{"user":"posit","name":"workbench","namespace":"posit","repository_type":"image","status":1,"status_description":"active","description":"","is_private":false,"is_automated":false,"star_count":0,"pull_count":244589,"last_updated":"2026-10-11T04:59:43.583416Z","last_modified":"2026-10-11T05:01:37.767912Z","date_registered":"2025-06-03T18:33:44.753935Z","collaborator_count":0,"affiliation":null,"hub_user":"jspiewak","has_starred":false,"full_description":"\u003ca href=\"https://posit.co/products/enterprise/workbench\"\u003e\n\u003cpicture\u003e\n \u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://cdn.posit.co/platform/containers/logos/logo_workbenchtag-reverse.svg\"\u003e\n \u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://cdn.posit.co/platform/containers/logos/logo_workbenchtag-fullcolor.svg\"\u003e\n \u003cimg alt=\"Posit Workbench Logo\" src=\"https://cdn.posit.co/platform/containers/logos/logo_workbenchtag-fullcolor.svg\"\u003e\n\u003c/picture\u003e\n\u003c/a\u003e\n\n# Posit Workbench container image\n\nThis container image provides [Workbench](https://docs.posit.co/ide/server-pro/), an integrated development environment for data science teams that supports R, Python, and VS Code.\n\n[![GitHub Repository](https://img.shields.io/badge/github-repo?logo=github\u0026color=grey)](https://github.com/posit-dev/images-workbench)\n[![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/posit-dev/images-workbench/production.yml?branch=main)](https://github.com/posit-dev/images-workbench/actions/workflows/production.yml)\n[![Latest Version](https://img.shields.io/docker/v/posit/workbench?sort=semver\u0026label=latest)](https://hub.docker.com/r/posit/workbench/tags)\n![Docker Hub Pulls](https://img.shields.io/docker/pulls/posit/workbench)\n![Docker Image Size](https://img.shields.io/docker/image-size/posit/workbench/latest)\n\n\u003e [!TIP]\n\u003e Deploying on Kubernetes? Try the \u003ca href=\"https://docs.posit.co/helm/charts/rstudio-workbench/README.html\"\u003ePosit Workbench Helm chart\u003c/a\u003e!\n\n## Related images\n\nFor Kubernetes deployments, Workbench uses these images together. See the [repository README](https://github.com/posit-dev/images-workbench#deploying-on-kubernetes) for Helm configuration.\n\n| Image | Description | Docker Hub | GitHub Container Registry |\n|:------|:------------|:-----------|:--------------------------|\n| `workbench-session` | Session images for Kubernetes (R and Python version matrix) | [posit/workbench-session](https://hub.docker.com/r/posit/workbench-session) | [posit-dev/workbench-session](https://github.com/posit-dev/images-workbench/pkgs/container/workbench-session) |\n| `workbench-session-init` | Init container providing session runtime components | [posit/workbench-session-init](https://hub.docker.com/r/posit/workbench-session-init) | [posit-dev/workbench-session-init](https://github.com/posit-dev/images-workbench/pkgs/container/workbench-session-init) |\n| `workbench-positron-init` | Init container providing Positron IDE components | [posit/workbench-positron-init](https://hub.docker.com/r/posit/workbench-positron-init) | [posit-dev/workbench-positron-init](https://github.com/posit-dev/images-workbench/pkgs/container/workbench-positron-init) |\n\n## Quick reference\n\n| | |\n|---|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| **Maintained by** | [the Posit Docker team](https://github.com/posit-dev/images) |\n| **Where to get help** | [GitHub Issues](https://github.com/posit-dev/images-workbench/issues), [Images Discussion Board](https://github.com/posit-dev/images/discussions), [the Posit Community Forum](https://forum.posit.co/c/posit-professional-hosted), [Posit Support](https://support.posit.co/hc/en-us) |\n| **Where to