How do I set a default umask in JupyterHub - jupyter

Question

How do I set a default umask (other than the standard 0022) for individual notebooks/users in JupyterHub?
Use case: I'm using the SystemUserSpawner, which spawns a Docker container for a user, but hooked into the underlying (virtual machine) system users: their notebook home directory matches that of the underlying OS. I've added a small option so that not just users, but also groups match.
I've mounted the base home directory (/home/ usually) to a separate _users folder in the notebook (read-only), so that users can browse each other's home directories for sharing scripts. By default, however, I'd like to have the permissions by group, not world-readable (obviously, users can change that if they'd like), so that different groups can read & share within their group, but not automatically with everyone.
Using an umask setting of 0027 seems to be practical for this, but I can't seem to set it (systemwide): none of the standard OS practices (OS of the Docker container, Ubuntu 18.04) appear to work.
How do I set up a default umask for 0027 for each notebook user?

Answer 1

The single-user notebooks take their configuration from /etc/jupyter/jupyter_notebook_config.py (note: this file lives in the Docker container, not on the host OS).
The last lines of that configuration file are the following:
# Change default umask for all subprocesses of the notebook server if set in
# the environment
if 'NB_UMASK' in os.environ:
os.umask(int(os.environ['NB_UMASK'], 8))
Thus, we can set the environment variable NB_UMASK to set the default umask for the notebook user.
We can set this in the Jupyter Hub configuration file on the host OS. In /etc/jupyterhub/jupyterhub_config.py, add or adjust the c.SystemUserSpawner.environment (or perhaps just c.Spawner.environment, but I'm using a variant of the SystemUserSpanwer) setting to include:
c.SystemUserSpawner.environment = {'NB_UMASK': '0027'}
And that line should be the only thing to set the umask in the entire notebook.
For the record, my full spawner environment is as follows:
c.SystemUserSpawner.environment = {'JUPYTER_ENABLE_LAB': '1', 'GRANT_SUDO': '1', 'NB_UMASK': '0027'}
So that I have a Jupyter Lab environment, and users are able to install further software inside their container as need (sudo apt install <something>).