LoginSign Up
← Back to all sparks
D

dockerfiler

INFRA · APIS
Velocity0.0

Easy Dockerfile Creation from R

thinkr-open.github.io/dockerfiler ↗

dockerfiler's 1.0.0 changes what its generated Dockerfiles actually contain.

dockerr-packagessupply-chain-securitymulti-archreproducibility
◆Current state
After two years of small parameter additions, ThinkR shipped a 1.0.0 that changes the tool's output for every existing user. The vendored copy of renv is gone, generated images default to multi-arch rocker/r-ver running as a non-root rstudio user, and packages come from Posit Public Package Manager binaries instead of a source CRAN mirror.
◆Where it's heading
The package is being hardened rather than extended. Every user-supplied value that reaches a Dockerfile shell context is validated at function entry, and two long-standing code-injection paths — a crafted renv.lock version string and DCF continuation lines in DESCRIPTION fields — were closed after an internal audit. The new parameters point at production image builds: github_pat via BuildKit secret mounts, strict_install turning install warnings into build failures, and a configurable renv cache path.
◆Prediction
With the injection surface closed and the defaults flipped, the next releases are more likely to be compatibility work against renv and pak than new generators.

◆Recent moves

  1. 3mo ago

    Multi-arch, non-root defaults and a closed injection surface

    ⚡ SPARK

    The release that changes what dockerfiler emits: multi-arch rocker/r-ver, a non-root runtime user, binary packages from P3M, the vendored renv removed, and every value flowing into a shell context validated. Regenerating a Dockerfile after this release produces a materially different image.

    View source ↗
  2. 2y ago

    System-requirement detection moves to pak::pkg_sysreqs()

    Dropped the sysreqs.r-hub.io service for pak::pkg_sysreqs(), added a user argument to dock_from_renv(), and let the dependencies parameter pull optional and development dependencies. An early step toward the configurable, non-root generation that 1.0.0 makes the default.

    View source ↗
  3. 2y ago

    Dockerfile generation from renv.lock, and parsing back

    Added dock_from_renv() and parse_dockerfile(), a renv_version pin, and memoised system-requirement lookups, alongside an internalised renv copy. This is where lockfile-driven generation — the surface 1.0.0 later hardens and de-vendors — first appears.

    View source ↗
  4. 3y ago

    Graceful failure without network access

    A small release covering graceful failure when there is no network, listed alongside the early dock_from_renv() work. No change to generated output.

    View source ↗