file issues** | [https://github.com/posit-dev/images-workbench/issues](https://github.com/posit-dev/images-workbench/issues) |\n| **Source** | [https://github.com/posit-dev/images-workbench](https://github.com/posit-dev/images-workbench) |\n| **License** | [MIT](https://github.com/posit-dev/images-workbench/blob/main/LICENSE.md) |\n| **Product documentation** | [Posit Workbench documentation](https://docs.posit.co/ide/server-pro/) |\n\n## How to use this image\n\n### Quick start\n\n```bash\nPWB_VERSION=\"latest\" # or a specific version like \"2026.09.0\"\nPWB_IMAGE=\"ghcr.io/posit-dev/workbench\" # or docker.io/posit/workbench\nPWB_LICENSE_FILE_HOST_PATH=\"/path/to/license.lic\"\nPWB_LICENSE_FILE_PATH=\"/etc/rstudio-server/license.lic\" # this is the default path for the `PWB_LICENSE_FILE_PATH` container environment variable, included for illustrative purposes\nPWB_DATA_STORAGE_HOST_PATH=\"/path/to/data\"\nPWB_HOME_STORAGE_HOST_PATH=\"/path/to/home\"\ndocker run -d \\\n --name workbench \\\n -p 8787:8787 \\\n -e PWB_TESTUSER=posit \\\n -e PWB_TESTUSER_PASSWD=posit \\\n -e PWB_LICENSE_FILE_PATH=${PWB_LICENSE_FILE_PATH} \\\n -v ${PWB_LICENSE_FILE_HOST_PATH}:${PWB_LICENSE_FILE_PATH} \\\n -v ${PWB_DATA_STORAGE_HOST_PATH}:/var/lib/rstudio-server \\\n -v ${PWB_HOME_STORAGE_HOST_PATH}:/home \\\n ${PWB_IMAGE}:${PWB_VERSION}\n```\n\nAccess Workbench at `http://localhost:8787`. Log in with username `posit` and password `posit`.\n\n### With a custom configuration file\n\n```bash\nPWB_VERSION=\"latest\" # or a specific version like \"2026.09.0\"\nPWB_IMAGE=\"ghcr.io/posit-dev/workbench\" # or docker.io/posit/workbench\nPWB_LICENSE_FILE_HOST_PATH=\"/path/to/license.lic\"\nPWB_CONFIG_HOST_PATH=\"/path/to/rstudio\"\ndocker run -d \\\n --name workbench \\\n -p 8787:8787 \\\n -v ${PWB_LICENSE_FILE_HOST_PATH}:/etc/rstudio-server/license.lic \\\n -v ${PWB_CONFIG_HOST_PATH}:/etc/rstudio:ro \\\n ${PWB_IMAGE}:${PWB_VERSION}\n```\n\n### With Docker Compose\n\n```yaml\nservices:\n workbench:\n image: docker.io/posit/workbench:latest # or ghcr.io/posit-dev/workbench:latest\n ports:\n - \"8787:8787\"\n environment:\n PWB_TESTUSER: posit\n PWB_TESTUSER_PASSWD: posit\n volumes:\n - /path/to/license.lic:/etc/rstudio-server/license.lic\n - /path/to/rstudio:/etc/rstudio:ro\n - workbench-home:/home\n - workbench-shared:/var/lib/rstudio-server\n restart: unless-stopped\n\nvolumes:\n workbench-home:\n workbench-shared:\n```\n\n## Image variants\n\nTwo variants are available:\n\n| Variant | Description |\n|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Standard (`std`) | Opinionated image, runs out of the box. Bundles Workbench with one R version, one Python version, Quarto, Posit Professional Drivers, and the Job Launcher. |\n| Minimal (`min`) | Small image you can extend with the dependencies you need. Does not include R, Python, or Quarto, and cannot run RStudio, JupyterLab, and other dependent features as-is. Use this variant as a starting point for custom images. |\n\nEach tagged image bundles a fixed set of dependencies. Both variants ship the `YYYY.MM` release of Workbench at the latest patch release available when the image was built. The `std` variant additionally ships one R version and one Python version, locked to the latest available at build time. The Containerfiles in this repository under `workbench/\u003cversion\u003e/` document the exact versions in any tag. No arguments are overridden at build time.\n\nSee [server extending examples](https://github.com/posit-dev/images-examples/tree/main/extending/workbench/server) for how to build on the Minimal image.\n\n## Image tags\n\nPosit publishes images to:\n- Docker Hub: `docker.io/posit/workbench`\n- GitHub Container Registry: `ghcr.io/posit-dev/workbench`\n\nUbuntu 24.04 is the default OS. Ubuntu 26.04 is also supported for the latest version.