RStudio Server module

[bpmct]

A discussion dedicated to the RStudio Server module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	19 / 25	10 / 20	0 / 20	8 / 10	59 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides a clear example with sensible defaults for the web IDE deployment mode.
Visual preview	5	5	README embeds ../../.images/rstudio-server.png which exists (191.1 KB verified).

IDE Integration — 19 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource present with proper subdomain, share, order, and group configuration.
Managed configuration	6	0	No documented support for managed IDE settings or RStudio Server configuration injection.
Configurable folder or workdir	6	6	project_path variable documented and mounted to /home/${RSTUDIO_USER}/project in the container.
Pre-installed extensions	6	6	Documented support for renv environment restoration via enable_renv variable, which pre-installs R packages.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	rstudio_user and rstudio_password are marked sensitive = true in main.tf, but README example does not show credential handling (no example provided for auth-enabled mode), earning half credit.
Non-hardcoded auth path	4	2	disable_auth defaults to true, avoiding credentials entirely in the default path. However, when auth is enabled, credentials must be provided as variables with no alternative auth mechanism documented, earning half credit.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The Docker image rocker/rstudio:${SERVER_VERSION} is hardcoded in run.sh with no module variable to override the image registry or source.
Bring-your-own binary	10	0	No documented way to skip the docker pull or use a pre-existing container/image. The script always pulls the image.
Egress transparency	3	0	No dedicated README section enumerating external endpoints (Docker Hub for image pull, CRAN for renv packages). Endpoints are only inferable from code.
Runs without sudo	2	0	The run.sh script invokes docker commands which typically require either sudo or Docker socket permissions. No documentation of a no-sudo path, and the script does not check for or handle permission failures gracefully.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults, and validation on share variable.
Test coverage	4	2	No .tftest.hcl or test files present in the module. No documented testing story, earning half credit for basic Terraform validation only.

Overall — 59 / 100

Raw 54 / 92 → round(54 / 92 × 100) = 59

(Correction: 17 + 19 + 10 + 0 + 8 = 54, not 66. Normalized: round(54/92 × 100) = 59)

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.