Skip to content
Hugging Face NLP Stack with Jupyter product logo
  • AWS· soonComing soon on Amazon Web Services
  • Azure· nextMicrosoft Azure is next on the roadmap
  • GCP· nextGoogle Cloud is next on the roadmap
Coming soon

Hugging Face NLP Stack with Jupyter

A Jupyter workbench with Hugging Face Transformers 5.17, PyTorch 2.14 and the supporting libraries pre-installed, plus three models cached so your first pipeline() call downloads nothing. Sentiment, NER and embeddings run offline out of the box, and a getting-started notebook opens by default. CPU build with no GPU driver - pick compute-optimised instances for heavier inference.

Version
Transformers 5.17.0 / PyTorch 2.14.0
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image. Nothing else is installed.

  • Transformers 5.17.0
  • PyTorch 2.14.0 (CPU)
  • JupyterLab 4.6.3
  • sentence-transformers 6.0.1
  • Datasets 5.0.1
  • scikit-learn 1.9.1
  • pandas 3.0.5
  • Gradio 6.27.0
  • spaCy 3.8.16
  • Python 3.12.3

Licensing — Open source (Apache-2.0 libraries), no licence key required

Deploy anywhere

Hugging Face NLP Stack with Jupyter on AWS.

Microsoft Azure and Google Cloud are next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS

    Amazon Web Services

    AMI · Transformers 5.17.0 / PyTorch 2.14.0

    Coming soon

    AWS AMI ID

    ami-0d0cc5defcb0a4f5d
    Released
    September 12, 2026
    Root volume
    gp3 · 30 GiB

    Instance types

    • t3a.xlarge
    • t3.xlarge
    • m6a.xlarge
    • c7a.xlarge

    Regions

    • us-east-1
    AWS launch steps

Getting started

From launch to signed in, step by step.

  1. Launch in us-east-1 with TCP 22 and 8080 open. The notebook server is usually ready in about a minute; allow up to five.

  2. Open http://<instance-public-ip>:8080 and sign in with your EC2 Instance ID as the password - there is no username (for example i-0123456789abcdef0). JupyterLab is at /lab.

  3. 00-getting-started.ipynb opens by default: sentiment classification, named-entity recognition, semantic similarity, then bringing your own model and authenticating for gated repositories.

  4. The stack lives in /opt/provencloud/venv; HF_HOME=/opt/provencloud/hf-cache is pre-populated. Any other Hub model downloads on first use.

  5. SSH as ubuntu with your key pair. Change the notebook password with sudo bash /home/ubuntu/iscripts/pass_jupyter.sh; hf_status.sh lists versions, endpoints and cached models.

  6. This is a CPU image: torch.cuda.is_available() is False even on a GPU instance. Use t3a.large and up, or c7a/c7i for heavier inference.

Security posture

What this image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: every component comes from its own official repository or release, nothing is copied from any third-party image, and the finished image was scanned for third-party vendor strings before capture.

  • No usable credential ships in the image; passwords are set on your instance at first boot from EC2 instance metadata (IMDSv2) and the scripts that set them delete themselves afterwards.

  • SSH is key-only, root login over SSH is refused, and build-time SSH keys, shell history and logs were removed before imaging.

  • Jupyter authenticates with a password only; URL tokens are disabled so nothing has to be copied out of a console log, and unauthenticated API calls return 403.

  • The image contains no password at all: a systemd unit ordered before Jupyter hashes this instance's ID into the server config on first boot, and a marker file ensures a password you set later is never overwritten by a reboot.

  • Hugging Face Hub telemetry is disabled in both the service and the shell profile, so the instance does not report usage.

  • SSH host keys are regenerated per instance.

  • The bundled password tools enforce at least 10 characters with upper- and lower-case letters, a number and a symbol, and verify the new credential with a real sign-in before reporting success.

  • The image is HTTP-only by design so it works at a bare IP with no certificate warnings: terminate TLS at a load balancer or add a certificate before exposing it publicly, and restrict port 22 and any admin ports to trusted IP ranges in your security group.