\n\nTag formats where `YYYY.MM.P` is any supported Workbench version:\n- `YYYY.MM.P` - Latest OS, standard variant\n- `YYYY.MM.P-ubuntu-24.04` - Explicit OS, standard variant\n- `YYYY.MM.P-ubuntu-24.04-std` - Explicit OS and variant\n- `YYYY.MM.P-ubuntu-24.04-min` - Minimal variant\n- `YYYY.MM.P-ubuntu-26.04` - Ubuntu 26.04 (latest version only)\n- `latest` - Latest version, default OS, standard variant\n\n## Architectures\n\nPosit publishes Workbench images for `linux/amd64` only. `linux/arm64` builds remain in developer preview until Workbench supports ARM in production.\n\n## Environment variables\n\n| Variable | Description |\n|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|\n| `PWB_LICENSE` | License key for activation |\n| `PWB_LICENSE_SERVER` | URL of floating license server |\n| `PWB_LICENSE_FILE_PATH`| Path to license file (default: `/etc/rstudio-server/license.lic`) |\n| `PWB_LAUNCHER` | Enable the Job Launcher (default: `true`) |\n| `PWB_LAUNCHER_TIMEOUT` | Launcher startup timeout in seconds (default: `10`) |\n| `PWB_TESTUSER` | Test user name. If empty, the image creates no test user. |\n| `PWB_TESTUSER_PASSWD` | Test user password |\n| `PWB_TESTUSER_UID` | Test user UID (default: `10000` when `PWB_TESTUSER` is set) |\n| `PWB_SSSD` | Enable `sssd` for user provisioning (default: `true`). Set to `false` to disable `sssd`. |\n| `PWB_STARTUP_DEBUG` | Set to `1` for verbose startup logging |\n| `PWB_DIAGNOSTIC_ENABLE`| When true, run `rstudio-server verify-installation` before server start and write results to `$PWB_DIAGNOSTIC_DIR/verify.log` (default: `false`) |\n| `PWB_DIAGNOSTIC_DIR` | Directory for diagnostic logs (default: `/var/log/rstudio`) |\n| `PWB_EXIT_AFTER_VERIFY`| When `PWB_DIAGNOSTIC_ENABLE=true`, exit after running verification instead of starting the server (default: `false`) |\n\nIf you are migrating from `rstudio/rstudio-workbench`, see [Environment variables](#environment-variables-1) under the migration guide for the legacy `RSW_` names and deprecation timeline.\n\n## Exposed ports\n\n| Port | Description |\n|------|-------------------------------|\n| 8787 | HTTP web interface |\n| 5559 | Job Launcher (needed for OHE) |\n\n## Volumes\n\nFor persistent data, add these volume mounts to your `docker run` command:\n\n```bash\n-v /data/workbench-home:/home \\\n-v /data/rstudio-server:/var/lib/rstudio-server \\\n-v /data/rstudio-server-config:/etc/rstudio\n```\n\n| Mount Point | Description |\n|---------------------------|------------------------------------------------------------------------|\n| `/home` | User home directories. Mount to persist user files between restarts. |\n| `/var/lib/rstudio-server` | Session data and database |\n| `/etc/rstudio` | Configuration files |\n\n## Configuration\n\n### License activation\n\nWorkbench requires a [product license](https://docs.posit.co/licensing/licensing-faq.html). If you don't have a license yet, request a free 30-day trial at [posit.co/trial-license](https://posit.co/trial-license/).\n\nPosit recommends activating with a license file. Choose one method:\n\n#### Option 1: License file (recommended)\n\nMount the license file to any path in the container and set `PWB_LICENSE_FILE_PATH` to that path. The default search path is `/etc/rstudio-server/license.lic`, so mounting to that path does not require setting the environment variable. The environment variable is only included for illustrative purposes below.\n\n```bash\ndocker run -v /path/to/license.lic:/etc/rstudio-server/license.lic -e PWB_LICENSE_FILE_PATH=/etc/rstudio-server/license.lic ...