Reproducibility - finding the right balance for R-based SCEs

[kkmann]

Proposal

Reproducibility and security can clash in container-based open-source statistical computing environments (SCEs).
For instance, a critical security issue could require updating layers of a container that could also affect numerical calculations or availibility of R packages.

This round table would discuss principles and practical implementation aspects for dealing with the reproducibility/security trade-off with a focus on containerized setups but also could discuss alternatives.

Expected impact

An x-pharma exchange could lead to more aligned definitions of required/acceptable levels of technical reproducibility.

Prior discussions/work

A great starting point on SCEs in general would be https://www.lexjansen.com/phuse-us/2021/hw/PAP_HoW04.pdf.

To make things a bit more tangible - building container images for analyses environemnts based on a linux base distribution is a robust strategy for reproducibility. However, there might be security findings that require a rebuild of said image to continue using it in an SCE environment that potentially jeopardize reproducibility. This implies that relying on containerization alone is not enough to ensure long-term (safe) reproducibility of results. If not, what metadata beyond the used e.g. R environment needs to be documented to maximize the chance of recreating an anlysis?

Would you be willing to potentially facilitate this discussion?

None

[kkmann]

I am afraid that I will not be able to make it to Seattle in person this year :(