ab056 in a browser.
[I 00:38:08.283 NotebookApp] 302 GET / (0.0.0.0) 0.83ms

vs client:

[omerta ~]$ nc -U /tmp/test.sock
GET / HTTP/1.0

HTTP/1.1 302 Found
Server: TornadoServer/6.0.3
Content-Type: text/html; charset=UTF-8
Date: Wed, 21 Aug 2019 07:38:08 GMT
Location: /tree?
Content-Length: 0

testing lifecycle (which roundtrips a shutdown request through the server):

[omerta notebook (kwlzn/notebook_unix_socket)]$ jupyter notebook list
Currently running servers:
http://localhost:8889/?token=3f8b4d55ad2348342641c042b5d39ac053ea0c10524bc5bf :: /Users/kwilson
http+unix://%2Ftmp%2Ftest.sock/?token=c3071bb578b9d418ab14908fb915053560e3be9748f9bf74 :: /Users/kwilson
[omerta notebook (kwlzn/notebook_unix_socket)]$ jupyter notebook stop 8889
Shutting down server on ...
[omerta notebook (kwlzn/notebook_unix_socket)]$ jupyter notebook list
Currently running servers:
http+unix://%2Ftmp%2Ftest.sock/?token=c3071bb578b9d418ab14908fb915053560e3be9748f9bf74 :: /Users/kwilson
[omerta notebook (kwlzn/notebook_unix_socket)]$ jupyter notebook stop /tmp/test.sock
Shutting down server on /tmp/test.sock...
[omerta notebook (kwlzn/notebook_unix_socket)]$ jupyter notebook list
Currently running servers:
[omerta notebook (kwlzn/notebook_unix_socket)]$ 

[I 00:25:10.492 NotebookApp] Shutting down on /api/shutdown request.
[I 00:25:10.493 NotebookApp] Shutting down 0 kernels

Closes #2503

[kwlzn]

@minrk might you be able to help with a review/merging of this change? as a datapoint, we've been running all of our notebook servers at Twitter on this exact patch since August with no issues.

[lresende]

@kwlzn Could you please update the pr with latest master.

[kwlzn]

@lresende I'd be happy to do that as long as there's some form of stated commitment from the maintainers of this project to actually review and make an attempt to land the PR this time around vs ignoring it. let me know who would be willing to shepherd this on the jupyter/notebook side.

[bkreider]

This is very cool. This makes it very easy to layer security and not need a network stack; i.e.: start the notebook in a restrictive network namespace without access to the network and proxy the domain socket using nginx/openresty to easily add OIDC on top of it.

[kwlzn]

would love to get this upstreamed soon, let me know if any maintainers are willing to help if I update the PR.

[Zsailer]

@kwlzn, I can review and help push this PR through. Apologies for the delay—the state of the classic notebook is in limbo right now (see this issue and the discussion in last week's Jupyter Server meeting). We're working on better communication here for the state+future of the notebook.

In the meantime, you can ping me here for review on this PR as you update on master (I can help along the way too—just let me know what you need). This is likely something we'll want to port over the Jupyter Server as soon as possible. We'd love to have you submit this work over there too, but I'm happy to cherry-pick the commits myself, if you're short on time.

Thank you, again, for all this great work!

[kevin-bates]

Thanks @kwlzn and Zach. I had started looking into this - taking the branch and playing with it - and plan on participating in the review as well.

@kwlzn - now that there is some attention, could you please resolve the conflicts and we'll get this moving forward? Thanks.

[lresende]

@kwlzn, we are all trying to get this merged, and that's why you are seeing the third person asking for help rebasing this without success.

[kwlzn]

@Zsailer @kevin-bates thanks. PR is rebased and tests fine locally - I'll give it another self-review pass tomorrow after CI runs, but should be good for an initial look from one of you.

[kwlzn]

@Zsailer also happy to port this to Jupyter Server, will take a look at that next.

[kevin-bates]

Given the response on the issue this is resolving, this sounds like a useful feature - thank you. I just had some comments surrounding parameter co-existence (sock/port/browser), usability, and shutdown right now.

[kevin-bates]

Thanks Kris - just had a few more comments.

[kwlzn]

@kevin-bates this should be ready for another review.

[kevin-bates]

Thank you for the updates. This looks good to me. I'd love to get another review prior to merge if possible.

[blink1073]

LGTM, thanks!

[Zsailer]

Great work, @kwlzn! Thanks for your patience here!

[kwlzn]

thanks folks, appreciate it! @Zsailer now that this is finalized, I'll circle back to port to Jupyter Server when I can.

[Zsailer]

Awesome! Thanks, @kwlzn!