RStudio Server module

[bpmct]

A discussion dedicated to the RStudio Server module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	19 / 25	10 / 20	0 / 20	7 / 10	53 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Single clear example with sensible defaults for the web IDE use case.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or how Coder fits in the flow. Only mentions Coder agent requirement.
Visual preview	5	5	README includes an embedded image: 

IDE Integration — 19 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource present with proper configuration (subdomain, icon, URL).
Managed configuration	6	6	Documented support for managed settings via disable_auth, rstudio_user, rstudio_password, enable_renv variables.
Configurable folder or workdir	6	6	project_path variable documented and implemented, mounts the project directory in the container.
Pre-installed extensions	6	0	Not applicable to RStudio Server; no extension mechanism documented.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	rstudio_user and rstudio_password marked sensitive = true in main.tf, but README example does not show credential handling, and defaults inline literal values ("rstudio"/"rstudio").
Non-hardcoded auth path	4	2	disable_auth variable exists and defaults to true, providing a path to avoid credentials, but this is not highlighted in README as a security best practice.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No variable to override the Docker image source. Hardcoded to rocker/rstudio:${SERVER_VERSION}. rstudio_server_version only controls the tag, not the registry or image name.
Bring-your-own binary	5	0	No documented way to skip the docker pull or use a pre-existing container/image.
Egress transparency	3	0	No dedicated README section enumerating external endpoints (Docker Hub, etc.).
Runs without sudo	2	0	Script invokes docker commands which typically require elevated privileges or docker group membership. No documentation of non-sudo path.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults, and validation on share variable.
Test coverage	4	1	No .tftest.hcl or test files visible in the provided module files.

Overall — 53 / 100

---

Scored against SCORECARD.md on 2026-07-20 with claude-sonnet-4-5.