Cloud-execution track · the Compute Canada model, on Kubernetes

Posit on EKS, on the prefix foundation.

The same reproducible stack the bare-metal chain builds — delivered a second way. Posit Workbench / Connect / Package Manager run in containers on Amazon EKS , and every session mounts /cvmfs/software.ndexr.io/…/current and enters the stack the one way: source hpc-env.sh → ml R/4.6.1-foss-2024a . Deployed from a pinned helmfile ; hpc.ndexr.io remains the control plane.

The cloud chain

EKS cluster (aws → nodes)

eksctl node groups; VPC/IAM from aws.ndexr.io. Instance type fixes pod ISA — kept GENERIC-compatible with laptop clients (§2).

CernVM-FS CSI (the prefix foundation)

The exact driver Compute Canada/DRAC runs on K8s. Mounts our published tree read-only into every pod.

Posit trio, on the mount

Workbench / Connect / PPM. R and its libraries load from CVMFS — zero compilation, zero host/image leakage.

The track

EKS

The Kubernetes cluster the pods land on — nodes, health, ingress.

eks.ndexr.io →

Podman

Rootless OCI image builds; thin base images (kernel + CVMFS client only).

podman.ndexr.io →

Registry

Private Podman registry — the built container images.

registry.ndexr.io →

Workbench

Interactive RStudio/VS Code/Jupyter sessions on EKS compute.

workbench.connect.ndexr.io →

Connect

Publish & host R/Python content; the EKS validation sandbox.

connect.ndexr.io →

Package Manager

Posit-native front for repo.ndexr.io — not a second package source.

ppm.connect.ndexr.io →

The north star, inside a pod

A pod with only a thin base image + the CSI mount can ml R/… and install.packages() with zero host/image leakage — proven with the same readelf loader/RPATH checks the build chain enforces ( bin/90-verify-prefix.sh ). The container is the borrowed layer; nothing of its userland enters a loaded binary.