To run JupyterLab safely on an Ubuntu VPS, install it in a Python virtual environment, keep the server on 127.0.0.1:8888, and reach it through an SSH tunnel. If other people must access it, put Jupyter Server behind HTTPS, keep authentication enabled, and restrict the firewall. The procedure below covers installation, remote access from a laptop, persistent startup, upgrades, and the point at which JupyterHub is a better architecture.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
This guide creates a single-user JupyterLab server for one operator. JupyterLab is the browser interface; Jupyter Server runs the kernels and serves files. By default, Jupyter Server listens locally at 127.0.0.1:8888, so a browser on your laptop cannot reach that address directly. You either forward the port through SSH or deliberately publish the service through an HTTPS setup.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The safest normal arrangement is:
- An ordinary, non-root Ubuntu account owns the notebooks and the Python virtual environment.
- JupyterLab runs from that virtual environment, not from Ubuntu’s system interpreter.
- Jupyter Server remains bound to loopback.
- An SSH tunnel provides private access for one administrator, or an HTTPS reverse proxy provides controlled browser access for a wider audience.
- Token or password authentication remains active.
JupyterLab is free software, but the VPS, storage, backups, and bandwidth are separate operational costs.
Prepare the Ubuntu VPS
Create a dedicated account
Connect over SSH using an existing administrative account and create a normal user for the notebook service. Replace the example account name with the account you actually intend to operate.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
sudo adduser jupyteruserDo not run the notebook server as root. Grant administrative privileges to this account only if your operating policy requires it; otherwise, keep administration with a separate sudo-enabled account. Create a working directory for notebooks after switching users:
mkdir -p ~/notebooksApply updates and verify SSH first
Before installing application software, update the package index and security patches:
sudo apt update
sudo apt upgradeOpen a second terminal and confirm that you can log in as the dedicated user before changing any firewall or service settings. Keep one known-good SSH session open while testing, so a firewall mistake does not lock you out. Ubuntu release choice and VPS provider are operational decisions; the Jupyter documentation does not require a particular Ubuntu version or vendor.
Install JupyterLab in an isolated Python environment
Install Ubuntu’s Python tools
Use Ubuntu’s packaged Python, virtual-environment support, and pip:
sudo apt install python3 python3-venv python3-pipSwitch to the dedicated account, or start a login shell as that user, then create the environment:
python3 -m venv ~/venvs/jupyterlab
source ~/venvs/jupyterlab/bin/activateYour shell prompt normally shows the environment name after activation. Upgrade pip inside the environment and install JupyterLab:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemspython -m pip install --upgrade pip
python -m pip install jupyterlabUsing python -m pip makes it explicit that pip belongs to the active environment. It prevents an accidental installation into a different Python interpreter.
Alternative installers
The same JupyterLab guide documents conda, mamba, uv, pipenv, and Docker. Choose one approach for a project instead of mixing package managers casually. The comparison below focuses on the operational consequences for a VPS.
| Option | Best fit | Trade-offs |
|---|---|---|
venv with pip |
A small, single-user VPS | Simple and lightweight; you are responsible for dependency compatibility and upgrades. |
| conda or mamba | Data-science stacks with many compiled dependencies | Convenient environment management, but a larger disk footprint and another package ecosystem to maintain. |
| uv | Teams comfortable with modern Python tooling | Fast installation and resolution; confirm that your team and operational policy support it. |
| Docker | Image-based, reproducible deployments | Requires container operations, persistent-volume planning, image updates, and resource monitoring. Jupyter’s Docker instructions require setting JUPYTER_ENABLE_LAB=yes. |
| JupyterHub | Several users needing separate authenticated environments | More components and administration, but it is the official multi-user architecture rather than a single-user server. |
Evaluate an option against dependency isolation, reproducibility, upgrade procedure, disk and memory footprint, backup design, and the number of people who need access.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Start JupyterLab and verify it locally
With the virtual environment active, launch without opening a graphical browser on the VPS:
jupyter lab --no-browserThe terminal prints a URL containing an authentication token, commonly using the local endpoint. Copy the complete URL or copy the token separately. In another SSH session, you can list running servers and their URLs with:
jupyter server listAt this stage, the service is reachable only from the VPS itself because the default bind address is 127.0.0.1. Test that assumption on the server:
curl http://127.0.0.1:8888A response containing Jupyter’s page confirms that the process is listening. This local test does not prove that a remote laptop can connect; remote access requires a tunnel or a deliberately published endpoint.
Access JupyterLab privately through an SSH tunnel
For one administrator, an SSH tunnel is usually the smallest and safest exposure. Leave Jupyter bound to loopback and, from your laptop, run:
ssh -N -L 8888:127.0.0.1:8888 [email protected]Use the real SSH account and hostname or address for your VPS. The -L option maps port 8888 on your laptop to port 8888 on the VPS’s loopback interface; -N tells SSH not to start a remote shell. Keep this terminal open while using JupyterLab.
