posit/workbench-session-complete repository overview

⁠

⁠Posit Workbench Session Complete

A Workbench⁠ session image that carries its own session components, so Workbench can launch sessions from it without a workbench-session-init init container alongside it.

It is a workbench-session⁠ image with a full Workbench installation layered on top. The session components come along with that installation.

⁠Quick reference

⁠How this differs from the standard session images

On Kubernetes, Workbench normally assembles a session container from two images at launch time:

1. The Job Launcher attaches an emptyDir volume, mounted at /mnt/init in an init container and at /usr/lib/rstudio-server in the session container.
2. The workbench-session-init init container copies the subset of /opt/session-components that the requested PWB_SESSION_TYPE needs into /mnt/init.
3. The workbench-session container starts and finds the components at /usr/lib/rstudio-server.

This image collapses that into one image: a full Workbench install puts the components at /usr/lib/rstudio-server at build time, so step 1 and 2 are unnecessary.

⁠Usage

Configure Workbench to launch sessions from this image and do not configure a session-init container. In rserver.conf, leave launcher-sessions-init-container-image-name unset; if it is set, Workbench will attach an init container whose emptyDir mount at /usr/lib/rstudio-server will mask the components baked into this image.

The Workbench Helm chart⁠ supports this pattern directly via components.enabled, which turns off init-container component delivery entirely:

session:
  image:
    repository: "ghcr.io/posit-dev/workbench-session-complete"
    tag: "2026.10.0-ubuntu-26.04"

components:
  # No init containers are configured; session.image must be self-contained.
  enabled: false

This is the same switch the chart documents for the classic rstudio/r-session-complete image — workbench-session-complete is the modern, workbench-session-based equivalent.

⁠Image registry

Posit publishes the image to Docker Hub and GitHub Container Registry:

• docker.io/posit/workbench-session-complete
• ghcr.io/posit-dev/workbench-session-complete

⁠Image variants

⁠Image tags

Tags follow {version}-{os}[-{variant}]. The following are valid examples:

• 2026.10.0-ubuntu-26.04: Standard variant on Ubuntu 26.04
• 2026.10.0-ubuntu-26.04-std: Standard variant (explicit)
• 2026.10.0-ubuntu-26.04-min: Minimal variant
• latest: Most recent Standard build on the default OS
• ubuntu-26.04, std, min: Most recent build of that OS or variant

The version is the Workbench version, and it is the exact apt version pin used for the rstudio-server package. It is not an R/Python coordinate — those come from whichever workbench-session base build the tag resolves to.

⁠Architectures

Posit publishes this image for linux/amd64 and linux/arm64.

⁠Operating systems

Ubuntu 26.04 only.

⁠Installed software

Everything from the workbench-session base (R, Python, Jupyter, Quarto, TinyTeX, Posit Pro Drivers) plus:

⁠Caveats

⁠Image size

A full Workbench install adds roughly 4.5 GB to the base. The Standard variant is around 15 GB uncompressed and the Minimal variant around 13 GB. Most of that is IDE payload: Positron Server, pwb-code-server, the bundled Quarto, and the Copilot language server.

If image size matters more than avoiding an init container, use workbench-session with workbench-session-init instead.

⁠libcap2 is an undeclared dependency of the Workbench deb

rsession and 22 other binaries under /usr/lib/rstudio-server link against libcap.so.2, but the rstudio-server package does not list libcap2 in its Depends. Installing the deb's declared dependencies is therefore not sufficient to get a working rsession.

The Containerfile installs libcap2 explicitly. This gap is invisible on the Standard variant (whose package set pulls libcap2 in incidentally) and on r-session-complete (whose product-base-pro base already has it); on the Minimal variant it caused rsession to fail at exec time with libcap.so.2: cannot open shared object file. The workbench-binaries-shared-libs-resolve goss check guards against the next such gap.

⁠The rstudio-server account's UID/GID is not pinned

The deb postinst creates the account with useradd -r -U rstudio-server, letting useradd pick the next free system id, so the value depends on what the base image leaves free and can move on a base rebuild.

It is left unpinned to stay faithful to r-session-complete, which also lets the postinst choose. Note that the uid/gid 999 convention used by the workbench⁠ image cannot simply be copied here: in the workbench-session base, gid 999 is already taken by systemd-journal. Pin it explicitly if anything in your deployment depends on a stable numeric owner.

⁠Inert sysv init links are present

With no init system in the build container, the postinst falls through to its sysv branch and creates /etc/init.d/rstudio-{server,launcher} plus /etc/rc{2,3,4,5}.d/S01rstudio-*. Nothing in a container runs sysv rc.d, so these are inert, and r-session-complete produces the same artifacts from the same postinst.

What matters is that no server is started and no server state is captured at build time. The install_workbench.sh patches remove the postinst's service-start and license-initialization steps, and the goss suite asserts that no secure cookie key, launcher keypair, session RPC key, or rstudio.sqlite is baked into the image.

⁠Security

Review this image before using it in production. Organizations with specific Common Vulnerabilities and Exposures (CVE) or vulnerability requirements can rebuild it to meet their security standards.

⁠Version compatibility

The Workbench version in this image must match your Workbench server version. Mismatched versions can cause session startup failures or unexpected behavior.

⁠Documentation

• Posit Workbench documentation⁠
• Job Launcher overview⁠
• Kubernetes integration guide⁠
• workbench-session⁠ and workbench-session-init⁠