posit/connect repository overview

⁠

⁠Posit Connect container image

This container image provides Connect⁠, a publishing platform for the work your teams create in R and Python. Deploy Shiny applications, R Markdown documents, Plumber APIs, Python applications (Flask, Dash, FastAPI, Bokeh, Streamlit), Jupyter notebooks, Quarto documents, and more.

⁠Quick reference

⁠Related images

For Kubernetes deployments, Connect uses three images together. See the repository README⁠ for Helm configuration.

⁠How to use this image

⁠Quick start

PCT_VERSION="2026.09.0"
PCT_IMAGE="ghcr.io/posit-dev/connect"  # or docker.io/posit/connect
PCT_LICENSE_FILE_HOST_PATH="/path/to/license.lic"
PCT_LICENSE_FILE_PATH="/etc/rstudio-connect/license.lic"
PCT_DATA_HOST_PATH="/data/connect"
docker run -d \
  --name connect \
  --privileged \
  -p 3939:3939 \
  -v ${PCT_LICENSE_FILE_HOST_PATH}:${PCT_LICENSE_FILE_PATH} \
  -v ${PCT_DATA_HOST_PATH}:/var/lib/rstudio-connect \
  ${PCT_IMAGE}:${PCT_VERSION}

Access Connect at http://localhost:3939.

⁠With a custom configuration file

PCT_VERSION="2026.09.0"
PCT_IMAGE="ghcr.io/posit-dev/connect"  # or docker.io/posit/connect
PCT_LICENSE_FILE_HOST_PATH="/path/to/license.lic"
PCT_LICENSE_FILE_PATH="/etc/rstudio-connect/license.lic"
PCT_DATA_HOST_PATH="/data/connect"
PCT_CONFIG_HOST_PATH="/path/to/rstudio-connect.gcfg"
docker run -d \
  --name connect \
  --privileged \
  -p 3939:3939 \
  -v ${PCT_LICENSE_FILE_HOST_PATH}:${PCT_LICENSE_FILE_PATH} \
  -v ${PCT_DATA_HOST_PATH}:/var/lib/rstudio-connect \
  -v ${PCT_CONFIG_HOST_PATH}:/etc/rstudio-connect/rstudio-connect.gcfg:ro \
  ${PCT_IMAGE}:${PCT_VERSION}

⁠With Docker Compose

services:
  connect:
    image: ghcr.io/posit-dev/connect:latest
    privileged: true
    ports:
      - "3939:3939"
    volumes:
      - /path/to/license.lic:/etc/rstudio-connect/license.lic
      - /path/to/rstudio-connect.gcfg:/etc/rstudio-connect/rstudio-connect.gcfg:ro
      - connect-data:/var/lib/rstudio-connect
    restart: unless-stopped

volumes:
  connect-data:

⁠Image variants

Two variants are available:

Each tagged image bundles a fixed set of dependencies. Both variants ship the latest patch of the YYYY.MM Connect release available at image build time. The Standard variant additionally ships one R version, one Python version, and one Quarto version, locked to the latest available at release. The Containerfiles in this repository under connect/<version>/ document the exact versions in any tag.

See server extending examples⁠ for how to build on the Minimal image.

⁠Image tags

Posit publishes images to:

• Docker Hub: docker.io/posit/connect
• GitHub Container Registry: ghcr.io/posit-dev/connect

Ubuntu 24.04 is the default OS.

Tag formats where YYYY.MM.P is any supported Connect version:

• YYYY.MM.P - Latest OS, standard variant
• YYYY.MM.P-ubuntu-24.04 - Explicit OS, standard variant
• YYYY.MM.P-ubuntu-24.04-std - Explicit OS and variant
• YYYY.MM.P-ubuntu-24.04-min - Minimal variant
• latest - Latest version, default OS, standard variant

⁠Architectures

Posit publishes Connect images for linux/amd64 and linux/arm64. Pull the same tag from either platform. Docker selects the matching manifest automatically.

⁠Environment variables

If you are migrating from rstudio/rstudio-connect, see Environment variables⁠ under the migration guide for the legacy RSC_ names and deprecation timeline.

⁠Exposed ports

⁠Volumes

For persistent data, add these volume mounts to your docker run command:

-v /data/connect:/var/lib/rstudio-connect \
-v /data/connect-config:/etc/rstudio-connect

The data path is set by the Server.DataDir option in rstudio-connect.gcfg (default /var/lib/rstudio-connect). If you change this option in a custom configuration, mount the persistent volume to the new path.

⁠Configuration

⁠License activation

Connect requires a product license⁠. If you do not have a license yet, request a free 30-day trial at posit.co/trial-license⁠.

Posit recommends activating with a license file. License files work well in all environments including ephemeral, container-based, or air-gapped environments. Choose one method:

⁠Option 1: License file (recommended)

Mount the license file to any path in the container and set PCT_LICENSE_FILE_PATH to that path. The default search path is /etc/rstudio-connect/license.lic, so mounting to that path does not require setting the environment variable.

docker run --privileged -v /path/to/license.lic:/etc/rstudio-connect/license.lic ...

To ensure correct permissions on the license file, set the owner and mode on the host before mounting:

sudo chown root:root /path/to/license.lic
sudo chmod 0600 /path/to/license.lic

If the license file does not successfully activate, the container fails to start under most circumstances. See the Licensing FAQ⁠ for usage and troubleshooting information.

⁠Option 2: License key

docker run --privileged -e PCT_LICENSE="your-license-key" ...

