RStudio Server module

[bpmct]

A discussion dedicated to the RStudio Server module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	18 / 25	10 / 20	0 / 20	8 / 10	58 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides a clear example with sensible defaults for the web IDE deployment mode.
Visual preview	5	5	README includes ../../.images/rstudio-server.png which exists (191.1 KB verified).

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource present with proper subdomain, share, icon, and URL configuration.
Managed configuration	6	0	No documented support for managed IDE settings or RStudio Server configuration files.
Configurable folder or workdir	6	6	project_path variable documented and mounted to /home/${RSTUDIO_USER}/project in the container.
Pre-installed extensions	6	5	enable_renv and renv_cache_volume provide documented support for pre-installing R packages via renv.lock, though not traditional IDE extensions. Partial credit for R-specific dependency management.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	rstudio_user and rstudio_password are marked sensitive = true in variables, but README example does not show usage, and defaults are hardcoded as "rstudio"/"rstudio" in the module itself, which is inline secrets behavior. Half credit.
Non-hardcoded auth path	4	2	disable_auth variable exists and defaults to true, providing a path to avoid credentials entirely, but this is not highlighted in README as a security best practice. Half credit.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The Docker image rocker/rstudio:${SERVER_VERSION} is hardcoded in run.sh with no module variable to override the registry or image source.
Bring-your-own binary	10	0	No documented way to skip the docker pull or use a pre-existing container/image. The script always pulls from Docker Hub.
Egress transparency	3	0	No dedicated README section enumerating external endpoints (Docker Hub registry, package repositories). Endpoints are only inferable from code.
Runs without sudo	2	0	Script uses docker commands which typically require either sudo or docker group membership (privileged access). No documentation of unprivileged path.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults, and validation on share variable.
Test coverage	4	2	No .tftest.hcl or test files present in the module. Half credit for basic validation logic in variables.

Overall — 58 / 100

Raw 53 / 92 → round(53 / 92 × 100) = 58

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.