- Start JupyterLab on the VPS as the dedicated user with
jupyter lab --no-browser. - Open the SSH tunnel from your laptop.
- Browse to
http://127.0.0.1:8888on the laptop. - Paste the token shown at launch, or enter the password configured with
jupyter server password.
Because the VPS firewall does not need to expose port 8888 for this method, only SSH must be reachable from your laptop. If port 8888 is already occupied locally, choose another local port while keeping the remote side at 8888, for example ssh -N -L 8899:127.0.0.1:8888 [email protected], then open http://127.0.0.1:8899.
Keep authentication enabled
Use the launch token
Jupyter’s first-login token is shown in the launch output and can also be found with jupyter server list. Tokens are useful for an SSH-tunnel workflow because no persistent password setup is required. Treat the URL as a credential: do not paste it into public issue trackers, chat rooms, or logs that others can read.
Set a password
For repeated logins, set a password from the activated environment:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
jupyter server passwordJupyter prompts twice and stores a hash in jupyter_server_config.json; it does not store the clear-text password there. The exact configuration directory follows the service user’s home and Jupyter’s configuration rules. If you forget the password, run the same command again as the service user to replace it, then reconnect and authenticate with the new password.
Do not disable both token and password authentication unless another complete authentication layer protects the endpoint. An HTTPS proxy by itself encrypts traffic but does not automatically provide Jupyter’s application login.
Publish access safely when an SSH tunnel is not enough
Prefer a reverse proxy
If a team needs browser access without individual SSH tunnels, keep Jupyter Server on loopback and place an HTTPS reverse proxy such as Nginx or Caddy in front of it. The proxy listens publicly on TCP 443, obtains and renews a certificate according to your certificate-management process, and forwards requests to the local Jupyter port.
The proxy must support WebSocket upgrades. Jupyter uses WebSockets for kernel interaction, so a proxy that forwards only ordinary HTTP may display the file browser while terminals and notebooks fail. Preserve the Host and forwarding headers required by your proxy configuration, and test a notebook kernel and terminal rather than stopping after the login page loads.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Run Jupyter with browser launching disabled and a fixed local port. A typical command is:
jupyter lab --no-browser --ip=127.0.0.1 --port=8888Configure the proxy’s public hostname and certificate separately. Do not bind Jupyter to every interface merely because the proxy is public; loopback binding limits the backend to the VPS and reduces accidental exposure.
Direct public binding is a higher-risk alternative
The public-server documentation describes configuring a fixed port, disabling automatic browser opening, setting a password, and supplying certificate and key files when Jupyter itself serves HTTPS. If you choose this route, bind deliberately, use valid TLS, and restrict the firewall to the required source addresses where possible. A bare command such as --ip=0.0.0.0 without TLS, authentication, and firewall policy is not a secure deployment.
When a password is used on a public endpoint, HTTPS is essential: otherwise credentials travel over an unencrypted connection. Test certificate validation from the actual client network and renew certificates before they expire.
Run JupyterLab reliably with systemd
A shell process disappears when its SSH session ends unless you use a terminal multiplexer. For a VPS, systemd is a more reliable way to start the service at boot and restart it after a failure. The following unit is deployment glue, not a universal Jupyter-provided template. Adjust the account, paths, port, and resource limits to your system.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Create the service unit
Ensure the directories exist and are owned by the service user:
sudo mkdir -p /home/jupyteruser/notebooks
sudo chown -R jupyteruser:jupyteruser /home/jupyteruser/notebooksCreate /etc/systemd/system/jupyterlab.service with the following content:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11[Unit]
Description=JupyterLab
After=network.target
[Service]
Type=simple
User=jupyteruser
WorkingDirectory=/home/jupyteruser/notebooks
ExecStart=/home/jupyteruser/venvs/jupyterlab/bin/jupyter lab --no-browser --ip=127.0.0.1 --port=8888
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetThe executable path is intentionally the one inside the virtual environment. A systemd service does not load your interactive shell profile, so relying on an activated prompt or a user-level PATH often causes jupyter: command not found.
Enable, inspect, and follow logs
sudo systemctl daemon-reload
sudo systemctl enable --now jupyterlab
sudo systemctl status jupyterlab
sudo journalctl -u jupyterlab -fUse systemctl status for the current state and journalctl for startup errors, import failures, permission problems, and kernel crashes. Keep configuration and password files readable only by the service user. If you later change the virtual-environment path, port, or command-line options, reload the unit and restart the service:
sudo systemctl daemon-reload
sudo systemctl restart jupyterlabConfigure the firewall without breaking kernels
SSH-tunnel deployment
With loopback binding and an SSH tunnel, allow SSH and do not open Jupyter’s port to the internet. If UFW is not already configured, a basic sequence is:
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verboseConfirm that your SSH port is really covered before enabling UFW. If SSH uses a nonstandard port, allow that specific port instead of relying on the OpenSSH application profile.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →HTTPS reverse-proxy deployment
For a proxy, allow SSH and HTTPS:
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enableKeep the Jupyter backend on loopback. The public access port is the proxy’s HTTPS port, not the internal Jupyter port.