\n```\n\nTo ensure correct permissions on the license file, set the owner and mode on the host before mounting:\n\n```bash\nsudo chown 999:999 /path/to/license.lic\nsudo chmod 0600 /path/to/license.lic\n```\n\nIf the license file does not successfully activate, the container fails to start under most circumstances. See the [Licensing FAQ](https://docs.posit.co/licensing/licensing-faq.html) for usage and troubleshooting information.\n\n#### Option 2: License key\n\n```bash\ndocker run -e PWB_LICENSE=\"your-license-key\" ...\n```\n\nLicense key activations can leak when a container shuts down ungracefully, consuming an activation slot that cannot be recovered through normal means. To help preserve license state across container restarts, mount these directories to persistent storage:\n\n- `/var/lib/.local`\n- `/var/lib/.prof`\n- `/var/lib/rstudio-workbench`\n\nThe license manager hardware-locks these state files to a single host; they do not transfer between machines. Mounting these paths reduces the chance of a leak but does not eliminate it. To avoid the leak risk entirely, use a license file (Option 1). See the [License keys](#license-keys) caveat for more detail.\n\n#### Option 3: Floating license server\n\n```bash\ndocker run -e PWB_LICENSE_SERVER=\"http://license-server:8989\" ...\n```\n\nFloating license activations can also leak on ungraceful shutdown. To help preserve license state across container restarts, mount this directory to persistent storage:\n\n- `/var/lib/.TurboFloat`\n\nState files are hardware-locked and not transferable between hosts. To avoid the leak risk entirely, use a license file (Option 1).\n\n### User provisioning\n\nBy default, Workbench creates a test user controlled by the `PWB_TESTUSER`, `PWB_TESTUSER_PASSWD`, and `PWB_TESTUSER_UID` environment variables. If `PWB_TESTUSER` is empty, no test user is created.\n\n#### LDAP, Active Directory, and sssd\n\nThe image installs `sssd` and starts it by default with a placeholder configuration. To provision users from a directory (LDAP server, Active Directory, etc.), mount your own configuration file into `/etc/sssd/conf.d/`.\n\nExample `sssd.conf`:\n\n```ini\n[sssd]\nconfig_file_version = 2\ndomains = LDAP\n\n[domain/LDAP]\nid_provider = ldap\nauth_provider = ldap\nchpass_provider = ldap\nsudo_provider = ldap\n# ... more configuration\n```\n\nThen run the container with the configuration mounted:\n\n```bash\n# sssd requires strict file permissions\nchmod 600 sssd.conf\n\ndocker run -d \\\n -p 8787:8787 -p 5559:5559 \\\n -v /path/to/license.lic:/etc/rstudio-server/license.lic \\\n -v $PWD/sssd.conf:/etc/sssd/conf.d/sssd.conf \\\n ghcr.io/posit-dev/workbench:latest\n```\n\nFor custom authentication or session behavior with PAM, you might also need to modify the PAM configuration files in the container. See the [Workbench admin guide](https://docs.posit.co/ide/server-pro/admin/authenticating_users/authenticating_users.html) for more information.\n\nTo disable `sssd` entirely, set `PWB_SSSD=false`. `sssd` requires root, so it is also skipped automatically when the container runs as a non-root user.\n\n### Custom configuration\n\nMount a custom configuration directory or file:\n\n```bash\ndocker run -v /path/to/rstudio:/etc/rstudio ...\n```\n\nOr mount a single file:\n\n```bash\ndocker run -v /path/to/rserver.conf:/etc/rstudio/rserver.conf ...\n```\n\nChanges take effect when the container is restarted. See the [configuration documentation](https://docs.posit.co/ide/server-pro/reference/rserver_conf.html) for available options.\n\nIf you replace `rserver.conf` with your own file, keep `server-health-check-enabled=1` so the [health check](#health-check) endpoint works.\n\n## Health check\n\nThe image declares a Docker [`HEALTHCHECK`](https://docs.docker.com/reference/dockerfile/#healthcheck) that polls the Workbench `/health-check` endpoint:\n\n```dockerfile\nHEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \\\n CMD curl -fsS http://localhost:8787/health-check || exit 1\n```\n\nThe endpoint requires `server-health-check-enabled=1` in `rserver.conf`. The bundled configuration sets this by default, so no action is required unless you mount your own `rserver.conf`.\n\nWhen the container is healthy, `docker ps` reports `healthy` in the status column and the endpoint returns `200 OK` with a plain-text dump of server diagnostics. To inspect the response directly:\n\n```bash\ndocker exec \u003ccontainer\u003e curl -fsS http://localhost:8787/health-check\n```\n\nTo disable the built-in health check, run the container with `--no-healthcheck` or override it in your orchestrator.\n\n## Process management\n\nWorkbench runs several services inside the container under [`supervisord`](http://supervisord.org/). `supervisord` exits the container if any required service exits, so the container fails fast on startup errors.\n\n\u003e [!NOTE]\n\u003e Running multiple services in a single container is generally an anti-pattern. The image uses this approach as a workaround until Workbench can handle users and supporting processes in a more container-friendly way.\n\nThe image manages these services:\n\n- **Workbench**: the main server process. The startup configuration mounts at `/startup/base`.\n- **Job Launcher**: enables Positron, RStudio, JupyterLab, and VS Code sessions, as well as integration with job schedulers like Slurm and Kubernetes. Enabled by default. The startup configuration mounts at `/startup/launcher`. To disable, mount an empty volume over `/startup/launcher`.\n- **sssd**: provides user provisioning when connected to an LDAP directory or other user store. Enabled by default with a placeholder domain that does nothing. To use your own directory, mount required `.conf` files into `/etc/sssd/conf.d/` (see [User provisioning](#user-provisioning)). To disable entirely, set `PWB_SSSD=false` or mount an empty volume over `/startup/user-provisioning/`.\n- **custom**: to run additional services inside the container, mount supervisord configuration files into `/startup/custom/`. `supervisord` starts and manages them alongside the built-in services. In Kubernetes, `initContainers` or sidecar containers are often a better fit.\n\n## User\n\nThe container starts as `root` and Workbench drops privileges to the `rstudio-server` user (UID and GID `999`) for the server process.\n\n## Examples\n\n### Running with persistent home directories and configuration\n\n```bash\ndocker run -d \\\n --name workbench \\\n -p 8787:8787 -p 5559:5559 \\\n -v /data/workbench-home:/home \\\n -v /path/to/rstudio:/etc/rstudio \\\n -v /path/to/license.lic:/etc/rstudio-server/license.lic \\\n -e PWB_TESTUSER=posit \\\n -e PWB_TESTUSER_PASSWD=posit \\\n ghcr.io/posit-dev/workbench:latest\n```\n\nOpen `http://localhost:8787` and log in as `posit`.\n\n## Migrating from legacy image\n\nThis image replaces the legacy [`rstudio/rstudio-workbench`](https://hub.docker.com/r/rstudio/rstudio-workbench) image. Workbench itself is unchanged. The application reads `/etc/rstudio/rserver.conf`, listens on `8787`, runs the Job Launcher on `5559`, and runs as the `rstudio-server` user (UID/GID `999`). Data and configuration volume mount points are unchanged. The differences are in how the image is published and configured.\n\n### Image references\n\nThe legacy image was published as `rstudio/rstudio-workbench` on Docker Hub and `ghcr.io/rstudio/rstudio-docker-products/rstudio-workbench` on GHCR, tagged by OS (`jammy`, `ubuntu2204`, `jammy-\u003cversion\u003e`, `ubuntu2204-\u003cversion\u003e`) for `linux/amd64` only. Update your image reference to one of the new locations and pick a tag that pins to your desired Workbench version, OS, and variant. See [Image tags](#image-tags) and [Architectures](#architectures).