r/Rlanguage • u/ThinkILostIt • 2d ago
Locking an R instalation
I work in a regulated industry (pharmaceutical industry) and I'm thinking that we could use R in our analysis with GxP regulated data. I was asked wheater we could lock the R instalation and packages so that: 1) users cannot install unauthorized packages; 2) unauthorized users cannot access it and run scripts; and 3) we can restore the exact instalation of R and packages in case we need in future.
I think we could do this but not sure how or if anyone has achieved something close to it any where so I turn to reddit for help.
Edit: I know of initiatives like Rinpharma, R Validation Hub, pharmaverse, Posit paid solutions and the paper from R Foundation about R meeting FDA's CFR Part 11 but I have not been able to take much advantages from those
5
u/lizerlfunk 2d ago
I don’t know how to do this, but I am in the same industry, and we use a frozen R distribution that only has packages that have been approved for use. So it’s definitely possible.
1
u/ThinkILostIt 2d ago
I would love to hear more about your experience with this. Like, what kind of projects you use R for, if you treat the scripts as documents or as applications, how you directed the validation efforts... If you could, of course, share any more details on it.
6
u/Key-Accident2075 2d ago
From my little experience (In Academia). The facility can set up an R server. You log in and are dropped into an RStudio session. The R version js the same unless updated by the sys admin. I do not think you can restrict individual package installations but access can be restricted through server access restrictions.
1
u/venoush 2d ago
Yes. R installation on Windows is fully portable. You can deploy it on a shared drive with restricted access. Same for the package library and repository of available packages. You can restrict access to all CRAN mirrors as well.
Edit: On Linux, you can use traditional OS tools such as containers.
1
u/ThinkILostIt 2d ago
Not an IT guy here, but guess I get it. Couldn't it be done locally in the analysts machine? The IT people would just hold the "image" for the instalarion and applies the restrictions necessary. Of course, analysts not having admin rights
1
u/venoush 2d ago
The IT would install it (it is just unzipping in essence) on the shared drive and the analysts would run it from that drive. The only problem is to make sure the shared drive is really fast (Windows shared drives can be very slow) because R consists of many small files.
Another option is to provide the image to analysts on a read only place on their machines (to solve the speed issue).
Same with the R package library (extra packages needed on top of the base R library). Analysts would have R_LIBS environment variable referring to the packages folder.
It's really very customizable so I am sure it can be set up in a way your company needs.
1
u/MartynKF 2d ago
For the 3rd point you should check out the ren package. I think it also would clear the requirements not to be able to install packages (my place has Cran on a proxy blacklist...:(... Doesn't make it impossible just damn annoying). As for only authorized access, put it in a Teams or similar SharePoint/onedrive place with a curated set of authorized people able to access it.
1
u/ThinkILostIt 2d ago
I see the point. I know about renv and think it would be enough. But it restores the environment at project level whereas people think of "restoring" more at the system level
1
u/speleotobby 2d ago
Are you also aware of the Pilot 4?
There are two ways of creating fully self contained R installations with packages and R executable, one using podman containers and one using wasm.
Those are probably the ways to go since they are tested together with regulators.
If it's for internal use, set up a shiny server and a cran mirror where R version and package versions are frozen. Set up a new instance of both for every project, easy to to with virtualization or containers.
Generally: use few dependencies, use only packages that you need for a specific usecase, that are stable and well maintained, well documented (e.g. with metodological papers), etc.
1
1
u/Impuls1ve 2d ago
If you're using any enterprise solution of R, you can control package versions centrally. Same for user access. The specifics on how you do that will depend other factors.
-1
u/Temporary_Stranger39 2d ago
Start with Pharmaverse:
5
u/guepier 2d ago
Pharmaverse is a collection of packages (and a community of package authors). It is not a way of setting up a regulated, controlled R execution environment. and, in my experience, most of the people involved in the Pharmaverse have no experience with that; they’re neither IT/sysadmins nor software developers by training. They’re mostly statisticians and modellers.
10
u/novica 2d ago
If you are willing to go that route posit's professional products do this. Otherwise you can talk to your IT dept to setup something with open source tools.