# Private Spaces won't load Apps

**URL:** <https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193>\
**Category:** Beginners\
**Created:** [October 5, 2024, 2:43am UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193 "2024-10-05T02:43:07Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![glossyio](https://avatars.discourse-cdn.com/v4/letter/g/f1d935/32.png) [@glossyio](https://discuss.huggingface.co/u/glossyio)\
**Post date:** [October 5, 2024, 2:43am UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/1 "2024-10-05T02:43:07Z")

</div>

Tried a Gradio app and a Docker Jupyter notebook, neither would load properly in Private Space but worked in Public Space. I am totally new to HuggingFace Spaces. What am I missing?

- I duplicated [gradio/chatinterface\_streaming\_echo](https://huggingface.co/spaces/gradio/chatinterface_streaming_echo) into a Private Space and chose the Free compute, and the interface won’t load. The "Building… "icon goes away and it says “Running” but the interface just stays blank.  
I duplicated that repo into my Public Space with the Free compute and it immediately loaded.
- Docker Jupyter shows a huggingface 404 in the Private space but works in Public space.

What do I need to do to get it working in my Private Space? Is it a setting? Is it common to all Private Spaces?

 ![image](https://us1.discourse-cdn.com/hellohellohello/original/3X/a/0/a08e46eb2d4b99ac095bf8ea660355c23cfa52c5.png)

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [October 5, 2024, 4:47am UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/2 "2024-10-05T04:47:50Z")

</div>

No special changes are required to make Spaces work in Private, unless it is in conjunction with an external application or something.  
Just click on the **three vertical dots** , select **Settings** , and press **Make private**.  
This will make it a Private space.  
If you press **Make public** , it will become a Public space.  
If it does not work, then you have another problem that has nothing to do with Private.

P.S.

> **[chatinterface\_streaming\_echo - a Hugging Face Space by gradio](https://huggingface.co/spaces/gradio/chatinterface_streaming_echo)**
>
> Discover amazing ML apps made by the community

This worked fine when I duplicated it in Private. Maybe you just had a bad build. Sometimes there are glitches.

Also, Spaces and models that are set to Private are visible as 404 to everyone but you, unless you use a token. That’s what this feature is for.

---

<div class="post-metadata">

**Author:** ![glossyio](https://avatars.discourse-cdn.com/v4/letter/g/f1d935/32.png) [@glossyio](https://discuss.huggingface.co/u/glossyio)\
**Post date:** [October 5, 2024, 7:40pm UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/3 "2024-10-05T19:40:59Z")

</div>

Starting Spaces in Public and going Private- good idea! But, does that have any drawbacks security-wise? I am very interested in the [SOCS compliance](https://huggingface.co/docs/hub/security) that huggingface hub spaces offers, does that lose anything security-wise?

**Back to the Private Spaces not working** :  
I once again duplicated [gradio/chatinterface\_streaming\_echo](https://huggingface.co/spaces/gradio/chatinterface_streaming_echo) into Private and it still failed to load (as a blank App page)! However, When I go to the three dots \> Settings and **make that private space Public** (same repo!), **it WORKS**. What is going on??

 ![image](https://us1.discourse-cdn.com/hellohellohello/original/3X/1/1/117df6c06b4ff4acc2b471ad1674f693b96d5ad4.png)  
I am running on Chrome 129, disabled all my blockers, and even tried on both my network and a cell phone hotspot (because I have adblock on the router firewall, too).

The Build Log looks fine to me…

Private Space build (first time, did not work, did not load app):

```auto
===== Build Queued at 2024-10-05 19:29:40 / Commit SHA: 00a8c4a =====

--> FROM docker.io/library/python:3.10@sha256:aaacc373f21abcbc67a22d203dab7fb797c016cc4c1daa7d2dec359dcbf4aea1
DONE 0.0s

--> RUN pip freeze > /tmp/freeze.txt
CACHED

--> RUN pip install --no-cache-dir pip==22.3.1 && pip install --no-cache-dir datasets "huggingface-hub>=0.19" "hf-transfer>=0.1.4" "protobuf<4" "click<8.1" "pydantic~=1.0"
CACHED

--> RUN apt-get update && apt-get install -y fakeroot && mv /usr/bin/apt-get /usr/bin/.apt-get && echo '#!/usr/bin/env sh\nfakeroot /usr/bin/.apt-get $@' > /usr/bin/apt-get && chmod +x /usr/bin/apt-get && rm -rf /var/lib/apt/lists/* && useradd -m -u 1000 user
CACHED

--> RUN apt-get update && apt-get install -y git git-lfs ffmpeg libsm6 libxext6 cmake rsync libgl1-mesa-glx && rm -rf /var/lib/apt/lists/* && git lfs install
CACHED

--> COPY --chown=1000:1000 --from=root / /
CACHED

--> WORKDIR /home/user/app
CACHED

--> RUN pip install --no-cache-dir gradio[oauth]==4.44.1 "uvicorn>=0.14.0" spaces
CACHED

--> COPY --link --chown=1000 ./ /home/user/app
DONE 0.0s

--> COPY --from=pipfreeze --link --chown=1000 /tmp/freeze.txt /tmp/freeze.txt
DONE 0.0s

--> Pushing image
DONE 0.9s

--> Exporting cache
DONE 0.7s

