jupyterhub admins should be able to run `sudo -E pip install numpy`
and install numpy into the user environment. However, since pip
is in the PATH we explicitly set in jupyterhub_config.py and
sudo doesn't preserve PATH, this won't work.
We exempt jupyterhub-admins groups from the PATH restriction,
so sudo -E works. This has some security costs, but we are already
allowing passwordless roots for them with unrestricted paths...
conda was not installed in the user environment explicitly,
so users can't install conda packages themselves.
Also install JupyterLab while we're at it :)
Dynamic Users are neat and probably very useful for a tmpnb
style situation. However, for regular use they have the following
problems:
1. Can't set ProtectHome=no, so you can never apt install or
similar from inside admin accounts.
2. Dynamic uid / gid makes it hard to write sudo rules. We want
admin users to have sudo.
3. Persistent uids / gids are very useful for ad-hoc ACLs between
users. gid sharing isn't the most flexible sharing mechanism,
but it is well known & quite useful.
4. /etc/skel is pretty useful!
