ilum/superset repository overview

⁠Ilum Superset

⁠Overview

ilum/superset is Ilum's production-hardened distribution of Apache Superset⁠, the modern data exploration and visualization platform. This distribution extends the official Superset image with pre-installed database connectors commonly used in data lakehouse environments, including Kyuubi, Trino, ClickHouse, and Elasticsearch.

• Kyuubi Integration — Apache Kyuubi Python client for Spark SQL access via Hive Thrift protocol
• Trino Support — pre-installed Trino connector for distributed SQL queries
• ClickHouse Ready — clickhouse-connect driver for real-time analytics
• Elasticsearch — elasticsearch-dbapi for log and time-series visualization
• Enterprise Auth — Flask-OIDC for OpenID Connect and OAuth2 authentication
• Chromium Included — Playwright with Chromium for scheduled alert screenshots

⁠TL;DR / Quick Start

# Run Superset with SQLite (development mode)
docker run -d \
  --name ilum-superset \
  -p 8088:8088 \
  -e SUPERSET_SECRET_KEY=your-secret-key \
  ilum/superset:6.0.0

# Access UI: http://localhost:8088
# Default credentials: admin / admin

Note: For production deployments, use the official Ilum Helm Chart⁠. Configure PostgreSQL as metadata database via superset_config.py.

⁠Supported Tags

• 6.0.0 — Superset 6.x + Ilum connectors + DuckDB + Chromium
• 4.1.1 — Superset 4.x + Ilum connectors + Chromium

⁠Key Features

⁠Pre-installed Database Connectors

⁠Enterprise Authentication

Pre-installed OIDC/OAuth2 support:

• flask-oidc — OpenID Connect provider integration
• flask_openid — OpenID authentication

Configure in superset_config.py:

from flask_oidc import OpenIDConnect

AUTH_TYPE = AUTH_OID
OIDC_CLIENT_SECRETS = '/app/pythonpath/client_secrets.json'

⁠Chromium for Alerts

Playwright with Chromium is pre-installed for:

• Scheduled report screenshots
• Dashboard thumbnail generation
• Alert visualization capture

⁠Environment Variables

⁠Required for Production

⁠Optional Configuration

⁠Data Persistence (Volumes)

# docker-compose example
volumes:
  - ./superset_config.py:/app/pythonpath/superset_config.py:ro
  - superset_home:/app/superset_home

⁠Network Configuration

⁠Security

⁠Non-root Architecture

The image runs as user superset (non-root). Home directory: /app/superset_home.

⁠Secret Management

CAUTION: Never hardcode SUPERSET_SECRET_KEY or database credentials!

Use Kubernetes Secrets:

env:
  - name: SUPERSET_SECRET_KEY
    valueFrom:
      secretKeyRef:
        name: superset-secrets
        key: secret-key

⁠Vulnerability Scanning

trivy image ilum/superset:6.0.0

⁠Building the Image

Run from the repository root:

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ilum/superset:6.0.0 \
  --target lean \
  --push .

⁠Image Verification

⁠Layer Analysis (Dive)

dive ilum/superset:6.0.0

⁠Software Bill of Materials (SBOM)

syft ilum/superset:6.0.0 -o spdx-json > sbom.json

⁠Image Contents — Details

⁠Base Components

• Python: 3.11 (Debian Bookworm slim)
• Node.js: 20 (for frontend build)
• User: superset (non-root)

⁠Superset Components

• Backend: Flask, SQLAlchemy, Celery
• Frontend: React, ECharts, D3.js (pre-built assets)
• Browser: Playwright + Chromium (for alerts)

⁠Ilum-Added Packages

• kyuubi — Apache Kyuubi Python client (from git)
• trino — Trino database connector
• clickhouse-connect — ClickHouse driver
• elasticsearch-dbapi — Elasticsearch SQL API
• mysqlclient — MySQL connector
• thrift, thrift-sasl — Hive/Thrift protocol support
• flask-oidc, flask_openid — Enterprise authentication

⁠Integration with Ilum Platform

When deployed as part of the Ilum data lakehouse platform:

1. Kyuubi Connection: Connect to Spark SQL via ilum-kyuubi:10009 using Hive protocol
2. Trino Queries: Direct connection to Trino cluster for federated queries
3. ClickHouse Analytics: Real-time dashboard on ClickHouse OLAP engine
4. Single Sign-On: Integrate with Ilum's OIDC provider

⁠Support and Feedback

• Issues: Bug Tracker⁠
• Documentation: Ilum Docs⁠
• Slack: Join our Community⁠