优化沙箱环境增加Jupter，暴露，更加方便管理环境

docker-compose.yml

@@ -282,15 +282,19 @@ services:
     #沙箱环境默认不对外暴露
 #    ports:
 #      - "${SANDBOX_PORT}:8000"
+#      - "${SANDBOX_JUPYTERLAB_PORT}:8888"
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
     volumes:
       - ./sandbox-data:/app/data
       - ./local_packages:/app/local_packages
-      - ./env/python-packages:/home/sandbox/.local
+      - ./env/python-packages:/root/.local
       - ./env/node-modules:/app/node_modules_extra
     tmpfs:
       - /app/tmp:mode=1777
       - /tmp:mode=1777
-    read_only: true
+# 需要更加强的安全性，可以将ready only设置为true，可能影响使用Jupterlab 操作容器改动
+#    read_only: true
     security_opt:
       - no-new-privileges:true
     environment:
@@ -301,8 +305,14 @@ services:
       - PIP_CACHE_DIR=/app/tmp/.pip
       - TMPDIR=/app/tmp
       - NPM_CONFIG_CACHE=/app/tmp/.npm
-      - PYTHON_EXTRA_DIR=/home/sandbox/.local/lib/python3.12/site-packages
-      - PYTHON_EXTRA_PATH=/home/sandbox/.local/lib/python3.12/site-packages
+      - PYTHON_EXTRA_DIR=/root/.local/lib/python3.12/site-packages
+      - PYTHON_EXTRA_PATH=/root/.local/lib/python3.12/site-packages
+      # Jupyter 运行时与数据写到可写目录，避免挂载 /root/.local 导致无法写入
+      - JUPYTER_DATA_DIR=/app/tmp/jupyter_data
+      - JUPYTER_RUNTIME_DIR=/app/tmp/jupyter_runtime
+      - JUPYTER_CONFIG_DIR=/app/tmp/jupyter_config
+      # Jupyter 访问 token：不设或为空则无需 token；设置后打开 JupyterLab 需填写该 token
+      - JUPYTER_TOKEN=${SANDBOX_JUPYTER_TOKEN}
     restart: unless-stopped
     deploy:
       resources: