...or even better examine running container canary as admission webhook or something like that every time a jupyter server is created.

Discussion points during sprint planning.

We have a few ways to implement this:

• do it in the notebook service (i.e. the notebook service does it on every session launch and exposes it as an endpoint so that any docker image can be checked)
• doing the canary checks on every session launch will result in slow response times, the response times for launching a server from the notebook service are already not great because a lot of things that need to be checked (i.e. does gitlab project exist, does image exist, does the branch exist, etc)
• do it in amalthea as a validating admission webhook server (see https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#write-an-admission-webhook-server)
• ideally the notebook service exposes this as an endpoint and amalthea does an admission webhook, and if possible the admission webhook and the notebook service use and call the same underlying service or code

Timeboxed to 2 days