feat: Make security context configurable by environment variables

[jesuino]

In this change we add Security Context configuration as a Jupyter Configuration and environment variables:

Source	Settings
JupyterLab Settings	Settings > Advanced Settings Editor > Kale
Environment Variables	KALE_SECURITY_CONTEXT_ENABLED, KALE_SECURITY_CONTEXT_RUN_AS_USER, KALE_SECURITY_CONTEXT_RUN_AS_GROUP, KALE_SECURITY_CONTEXT_RUN_AS_NON_ROOT

Precedence: JupyterLab settings → env vars → defaults (enabled=true, run_as_user=65534, run_as_group=0, run_as_non_root=true)

This is how it looks like from Jupyter Lab settings:

A video showing it in action:

Screencast.From.2026-05-08.14-43-24.mp4

This change was co-authored by Claude

[ada333]

@jesuino looks good on the first look, could you please fix the tests?

[ada333]

@jesuino thanks for working on this! I have 2 comments - one is just code duplicity, the other is about functionality which I found when testing this PR (I hope I did not test it wrong)

[ada333]

I tested this and I believe the env vars in UI are never applied because security_context is always set to default values (from either settings default or widget default

[jesuino]

Thank you for finding this, you are right - I did refactor the code to make it sure that the env var is respected - please let me know if it works for you.

Thanks!

[hmtosi]

small update to documentation - on this line and in the next section, could you please clarify... to run containers as what?

[hmtosi]

addressed, thank you

[hmtosi]

Closes #781

[jesuino]

I am fixing an issue with the UI/Backend sync

/hold

[jesuino]

/unhold

[jesuino]

@hmtosi @ada333 The PR is ready for review!

[hmtosi]

/lgtm

@jesuino thank you for this work, the code looks good to me. I did the following tests:

1. build kale and run it without adjusting security context - successful run, yaml includes security context
2. use settings menu and disable security context - successful run, yaml doesn't include security context (shows that settings correctly control security context)
3. use settings menu and reenable security context - successful run, yaml includes security context
4. open local kale-settings.jupyterlab-settings file and delete security context, export KALE_SECURITY_CONTEXT_ENABLED=False - successful run, doesn't include security context (this shows that the env vars also correctly control security context)

[ederign]

William, some comments:

• Looks like there is a circular import between utils.py and pipeline.py**;
• No error handling for invalid integer env vars i nsecurity_context.run_as_user = int(run_as_user
• In widget.tsx, when jlSecurityContextSetting.user === undefined, backend env var defaults are written to the JupyterLab settings store via `loadedSetting.set(...)

Would mind to take a look on it?

[jesuino]

@ederign

Thanks for the feedback.

In widget.tsx, when jlSecurityContextSetting.user === undefined, backend env var defaults are written to the JupyterLab settings store via `loadedSetting.set(...)

Thanks for pointing this. We have to override the user values, otherwise the UI will not reflect the values in env vars. I did some research of alternative values, but still I could not find a feasible way to do this. In fact, Claude is saying that it is not possible:

this will always show schema defaults. That's the tradeoff - we can't change what the Settings UI shows without writing to user settings.

So I think we should keep this approach and document it? Or we can ignore the env var on the user settings and show the default values.

The other points were addressed, thanks!

[ederign]

/approve
/lgtm

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ederign

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ederign]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment