Deprecate album-server

Decision

album-server is deprecated and will be archived in a later release. album-server is the album server command plugin: a Flask REST API that remote-controls one album installation.

Running solutions remotely, for example as jobs on an HPC cluster, stays a goal. It will not be built on album-server, and it gets its own decision (see "Not decided here").

What album-server is

  • A command plugin (console_parsers_album entry point server) in album-app/plugins/album-server. It was released once, as 0.1.0 on PyPI, and was never on conda-forge. It is not a solution plugin (those are #266 (closed)), although its unmerged solution-plugin branch adds one (album-server_launch-server).
  • album server --port 8080 --host 127.0.0.1 (the defaults) starts Flask's development server around one album instance.
  • Every route is a GET.
    • Synchronous: /, /config, /index, /catalogs, /recently-launched, /recently-installed, /search/<keywords>, /add-catalog, /remove-catalog, /update, /upgrade, /shutdown.
    • Asynchronous: /install, /uninstall, /run, /test, /clone, /deploy. They return a task id, and /status/<id> returns the task's status and log records. The query parameters of /run become the solution's command-line arguments.
  • The tasks run in three worker threads of album's TaskManager, inside the server process. Everything runs on the server host, as the user who started the server. Paths in arguments are paths on that host, and task ids and logs are lost when the server restarts.

History

when what
2021-04 album-app/album-app: an experimental Java GUI with LocalAlbumInstallation and RemoteAlbumInstallation(host, port), which talks to album through an AlbumServerService
2021-05 "Add hips server" (efb66500): the REST server, in core
2021-07 asynchronous tasks through the TaskManager; docs/server.md
2022-03 moved out of core into the album-server plugin (22803137)
2022-04 last commit on main
2024-03 two branches that were never merged: dependencies-update (Flask 2.3 and later) and solution-plugin
2025-10 album-app/album-app archived

The Java app is the only client in the album-app group, and it is archived. album-client is the client of album-socket (ZeroMQ), not of album-server. album-docs still has docs/server.md in its index, marked "Outdated", and the developer wiki lists album-server as "Outdated".

Why deprecate

  1. Security. There is no authentication, and every route is a GET, including /add-catalog, /install, /run, /deploy and /shutdown. Anyone who can reach the port can add a catalog and install and run its code. A server that listens on 127.0.0.1 only is still reachable from a web page open in a browser on the same machine (cross-site request forgery). The 2021 docs already warned that it "enables others with access to the API to run arbitrary scripts on the system". This is the same profile as album-socket (#266 (closed)).
  2. It does not work with current album. Checked on dev (73925f5c) with Python 3.14, Flask 3.1 and the dependencies-update branch: the server starts and the read-only routes answer, but /install and /run return HTTP 500 (Task.__init__() missing 1 required positional argument: 'method'), and /status/<id> raises KeyError. Uninstall, test, clone and deploy build their tasks the same way. From the code:
    • main does not import with Flask 2.3 or later (flask.json.JSONEncoder), so album skips the plugin with "Cannot load console parser server".
    • /shutdown relies on werkzeug.server.shutdown, which Werkzeug 2.1 removed.
    • /deploy passes the git name and email in swapped positions for the current Album.deploy.
  3. It is not a base for remote execution. It runs everything in its own process, on its own host. Running solutions on a cluster needs a per-user identity on the cluster, submission to the scheduler, a job store that survives restarts, and data staging. HPC sites already offer these in forms they accept (SSH, their own REST APIs, Globus Compute). Using album-server for that would mean a rewrite, not a revival.
  4. No maintenance. main has not changed since 2022-04, the 2024-03 branches were never merged, and nothing tests it against a current album.

What to use instead

  • On the local machine: the album CLI, the Python API (album.api.Album) and album-gui.
  • For agents: album-mcp.
  • On a remote machine: album itself, through SSH (the CLI, or album-mcp over stdio).

Plan

Deprecation, now:

  • this decision
  • a deprecation notice in the README of album-server, as album-app/plugins/album-socket!1 (merged) adds for album-socket
  • album-docs: mark docs/server.md as deprecated with a link to this issue, or remove it from the index
  • developer wiki: list album-server as deprecated instead of "Outdated"
  • the comment on DefaultValues.server_port / server_host links this decision: !313 (merged)

Removal, in a later release:

  • archive album-server
  • remove DefaultValues.server_port and server_host once album-server and album-socket (#266 (closed)) are both archived. Both plugins read server_port when they are imported.

Not decided here

Remote execution of solutions, for example as SLURM jobs on an HPC cluster. It stays a goal and will get its own decision.

Changelog (unreleased, Deprecated): "album-server (album server) is deprecated (#268 (closed))".

Decided by the maintainer after a review of album-server, prompted by item 6 of !313 (merged) (#263 (closed)).

🤖 Generated with Claude Code

Edited by jpalbrecht