License key activations can leak when a container shuts down ungracefully, consuming an activation slot that cannot be recovered through normal means. To help preserve license state across container restarts, mount these directories to persistent storage:

• /var/lib/.local
• /var/lib/.prof
• /var/lib/rstudio-connect

The license manager hardware-locks these state files to a single host; they do not transfer between machines. Mounting these paths reduces the chance of a leak but does not eliminate it. To avoid the leak risk entirely, use a license file (Option 1). See the License keys⁠ caveat for more detail.

⁠Option 3: Floating license server

docker run --privileged -e PCT_LICENSE_SERVER="license-server:port" ...

Floating license activations can also leak on ungraceful shutdown. To help preserve license state across container restarts, mount this directory to persistent storage:

• /var/lib/.TurboFloat

State files are hardware-locked and not transferable between hosts. To avoid the leak risk entirely, use a license file (Option 1).

⁠Custom configuration

Mount a custom configuration file:

docker run --privileged -v /path/to/rstudio-connect.gcfg:/etc/rstudio-connect/rstudio-connect.gcfg ...

Make sure the configuration file sets these fields:

• Server.Address set to the exact URL that users will use to visit Connect
• Server.DataDir set to the same path as the data volume mount (default /var/lib/rstudio-connect)
• HTTP.Listen (or equivalent HTTP, HTTPS, or HTTPRedirect settings, which change how to map the container ports)
• Python.Enabled and Python.Executable

See the configuration documentation⁠ for available options.

⁠Healthcheck

Connect exposes an unauthenticated health endpoint at /__ping__ on port 3939 that returns 200 OK once the application is ready to serve traffic.

curl http://localhost:3939/__ping__

The image declares a HEALTHCHECK against this endpoint:

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
    CMD curl --fail --silent --output /dev/null http://localhost:3939/__ping__

Both variants inherit the same directive. The min variant reports healthy, but most content will require R, Python, or Quarto to be installed if you are running a standalone instance. To disable the directive in a derived image, add HEALTHCHECK NONE.

For Kubernetes liveness and readiness probes, or load balancer health checks, hit the same endpoint directly rather than relying on the Docker healthcheck.

⁠User

Connect runs with the --privileged flag. The container starts as root and Connect drops privileges to the rstudio-connect user (UID and GID 999) for the server process and content sandboxing.

⁠Migrating from legacy image

This image replaces the legacy rstudio/rstudio-connect⁠ image. Connect itself is unchanged. The application reads rstudio-connect.gcfg, listens on 3939, writes data to Server.DataDir, requires --privileged, and uses the rstudio-connect user (UID/GID 999) for content execution. Existing data and configuration volumes mount unchanged. The differences are in how the image is published and configured.

⁠Image references

Posit published the legacy image as rstudio/rstudio-connect on Docker Hub and ghcr.io/rstudio/rstudio-connect on GHCR, tagged by OS (jammy, ubuntu2204, jammy-<version>, ubuntu2204-<version>) for linux/amd64 only. Update your image reference to one of the new locations and pick a tag that pins to your desired Connect version, OS, and variant. See Image tags⁠ and Architectures⁠.

⁠Variants

The legacy image shipped a single variant containing two R versions, two Python versions, Quarto, and Posit Professional Drivers. The Standard (std) variant is closest to the legacy image, containing one R version, one Python version, Quarto, and Posit Professional Drivers. The Minimal (min) variant has no equivalent in the legacy image. See Image variants⁠.

⁠Environment variables

License and debug environment variables now use the PCT_ prefix:

The image accepts the legacy RSC_ license names as a fallback during the deprecation window.

⁠Default data directory

The legacy image set Server.DataDir to /data by default, while this image sets it to /var/lib/rstudio-connect to align with the defaults used by Connect and the Connect Helm chart. If you use the default configuration file that comes with the image, update your data volume mount to match the new path:

-v /data/connect:/var/lib/rstudio-connect

⁠What did not change

• Application port (3939)
• Configuration file path (/etc/rstudio-connect/rstudio-connect.gcfg)
• Service user (rstudio-connect, UID/GID 999)
• --privileged flag requirement

⁠Caveats

⁠Security

Review these images before using them in production. Organizations with specific Common Vulnerabilities and Exposures (CVE) or vulnerability requirements can rebuild these images to meet their security standards.

Posit rebuilds published images weekly for Posit product editions under active support, pulling in operating system patches.

⁠Privileged mode

Connect requires the --privileged flag to run containers. The flag is necessary for Connect to execute user content in isolated environments.

⁠License keys

License keys used in containers risk activation slot loss if the container does not shut down gracefully. The license deactivates on container exit, but ungraceful shutdowns (crashes, docker kill) can leave the activation slot consumed on the Posit license server.

To ensure proper license deactivation, use a sufficient stop timeout for both docker run and docker stop:

docker run -d --privileged --stop-timeout 120 -e PCT_LICENSE="your-license-key" ...
docker stop --time 120 <container>

For production deployments, use license files rather than license keys.

⁠Hardware locking

Connect hardware-locks license state files to a specific machine. Changes to MAC addresses, hostnames, or container orchestration platforms, such as Kubernetes, can invalidate the license state, requiring reactivation.

To preserve license state across container restarts, mount these directories to persistent storage:

• License key
  • /var/lib/.local
  • /var/lib/.prof
  • /var/lib/rstudio-connect
• Floating license
  • /var/lib/.TurboFloat

Files in these directories are hardware-locked and not transferable between hosts. Gracefully shut down containers and allow license deactivation before changing host hardware or firmware (for example, upgrading a network card or updating BIOS). Apply the same caution before changing container resources (for example, the network driver or allocated CPU cores).

⁠Documentation

• Posit Connect Documentation⁠
• Admin Guide⁠
• Configuration Reference⁠