Flask App设为Windows服务时Jupyter内核崩溃问题求助

问题背景 #

• 开发Flask应用，通过UI触发subprocess.Popen()创建子进程启动Jupyter Notebook服务器，使用Waitress作为Web服务器，Python版本3.9
• 三种运行场景差异：
  1. 直接用python.exe运行Flask应用：Jupyter正常工作
  2. 调试模式执行（python service.py debug）：运行状态正常
  3. 注册为Windows服务（win32serviceutil/NSSM/Winsw）运行：Jupyter内核崩溃，抛出域信任关系错误

错误日志 #

Traceback (most recent call last):
  File "d:\v307\lib\site-packages\tornado\web.py", line 1704, in _execute
    result = await result
  File "C:\Program Files\Python39\lib\asyncio\tasks.py", line 328, in __wakeup
    future.result()
  File "d:\v307\lib\site-packages\tornado\gen.py", line 769, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "d:\v307\lib\site-packages\notebook\services\sessions\handlers.py", line 74, in post
    model = yield maybe_future(
  File "d:\v307\lib\site-packages\tornado\gen.py", line 762, in run
    value = future.result()
  File "d:\v307\lib\site-packages\tornado\gen.py", line 769, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "d:\v307\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 98, in create_session
    kernel_id = yield self.start_kernel_for_session(session_id, path, name, type, kernel_name)
  File "d:\v307\lib\site-packages\tornado\gen.py", line 762, in run
    value = future.result()
  File "d:\v307\lib\site-packages\tornado\gen.py", line 769, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "d:\v307\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 110, in start_kernel_for_session
    kernel_id = yield maybe_future(
  File "d:\v307\lib\site-packages\tornado\gen.py", line 762, in run
    value = future.result()
  File "C:\Program Files\Python39\lib\asyncio\futures.py", line 201, in result
    raise self._exception
  File "C:\Program Files\Python39\lib\asyncio\tasks.py", line 256, in __step
    result = coro.send(None)
  File "d:\v307\lib\site-packages\notebook\services\kernels\kernelmanager.py", line 176, in start_kernel
    kernel_id = await maybe_future(self.pinned_superclass.start_kernel(self, **kwargs))
  File "d:\v307\lib\site-packages\jupyter_client\utils.py", line 30, in wrapped
    raise e
  File "d:\v307\lib\site-packages\jupyter_client\utils.py", line 27, in wrapped
    return loop.run_until_complete(future)
  File "d:\v307\lib\site-packages\nest_asyncio.py", line 89, in run_until_complete
    return f.result()
  File "C:\Program Files\Python39\lib\asyncio\futures.py", line 201, in result
    raise self._exception
  File "C:\Program Files\Python39\lib\asyncio\tasks.py", line 256, in __step
    result = coro.send(None)
  File "d:\v307\lib\site-packages\jupyter_client\multikernelmanager.py", line 212, in _async_start_kernel
    starter = ensure_async(km.start_kernel(**kwargs))
  File "d:\v307\lib\site-packages\jupyter_client\utils.py", line 30, in wrapped
    raise e
  File "d:\v307\lib\site-packages\jupyter_client\utils.py", line 27, in wrapped
    return loop.run_until_complete(future)
  File "d:\v307\lib\site-packages\nest_asyncio.py", line 89, in run_until_complete
    return f.result()
  File "C:\Program Files\Python39\lib\asyncio\futures.py", line 201, in result
    raise self._exception
  File "C:\Program Files\Python39\lib\asyncio\tasks.py", line 256, in __step
    result = coro.send(None)
  File "d:\v307\lib\site-packages\jupyter_client\manager.py", line 83, in wrapper
    raise e
  File "d:\v307\lib\site-packages\jupyter_client\manager.py", line 75, in wrapper
    out = await method(self, *args, **kwargs)
  File "d:\v307\lib\site-packages\jupyter_client\manager.py", line 383, in _async_start_kernel
    kernel_cmd, kw = await ensure_async(self.pre_start_kernel(**kw))
  File "d:\v307\lib\site-packages\jupyter_client\utils.py", line 30, in wrapped
    raise e
  File "d:\v307\lib\site-packages\jupyter_client\utils.py", line 27, in wrapped
    return loop.run_until_complete(future)
  File "d:\v307\lib\site-packages\nest_asyncio.py", line 89, in run_until_complete
    return f.result()
  File "C:\Program Files\Python39\lib\asyncio\futures.py", line 201, in result
    raise self._exception
  File "C:\Program Files\Python39\lib\asyncio\tasks.py", line 256, in __step
    result = coro.send(None)
  File "d:\v307\lib\site-packages\jupyter_client\manager.py", line 349, in _async_pre_start_kernel
    kw = await self.provisioner.pre_launch(**kw)
  File "d:\v307\lib\site-packages\jupyter_client\provisioning\local_provisioner.py", line 190, in pre_launch
    km.write_connection_file()
  File "d:\v307\lib\site-packages\jupyter_client\connect.py", line 503, in write_connection_file
    self.connection_file, cfg = write_connection_file(
  File "d:\v307\lib\site-packages\jupyter_client\connect.py", line 164, in write_connection_file
    with secure_write(fname) as f:
  File "C:\Program Files\Python39\lib\contextlib.py", line 117, in __enter__
    return next(self.gen)
  File "d:\v307\lib\site-packages\jupyter_core\paths.py", line 893, in secure_write
    win32_restrict_file_to_user(fname)
  File "d:\v307\lib\site-packages\jupyter_core\paths.py", line 442, in win32_restrict_file_to_user
    user, _domain, _type = win32security.LookupAccountName(
pywintypes.error: (1789, 'LookupAccountName', 'The trust relationship between this workstation and the primary domain failed.')

已尝试的无效方案 #

• 使用NSSM和Winsw替代win32serviceutil注册服务，错误依旧
• 在subprocess.Popen()中添加creationflags=CREATE_NEW_CONSOLE参数，无改善

可行解决方案 #

1. 禁用Jupyter的文件权限限制 #

Jupyter创建连接文件时会调用win32_restrict_file_to_user限制权限，而Windows服务默认的Local System账户在域环境下无法正常解析用户信息。通过设置环境变量跳过该步骤：

import os
import subprocess

env = os.environ.copy()
env["JUPYTER_ALLOW_INSECURE_WRITES"] = "1"
# 替换为你的Jupyter启动命令
subprocess.Popen(["jupyter", "notebook", "--no-browser"], env=env)

2. 修改服务运行账户 #

默认Local System账户无有效域身份，将服务登录账户改为以下类型之一：

• 本地管理员账户：打开服务管理器→目标服务→属性→登录→选择“此账户”，输入本地管理员用户名和密码
• 有效域用户账户：确保该用户在本地拥有足够权限，且工作站与域信任关系正常
  修改后重启服务，Jupyter内核启动时可正常解析用户身份。

3. 自定义连接文件路径并设置权限 #

指定Jupyter连接文件到服务有权限操作的目录，手动配置目录权限：

1. 启动Jupyter时指定连接文件路径：

subprocess.Popen([
    "jupyter", "notebook", 
    "--connection-file", "C:/path/to/service-working-dir/jupyter-connection.json",
    "--no-browser"
])

2. 在Windows资源管理器中找到目标目录，右键→属性→安全→添加服务运行账户（如Local System），赋予完全控制权限

4. 降级jupyter_core版本 #

部分jupyter_core版本存在域环境下权限解析问题，尝试降级到稳定版本：

pip install jupyter_core==4.9.2

内容的提问来源于stack exchange，提问作者Pradip Waghela