REACH — Regeneron Environment for Analytics, Computing, and HPC

Why the Compute Canada stack

Every R version the package-validation register offers was compiled by EasyBuild, published read-only over CVMFS, and is selected at run time by Lmod — the same software stack the Digital Research Alliance of Canada (formerly Compute Canada) runs its national clusters on. Four things follow.

One build, every machine

CVMFS distributes identical compiled binaries to every host that mounts it, and nothing on that mount can be edited in place. The R that validates a package is byte-for-byte the R that later runs it.

Every version stays available

Lmod loads R/4.6.1-foss-2024a without uninstalling R/4.5.3. A study filed two years ago still has its original interpreter sitting there to be re-run against.

The toolchain is pinned, not just R

foss-2024a names the compiler, MPI and BLAS underneath R, not only the R version. Dependency drift stops being a mystery and becomes a version string you can cite in a report.

Reproducibility becomes evidence

Because the stack is named and immutable, a validation run can be repeated years later and reach the same verdict — which is what 21 CFR Part 11 and GAMP 5 are actually asking for.

Getting in

Nothing is installed and nothing is downloaded up front. The tree is already mounted, read-only; module load edits PATH and LD_LIBRARY_PATH in the shell you already have. The same lines work on x86_64 and arm64 — the architecture triple selects the tree.

TRIPLE=$(uname -m)-linux-gnu    # x86_64-linux-gnu or aarch64-linux-gnu
ROOT=/cvmfs/software.ndexr.io/$TRIPLE/current
source $ROOT/lmod/init/profile
module use $ROOT/eb/modules/all
module avail
module load R
R --version

CVMFS is a read-only filesystem served over plain HTTP with a local cache — built at CERN to give the worldwide LHC computing grid one software tree. Files arrive when a process opens them, so you pay for the handful you touch rather than for the size of the tree; identical content is stored and fetched once however many modules share it; and catalogues are signed and revisions atomic, so a client sees the whole new revision or the whole old one, never a half-updated environment.

Named all the way down

Take one ordinary line — library(stringr) — and walk it to the floor. stringr requires stringi , which is C++ that links ICU : not a copy vendored into the package, but the one the stack publishes. That ICU is ICU/75.1-GCCcore-13.3.0 , built from icu4c-75_1-src.tgz at a recorded sha256 by GCCcore 13.3.0 , which is itself built from gcc-13.3.0 source against binutils 2.42 . The chain ends at glibc 2.43 , compiled from source by the prefix bootstrap. Every box has a file naming where its source came from, and no layer underneath belongs to nobody.

$ ldd stringi.so | grep icu
libicuuc.so.75   => /cvmfs/.../ICU/75.1-GCCcore-13.3.0/lib64/libicuuc.so.75
libicui18n.so.75 => /cvmfs/.../ICU/75.1-GCCcore-13.3.0/lib64/libicui18n.so.75

library(stringr), walked to the floor - every box names its own source

Why not just a container

A container image and an EasyBuild recipe look like the same promise — freeze the environment — but they freeze different things. A Containerfile resolves against a distribution archive that moves continuously; an easyconfig resolves against a source tarball at a fixed hash. Everything below follows from that one difference.

Same shape, different middle box - an archive that moves, or a source at a fixed hash

A distro pin is not a source pin

apt-get install takes whatever the archive serves that day. Pinning a package build names neither the compiler, nor the BLAS, nor the source, nor a checksum — and a real image pulls in a hundred and fifty -dev packages, none of which say where they came from.

Rebuilds move everything at once

Rebuild the same file three months later and you get a different environment under the same tag. The digest is stable only while you never rebuild, and a single CVE forces a rebuild of the lot.

An image records the result, not the derivation

It proves what you shipped. It cannot prove what you built from, which is the question an auditor is actually asking — and keeping the image aligned with its host stays manual lockstep work, forever.

So use both

Containers isolate and ship; the stack names and preserves. Mount CVMFS inside the container and the image goes thin, with nothing to rebuild: the same module load inside and outside, resolving to the same bytes.

Where it sits

Use the Regeneron bar above to move across the suite. Surface tracks what regeneron.com publishes. Package validation holds GxP evidence per R package, run against the very interpreters REACH describes. Rapid prototyping is the delivery story. REACH is the ground all three stand on.