\n\n### Variants\n\nThe legacy image shipped a single variant containing two versions of R and two versions of Python alongside many extraneous system packages. The Standard (`std`) variant is closest to the legacy image; the Minimal (`min`) variant has no equivalent. See [Image variants](#image-variants) for what each includes.\n\n### Environment variables\n\nLicense, launcher, and test user environment variables use the `PWB_` prefix:\n\n| New variable | Legacy variable |\n|------------------------|------------------------|\n| `PWB_LICENSE` | `RSW_LICENSE` |\n| `PWB_LICENSE_SERVER` | `RSW_LICENSE_SERVER` |\n| `PWB_LICENSE_FILE_PATH`| `RSW_LICENSE_FILE_PATH`|\n| `PWB_LAUNCHER` | `RSW_LAUNCHER` |\n| `PWB_LAUNCHER_TIMEOUT` | `RSW_LAUNCHER_TIMEOUT` |\n| `PWB_TESTUSER` | `RSW_TESTUSER` |\n| `PWB_TESTUSER_PASSWD` | `RSW_TESTUSER_PASSWD` |\n| `PWB_TESTUSER_UID` | `RSW_TESTUSER_UID` |\n\nThe image accepts the legacy `RSW_` names as a fallback.\n\n\u003e [!NOTE]\n\u003e Posit plans to deprecate `RSW_` variables after 2026; see the \u003ca href=\"https://docs.posit.co/ide/server-pro/news/\"\u003eWorkbench release notes\u003c/a\u003e for updates. Use the `PWB_` prefix for new deployments.\n\n### Privileged mode\n\nThe legacy image documented `docker run --privileged` for some examples. This image does not require `--privileged`.\n\n### What did not change\n\n- Application port (`8787`)\n- Job Launcher port (`5559`)\n- Configuration directory (`/etc/rstudio`)\n- License file default path (`/etc/rstudio-server/license.lic`)\n- Service user (`rstudio-server`, UID/GID `999`)\n- Process management with `supervisord` and the `/startup/{base,launcher,user-provisioning,custom}` mount points\n\n## Caveats\n\n### Security\n\nReview these images before using them in production. Organizations with specific Common Vulnerabilities and Exposures (CVE) or vulnerability requirements can rebuild these images to meet their security standards.\n\nPosit rebuilds published images weekly for Posit product editions under active support to pull in operating system patches.\n\n### License keys\n\nLicense keys used in containers risk activation slot loss if the container does not shut down gracefully. The license deactivates on container exit, but ungraceful shutdowns (crashes, `docker kill`) can leave the activation slot consumed on the Posit license server.\n\nTo ensure proper license deactivation, use a sufficient stop timeout for both `docker run` and `docker stop`:\n\n```bash\ndocker run -d --stop-timeout 120 -e PWB_LICENSE=\"your-license-key\" ...\ndocker stop --time 120 \u003ccontainer\u003e\n```\n\nFor production deployments, use license files rather than license keys.\n\n### Hardware locking\n\nWorkbench hardware-locks license state files to a specific machine. Changes to MAC addresses, hostnames, or container orchestration platforms, such as Kubernetes, can invalidate the license state, requiring reactivation. See [License activation](#license-activation) for the directories to mount for each license type.\n\nGracefully shut down containers and allow license deactivation before changing host hardware or firmware (for example, upgrading a network card or updating BIOS). Apply the same caution before changing container resources (for example, the network driver or allocated CPU cores).\n","permissions":{"read":true,"write":false,"admin":false},"media_types":["application/vnd.oci.image.index.v1+json"],"content_types":["image"],"categories":[],"immutable_tags_settings":{"enabled":false,"rules":[".*"]},"storage_size":2301369033619,"source":null}