Activity

1. ianpittwood

   added the

   Task

   issue type on Apr 29, 2026
2. ianpittwood

   added

   dependenciesUpdates to dependency filesUpdates to dependency files

   tech debtTechnical debt we should addressTechnical debt we should address

   on Apr 29, 2026
3. workbench-ide-release

   added

   dockerRelated to container images we produceRelated to container images we produce

   on Apr 29, 2026
4. ianpittwood commented on Apr 29, 2026

   

   ianpittwood

   on Apr 29, 2026

   ContributorAuthor

   More actions

   Package list review — findings

   Generated by Claude (Opus 4.7) at the request of @ianpittwood. Treat as a starting point for human review and verification, not as authoritative.

   Reviewed workbench/template/deps/{ubuntu-22.04,ubuntu-24.04}_{,optional_}packages.txt.jinja2 against the Containerfile, install_workbench.sh, and the Bakery apt.j2 macros. The 22.04 and 24.04 required lists are byte-identical; the optional lists differ only on libfreetype-dev vs libfreetype6-dev (correct transitional naming).

   Context that shapes the recommendations

   • The required list is installed for both Standard and Minimal — every entry is opinionated bundling that Minimal customers cannot opt out of.
   • apt.run_setup() already installs curl, ca-certificates, gnupg, tar.
   • install_workbench.sh extracts the rstudio-server deb's Depends: and installs them, so anything pulled by the deb is already covered.
   • All installs use --no-install-recommends, so anything normally pulled via Recommends must be explicit.

   Highest-priority findings

   1. libpam-sss / libnss-sss are likely missing. With --no-install-recommends, the sssd metapackage may not pull these reliably across releases. Without them, SSSD cannot integrate with PAM/NSS — login lookups silently fall back. Verify presence in the current Standard image; if they exist, it's transitive luck. Add explicitly to optional.
   2. default-jdk → default-jre-headless. Saves ~250–400 MB and reduces CVE surface. Most users with rJava / RJDBC / Spark / H2O need only the JRE. Customers needing javac can layer it back in.
   3. build-essential, libssl-dev, libclang-dev should leave the required list. None are runtime requirements of rstudio-server itself; they're source-compilation conveniences. Putting them in required forces them into Minimal, which contradicts Minimal's purpose.
   4. libc6 in required is a no-op. Guaranteed present in the base image and pulled by the deb's Depends:. Remove.

   Required list — recommended trim

   Package	Recommendation	Reason
   libc6	Remove	Already in base image + deb depends
   libclang-dev	Move to optional	Not a server runtime dep; ~150 MB
   libxkbcommon-x11-0	Investigate, likely remove	X11 keyboard lib in a headless server image
   libssl-dev	Move to optional	Headers only needed for compilation; runtime libssl3 already pulled by deb
   lsb-release	Move to optional or remove	/etc/os-release covers most needs
   build-essential	Move to optional	~400 MB compiler chain doesn't belong in Minimal
   libsqlite3-0	Verify against deb depends	Likely already pulled
   libpq5, psmisc, rrdtool, sudo, supervisor	Keep	Core runtime

   Consider adding tzdata and locales (with a locale-gen en_US.UTF-8) — UTF-8 / time-zone issues are recurring user pain points.

   Optional list — recommended changes

   Add (advanced auth — directly called out in the issue scope):

   • libpam-sss, libnss-sss — see priority finding Refactor repo for bakery tool compatbility #1
   • krb5-user — Kerberos client (kinit, klist) for AD/GSSAPI
   • libsasl2-modules-gssapi-mit — SASL GSSAPI mechanism for Kerberos-backed LDAP binds
   • libsasl2-dev, libldap2-dev — for R/Python LDAP/SASL bindings

   Add (Quarto / rendering):

   • librsvg2-bin — SVG → PDF for Quarto/RMarkdown PDF pipelines
   • fonts-dejavu-core, fonts-liberation — currently only gsfonts ships; ggplot/Quarto PDF output benefits from common fallbacks (~30–80 MB total)

   Add (developer ergonomics — commonly assumed present):

   • openssh-client — git over SSH, scp/sftp (notable omission)
   • unzip, zip, rsync, jq, vim-tiny, htop

   Remove or downgrade:

   Package	Action	Reason
   default-jdk	→ default-jre-headless	Size + CVE surface; most users need only JRE
   imagemagick	Remove (keep libmagick++-dev)	Long CVE history; R magick package only needs the library
   oddjob-mkhomedir	Remove	Containerfile already wires pam_mkhomedir.so directly; redundant mechanism
   python3	Remove	Workbench uses uv-managed Python in /opt/python; system Python invites version drift
   tk-table	Remove	Very niche; bare tcl/tk is sufficient for tcltk
   gdb	Optional candidate	Useful but easily added on demand if image size matters

   Suggested verification before merging any change

   1. Run dpkg -I against the published rstudio-server deb to enumerate Depends: precisely — drop anything from packages.txt that's already there.
   2. Build Minimal with the trimmed required list and run bakery run dgoss --image-name workbench.
   3. For SSSD additions, check /lib/*/security/pam_sss.so and /lib/*/libnss_sss.so.2 exist in the current Standard image to confirm whether the additions are correctness fixes vs explicit pinning.
   4. Build Standard with default-jre-headless and smoke-test rJava / RJDBC workflows before committing.

   Biggest wins, in priority order

   1. Explicit libpam-sss / libnss-sss (correctness for SSSD-based auth)
   2. default-jdk → default-jre-headless (size + CVE surface)
   3. Move build-essential / libssl-dev / libclang-dev out of required (Minimal slimming)
   4. Drop libc6 from required (cosmetic, but signals carefulness)
5. ianpittwood

   self-assigned this

   on May 27, 2026
6. bschwedler

   added

   cvp:0Necessary projects we are undertaking that don’t directly deliver value to the customerNecessary projects we are undertaking that don’t directly deliver value to the customer

   tdp:1The individual working on it notices.The individual working on it notices.

   on Jul 22, 2026
7. bschwedler

   closed this as completedin #113on Jul 23, 2026