Skip to content
RepoReady
Sign up
Menu
Docs menu

Pinned dependencies and containers for research code

A requirements file with version ranges installs whatever is newest on the day. Pin exact versions so others can rebuild the environment behind your results.

Last updated

In your report

Area
Execution
Check
Environment & Dependencies

Why it matters

Package updates change defaults, fix bugs and sometimes change results. An unpinned environment drifts away from the one that produced your figures, until the code stops working.

Trisovic et al. ran over 9,000 R files from Harvard Dataverse in a clean environment: 74% failed to complete without error. Library errors were common, and the authors recommend capturing library versions, ideally with renv (Scientific Data, 2022).

What good looks like

  • Exact versions for every package, in a lock file (uv.lock, poetry.lock, conda-lock.yml, renv.lock) or as == pins, plus the Python or R version.
  • Your hand-written list of direct dependencies kept next to the lock file, so updates stay deliberate.
  • A container recipe, such as a Dockerfile or an Apptainer definition for HPC clusters, on a versioned base image instead of latest.
  • A README section with the install command, the hardware and CUDA version the code needs, and roughly how long it runs.
  • Environment files changed in the same commit as the code that needs the change.

How to fix it

Python. Freeze exact versions from a clean virtual environment that runs your analysis:

bash
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.in    # your hand-written list
pip freeze > requirements.txt     # exact == pins for every package

R. renv records the R version and every package version in renv.lock:

R
renv::init()      # once: project library and renv.lock
renv::snapshot()  # after installing or updating packages
renv::restore()   # on another machine: install the locked versions

Container. Start from a versioned base image and install from the pinned file:

Dockerfile
FROM python:3.11.9-slim
WORKDIR /work
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .

Then add a Requirements section to the README with the setup command, the CUDA version and the runtime you measured.

See this check on your repository

Every analysis reports findings for this check, with file references and suggested fixes.

Start free