```

Making that Private space Public, build log (this worked):

```auto
===== Build Queued at 2024-10-05 19:36:45 / Commit SHA: 00a8c4a =====

--> FROM docker.io/library/python:3.10@sha256:aaacc373f21abcbc67a22d203dab7fb797c016cc4c1daa7d2dec359dcbf4aea1
DONE 0.0s

--> COPY --chown=1000:1000 --from=root / /
CACHED

--> RUN apt-get update && apt-get install -y fakeroot && mv /usr/bin/apt-get /usr/bin/.apt-get && echo '#!/usr/bin/env sh\nfakeroot /usr/bin/.apt-get $@' > /usr/bin/apt-get && chmod +x /usr/bin/apt-get && rm -rf /var/lib/apt/lists/* && useradd -m -u 1000 user
CACHED

--> RUN apt-get update && apt-get install -y git git-lfs ffmpeg libsm6 libxext6 cmake rsync libgl1-mesa-glx && rm -rf /var/lib/apt/lists/* && git lfs install
CACHED

--> WORKDIR /home/user/app
CACHED

--> RUN pip install --no-cache-dir pip==22.3.1 && pip install --no-cache-dir datasets "huggingface-hub>=0.19" "hf-transfer>=0.1.4" "protobuf<4" "click<8.1" "pydantic~=1.0"
CACHED

--> RUN pip freeze > /tmp/freeze.txt
CACHED

--> RUN pip install --no-cache-dir gradio[oauth]==4.44.1 "uvicorn>=0.14.0" spaces
CACHED

--> COPY --link --chown=1000 ./ /home/user/app
DONE 0.0s

--> COPY --from=pipfreeze --link --chown=1000 /tmp/freeze.txt /tmp/freeze.txt
DONE 0.0s

--> Pushing image
DONE 0.7s

--> Exporting cache
DONE 0.6s

```

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [October 5, 2024, 11:32pm UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/4 "2024-10-05T23:32:56Z")

</div>

> does that have any drawbacks security-wise?

I don’t think any inconvenience will occur, except in the case of commercial problems if the code is open, or if you mistakenly put personal information in the code.  
The switch between Public and Private is just an example to isolate the problem, and it should work perfectly fine even if the code is directly duplicated in Private. In fact, it worked fine on my account.

> What is going on??

I don’t know. I don’t know, but something is definitely wrong with your environment anyway.🙀

I too usually use Chrome as my primary tool for running Spaces. As for this space, even Firefox with ad blocker works. And if the demo doesn’t work, it shouldn’t work in Public either.

Conceivably, we need to be logged in to our account to use Private Spaces, which HF is probably judging by cookies, sessions, or something like that.  
If you look at your Private space and don’t get a 404, then your login is working at least minimally well. But what if there was a case where this is the halfway point?  
But is there such a glitch nowadays? We’re probably fine with Private Browsing…

@not-lain Have you ever heard of such a phenomenon where only executing Private Space on a browser causes an error? I can’t find any reports of it in my search.

P.S.  
Maybe VPN issue?

---

<div class="post-metadata">

**Author:** ![glossyio](https://avatars.discourse-cdn.com/v4/letter/g/f1d935/32.png) [@glossyio](https://discuss.huggingface.co/u/glossyio)\
**Post date:** [October 6, 2024, 1:22am UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/5 "2024-10-06T01:22:23Z")

</div>

> [@John6666](#):
>
> Conceivably, we need to be logged in to our account to use Private Spaces, which HF is probably judging by cookies, sessions, or something like that.

**Cookies–brilliant**! So, I run all my browsers in Strict Privacy mode with _NO 3rd Party Cookies_. I was able to fix it by doing this:  
In Chrome I went to `Settings > Privacy > Third-Party Cookies > Sites Allowed to use Third Party cookies` and added an exception for `[*.]huggingface.co`.

So, apparently, when you _Duplicate Space_ **directly in Private** , it tries to create a third party cookie to enable the “App” window. But all **Public spaces do not use third-party cookies**? And if you go Public → to Private space, the 3rd party cookie is also not required?? (Edit - I was always logged into my account, of course, and I continue to be logged in.)  
Makes me think there is something funny about Security when you go from Public → Private… But maybe that’s my tin foil hat getting too tight?

Anyway, good call, @John6666. I’ll have more security-related Q’s in the future, but this gets me off and running!

---

<div class="post-metadata">

**Author:** ![not-lain](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/not-lain/32/59092_2.png) [@not-lain](https://discuss.huggingface.co/u/not-lain)\
**Post date:** [October 6, 2024, 1:43am UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/6 "2024-10-06T01:43:32Z")

</div>

Maybe this has been added for security reasons since you can run anything in spaces, but i’m glad this has been resolved.

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [October 6, 2024, 2:28am UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/7 "2024-10-06T02:28:05Z")

</div>

Oh well. Anyway, if it works, it’s good.  
It’s easy for HF and us.

BTW, too many video trolls and I won’t be able to flag anything for the next 9 hours. But it’s nighttime in the US…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/hellohellohello/original/2X/d/de4155eb4aa4108ecb32a1389d7cc37ae69f88b7.png) [@system](https://discuss.huggingface.co/u/system)\
**Post date:** [October 6, 2024, 2:28pm UTC](https://discuss.huggingface.co/t/private-spaces-wont-load-apps/110193/8 "2024-10-06T14:28:55Z")

</div>

This topic was automatically closed 12 hours after the last reply. New replies are no longer allowed.