Direct Jupyter exposure
If Jupyter itself must be reachable directly, allow its configured port only from trusted source addresses whenever possible. For example, a trusted client address from documentation-only space could be allowed with:
sudo ufw allow from 198.51.100.24 to any port 8888 proto tcpDo not broadly expose the kernel communication range. Jupyter notes that local kernel communication may use randomly selected ports in the range 49152–65535. Those ports should remain private to the server and its local processes; a reverse proxy or SSH tunnel should carry the browser connection instead of opening that entire range on the internet.
Upgrade, back up, and operate the environment
Upgrade deliberately
Stop or schedule the service before changing packages, activate the same virtual environment used by systemd, and inspect installed versions:
Recommended Free Tools
source ~/venvs/jupyterlab/bin/activate
python -m pip list
python -m pip install --upgrade jupyterlabRestart the service after an upgrade and test login, opening a notebook, starting a kernel, and using a terminal. For repeatable deployments, record dependencies in a requirements file or use the environment-management mechanism chosen by your team. Do not run pip as root into the system interpreter to “fix” a service that points at a virtual environment.
Back up notebooks and configuration
Back up the notebook directory, environment definition, and relevant Jupyter configuration. Password hashes and server settings are operational data; protect their permissions and encrypt backups where appropriate. A backup is useful only if you can restore it to a test directory or replacement VPS, so document the service account, virtual-environment path, proxy configuration, firewall rules, and certificate renewal process.
Watch resources
A notebook kernel consumes VPS memory and CPU independently of the browser tab. Monitor system and service logs, especially after installing scientific libraries or running large data sets. If kernels die immediately, check memory limits and the journal before reinstalling JupyterLab.
Troubleshoot common failures
jupyter: command not found
Activate the virtual environment and call the executable directly:
source ~/venvs/jupyterlab/bin/activate
which jupyter
python -m jupyter lab --no-browserIf you installed with a user-level pip command instead, the executable may be under $HOME/.local/bin; add that directory to the user’s PATH or use the virtual-environment method above. For systemd, always use the full path in ExecStart.
The browser cannot connect remotely
Check that the process is running with systemctl status jupyterlab or jupyter server list. Confirm whether it is intentionally listening on 127.0.0.1. A loopback-only service will not accept a direct connection to the VPS address; use the SSH tunnel or verify that the HTTPS proxy forwards to the correct local port. Also check the VPS firewall and any cloud firewall outside the operating system.
The login page keeps rejecting credentials
Use the current token from jupyter server list, not an old URL copied from a previous process. If you use a password, reset it with jupyter server password as the same service user that runs Jupyter. Make sure your browser is pointed at the correct local tunnel port and that another Jupyter process is not occupying the address.
HTTPS loads but terminals or notebooks do not work
Inspect reverse-proxy WebSocket forwarding, certificate validity, and proxy logs. A restrictive content-security policy can also interfere with Jupyter’s browser features. Confirm that the proxy forwards upgrade and connection headers and that the backend remains reachable at its loopback address.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA kernel starts and then dies
Read the service log with journalctl -u jupyterlab. Confirm that the kernel’s Python packages are installed in the environment selected by Jupyter rather than in a different system interpreter. Check VPS memory, process limits, disk space, and permissions on the notebook directory. A server that can display the Lab interface can still fail to start a kernel if the kernel environment is incomplete.
Know when to use JupyterHub
A single-user Jupyter Server is appropriate when one operator owns the VPS and its notebooks. It is not the multi-user solution. If several people need independent logins, kernels, files, or environments, use JupyterHub, the official architecture for brokering multiple authenticated user servers. Expect additional administration for user accounts, spawners, storage permissions, upgrades, and resource isolation. Do not give several people the same single-user token or password as a substitute for per-user access control.
Quick Recap
Deployment checklist
- A non-root account owns the notebooks and virtual environment.
- Ubuntu updates are applied and a second SSH login has been tested.
- JupyterLab is installed with
python -m pipinside a dedicated virtual environment. - The server has been verified locally at
127.0.0.1:8888. - Authentication is enabled through a launch token or a password.
- An SSH tunnel is used for private single-user access, or a reverse proxy provides HTTPS for public access.
- WebSocket forwarding has been tested with a real notebook kernel and terminal.
- Systemd uses the virtual environment’s absolute Jupyter path and logs are available through
journalctl. - The firewall exposes only SSH and, for a proxy, HTTPS; kernel ports remain private.
- Notebook files, configuration, dependency definitions, and recovery steps are backed up.
- JupyterHub is selected instead if multiple users require separate authenticated environments.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
