To Pin or Not to Pin: Reproducibility trade-offs in containerised research software

Abstract

Abstract Distributing research software via containers is becoming standard practice in many domains for the benefit of improving reproducibility, security, and accessibility to tools that might otherwise be difficult to install or share. Yet containerised software requires maintenance: package sources disappear, vulnerabilities are flagged and dependencies change. Build once and forget is not a viable strategy for software intended to outlive its initial development. Reproducible software should be rebuildable. This talk examines the tensions between reproducibility, security, and accessibility that arise when maintaining container build files. We present practical strategies - from "install latest" approaches to package caches and snapshot services - to keep your builds working. A central argument is that reproducible outcomes, rather than binary reproducibility, is a more attainable and scientifically meaningful goal for most research software contexts.