One environment. Everywhere. For as long as you need it.

REACH — Regeneron Environment for Analytics, Computing, and HPC · ndexr.io

reach.regeneron.ndexr.io

The claim

The environment stops
being a variable.

REACH runs on the Compute Canada stack — the software environment behind Canada’s national research computing

The problem, plainly

“It works on my machine” is a scientific problem, not only an IT one.

  • Two scientists, two R versions, two answers — and no clean way to say which is right.
  • A result from three years ago will not re-run, because the environment it ran in no longer exists.
  • Every new machine is a fresh install, a fresh drift, a fresh surprise.

What the Compute Canada stack is

Not a product. Not a vendor. Not something to buy.

It is the software environment the Digital Research Alliance of Canada (formerly Compute Canada) built to run every national HPC cluster in the country.

  • Open source, publicly documented
  • Tens of thousands of researchers use it daily
  • Maintained by people whose job it is

REACH adopts it whole rather than inventing an internal equivalent.

Four parts, one job

A scientist only ever types one of these — module load.

Everything above it already happened: once, centrally, for everybody. No install step, no build step, no per-project environment to curate.

It arrives as a mount, not an install

One published tree. No install, no root, no per-node build, no fat image to rebuild

Getting in is a few lines

  • Nothing is installed. The tree is already there, read-only.
  • module load edits PATH in the shell you already have.
  • The same lines on x86_64 and arm64 — the triple picks the tree.

One tree, served to everyone

CVMFS is a read-only filesystem delivered over plain HTTP with a local cache. It was built at CERN to give the worldwide LHC computing grid one software tree.

  • Files arrive when a process opens them — you pay for the few you touch, not for the size of the tree.
  • Content-addressed and deduplicated: a library shared by twenty modules is stored once and fetched once.
  • Signed catalogues, atomic revisions — a client sees the whole new revision or the whole old one, never a half-updated environment.

You pick a version. You never chase one.

ml spider R on the REACH stack — six interpreters, one shell

module load R/4.5.1
  • Loading one does not uninstall another.
  • Upgrading one team’s environment cannot break another team’s.
  • The version cited in a report is still sitting there, unchanged, years later.

The pin goes deeper than R

foss-2024a is not decoration. It names the compiler, the MPI, and the BLAS underneath R — not just the R version.

Without it

Same code, different machine, slightly different numbers — and nobody can say why.

With it

Dependency drift stops being a mystery and becomes a version string you can cite.

Named all the way down

One ordinary line, walked to the floor — every box names its own source

The same walk, in words

  • stringr needs stringi, which is C++ that links ICU — the one the stack publishes, not a copy vendored into the package.
  • ICU 75.1 is built from icu4c-75_1-src.tgz at a recorded sha256, by GCCcore 13.3.0, itself built from gcc-13.3.0 source.
  • It ends at glibc 2.43, compiled from source. No layer below it is nobody’s.
libicuuc.so.75 => /cvmfs/.../ICU/75.1-GCCcore-13.3.0/lib64/libicuuc.so.75

ldd on the installed package — the link is to the stack, not to the host

Nothing is ever overwritten

One recipe — source URL, checksums, every dependency named

  • Every build comes from a recipe — a readable file, reviewable like code.
  • Every dependency named in it has a recipe of its own, all the way down.
  • Every publish is a new immutable revision; old revisions stay put.
  • So “we upgraded it in place and now the old result will not reproduce” simply cannot happen.

Now ask a container the same question

Same intent — freeze the environment. Look at what actually gets frozen.

  • apt-get install takes whatever the archive serves that day.
  • A distro pin names a package build: no compiler, no BLAS, no source, no hash.
  • ~150 -dev packages, and not one of them says where it came from.

Why containers drift

The difference is the second box — an archive that moves, or a source at a fixed hash

What drift looks like in practice

  • Rebuild the same file three months later and you get a different environment under the same tag. Nothing in the file changed; the world underneath did.
  • The digest is only stable while you never rebuild — and one CVE forces a rebuild of everything at once.
  • Keeping the image aligned with the host is manual lockstep. The comments in a real Containerfile say so out loud.
  • An image proves what you shipped. It cannot prove what you built from.

Not either/or

Containers isolate and ship. The stack names and preserves. Those are different jobs, and REACH does not ask you to give up the first one.

Container alone

Fat image, rebuilt to move one library. Provenance stops at the base layer.

Container + mounted stack

Thin image, nothing to rebuild. The same module load inside the container and outside it — and the same bytes.

Why regulated work likes it

  • The chain from recipe to verdict is named, immutable artefacts end to end.
  • Reproducibility stops being a promise and becomes a property of the platform.
  • Which is what 21 CFR Part 11 and GAMP 5 are actually asking for.

The honest boundary

It is a software environment — not a data platform, not a scheduler, not a replacement for either.

Adopting it means committing to modules: module load becomes part of every job script and every container recipe.

And R packages live in a governed repository (repo.ndexr.io), deliberately kept out of the stack itself — the stack ships the interpreter, the repository ships the packages.

What Regeneron gets

  • One environment — the same interpreter on a laptop, a cluster, a cloud instance, and a validated host. Byte for byte.
  • Time that runs backwards — a study from three years ago re-runs against its original stack, not an approximation of it.
  • Evidence as a by-product — versions are named and immutable, so the audit trail falls out of normal use instead of being a separate project.
  • No stack to maintain — a national-scale, open, actively maintained environment instead of an internal one nobody has time to own.

Name the environment.
Keep it forever.

reach.regeneron.ndexr.io — REACH, Regeneron Environment for Analytics, Computing, and HPC