controlling package versions / snaphots / reproducibility / mirroring

[Karl Forner]

Hi Dirk,

Thanks for r2u, this is really awesome. As a person which has built and maintained reproducible R environments as docker containers, this is really a game changer.

I was wondering if you had advice or suggestions on how to control the versions of the packages that are installed via r2u.
I mean, if you rebuild a docker that installs a R package using r2u tomorrow, it may install an updated version.
So, if you use this docker image to perform an analysis, it may not run at all or produce different results.

One way to tackle this, is for example the PPM and its snapshot system. I haven't found a similar system for r2u.
I was thinking that maybe mirroring https://r2u.stat.illinois.edu/ubuntu at controlled dates could work.
What in your opinion would be the right way to solve this (for a company)?

Thanks,
Karl

[Dirk Eddelbuettel]

Note that all we do here is apt-based so comparisons with p3m, renv, MRAN, ... are all more or less irrelevant.

What a next layer would need is per-date (maybe monthly? later weekly?) 'snapshotting' of apt indices. I thought about this a little but have not done anything. I also think I eventually convinced myself of a counterargument but not I don't recall now what it was. I think one could experiment with per-date PACKAGES etc file and apt URLs.

So in the narrow sense: use and enjoy r2u for what it is, and "freeze" what you need to freeze via containers. Everything else is more or less out of scope given the resourcess (one person, ie me, a few minutes each day).

[Karl Forner]

Thanks for your quick reply. That confirms what I had in mind. Keep up the good work, these few minutes save hours and days for your users!