MILAB-6263: fix renv runtime permission-denied on non-root containers

[blackcat]

Summary

Cross-block fix: the docker entrypoint of the R-based software re-ran renv::restore() on every container start. On hosts that run the container as a non-root UID (e.g. lab.research), renv tried to back up entries in the root-owned /usr/local/lib/R/site-library/ (e.g. rlang brought in by the r-base:4.4.2 base image) and failed with Permission denied.

Already merged in differential-clonotype-abundance (platforma-open/differential-clonotype-abundance#43); the same Dockerfile pattern was replicated here.

Change

• ENV R_LIBS_USER=/app/renv/library + ENV RENV_PATHS_LIBRARY=\${R_LIBS_USER} so renv installs into a project-local library and R discovers packages via the standard R_LIBS_USER env var.
• RUN mkdir -p \"\${R_LIBS_USER}\" because renv silently falls back to the default library if the path doesn't exist.
• Drop /app/run.sh and the ENTRYPOINT; the platforma SDK passes the full cmd (Rscript /app/...) at run time, so no wrapper is needed.

Test plan

• CI build of the docker image succeeds.
• On a non-root host (lab.research), running the entrypoint no longer logs cannot create directory '/usr/local/lib/R/site-library/...': Permission denied.

🤖 Generated with Claude Code

Greptile Summary

This PR fixes a Permission denied crash that occurred when renv's runtime restore() call tried to back up root-owned system library entries (e.g. rlang in /usr/local/lib/R/site-library/) on hosts running containers as a non-root UID. The fix redirects renv's install target to a project-local, writable path and removes the runtime restore wrapper entirely.

• Dockerfile: Sets R_LIBS_USER and RENV_PATHS_LIBRARY to /app/renv/library (a writable, /app-scoped path), creates the directory explicitly, performs a two-pass build-time restore (parallel first, then sequential clean=TRUE to resolve race conditions), and drops /app/run.sh + ENTRYPOINT since the SDK injects the command directly at runtime.
• Repo pinning: Switches RENV_CONFIG_REPOS_OVERRIDE from cloud.r-project.org to a dated Posit Package Manager snapshot (2025-09-10) to lock the CRAN metadata to a pre-ggplot2-4.0 state and prevent silent lockfile-version drift.
• Tooling: Bumps @platforma-sdk/block-tools from ~2.6.30 to ~2.7.24 with associated lockfile updates.

Confidence Score: 5/5

Safe to merge — the change correctly isolates renv's install target to a writable project-local path and removes the runtime restore wrapper that was the source of the permission failure.

The Dockerfile changes are well-reasoned: R_LIBS_USER and RENV_PATHS_LIBRARY both resolve to the same /app/renv/library path (Docker ENV interpolation expands the variable correctly at build time), the directory is created before renv runs, and the two-pass restore strategy handles parallel-install races without hiding genuine failures. Removing the ENTRYPOINT is intentional and consistent with how the SDK drives the container. The PPM dated snapshot pin prevents silent CRAN metadata drift. No logic errors or regressions are introduced.

No files require special attention. The pnpm-lock.yaml bump is a straightforward transitive dependency update alongside the block-tools version bump.

Important Files Changed

Filename	Overview
software/Dockerfile	Core fix: R_LIBS_USER and RENV_PATHS_LIBRARY now point to a writable project-local path (/app/renv/library); runtime renv::restore wrapper and ENTRYPOINT removed; two-pass build-time restore added; PPM dated snapshot replaces cloud.r-project.org
.changeset/fix-runtime-renv-restore-permission-denied.md	Changeset entry documenting the fix; accurately describes root cause and solution
pnpm-workspace.yaml	Bumps @platforma-sdk/block-tools catalog pin from ~2.6.30 to ~2.7.24
pnpm-lock.yaml	Lockfile update matching the block-tools bump; several @milaboratories sub-packages updated as transitive dependencies

Sequence Diagram

sequenceDiagram
    participant Docker as Docker Build
    participant renv as renv::restore()
    participant lib as /app/renv/library
    participant SDK as Platforma SDK (runtime)
    participant Rscript as Rscript

    Docker->>renv: Pass 1 — parallel restore (tryCatch, errors logged)
    renv->>lib: Install packages to R_LIBS_USER
    Docker->>renv: "Pass 2 — sequential restore (Ncpus=1, clean=TRUE)"
    renv->>lib: Verify/fix any parallel-race installs

    Note over Docker,lib: Build complete — no ENTRYPOINT set

    SDK->>Rscript: Rscript /app/script.R
    Rscript->>lib: "Resolve packages via R_LIBS_USER=/app/renv/library"
    lib-->>Rscript: Packages found (writable path, non-root safe)

Loading

_{Reviews (1): Last reviewed commit: "MILAB-6263: pin CRAN to PPM dated snapsh..." | Re-trigger Greptile}

[gemini-code-assist]

Code Review

This pull request resolves a Permission denied error encountered when running the container as a non-root user by shifting the renv installation to a project-local library at /app/renv/library. The runtime renv::restore() call and the run.sh entrypoint wrapper have been removed to prevent unauthorized filesystem modifications at startup. Review feedback recommends extending the post-installation cleanup to include the new library path and explicitly setting executable permissions on R scripts to ensure reliability without the previous wrapper script.

[gemini-code-assist]

Since the R packages are now installed into a project-local library at ${R_LIBS_USER}, the cleanup logic should be extended to remove any keys.html files generated within that directory. Additionally, as the runtime wrapper script (run.sh) has been removed, it is recommended to explicitly ensure that the R scripts are executable. This is particularly important because they are invoked directly in the package.json command, and relying on source file permissions can be fragile.

RUN R --no-echo -e "renv::restore(clean = TRUE)" \
    && chmod +x /app/*.R \
    && find /root/.cache/R -name keys.html -delete \
    && find /usr/local/lib/R -name keys.html -delete \
    && find "${R_LIBS_USER}" -name keys.html -delete