fix(docker): R installs — lib path, CRAN mirror, fail-fast for toolchain

- mkdir R_LIBS_USER before Rscript; set .libPaths + cloud.r-project.org in install_packages.R
- Pre-flight step fails in seconds if cmake or pkg-config missing (avoids 30–60m then fs/rmarkdown/tidyverse verify failure)
- Ncpus=1 for R package compiles; realistic time hint for the long CRAN compile step

Author: profvjreddi

book/docker/linux/Dockerfile

@@ -469,9 +469,21 @@ RUN echo "🚀 === STARTING R INSTALLATION ===" && \
     duration=$((end_time - start_time)) && \
     echo "✅ === R INSTALLATION COMPLETE === (${duration}s)"
 
+# R may omit R_LIBS_USER from .libPaths() if the directory is missing, so install and verify
+# can disagree on where packages were written. Create it before any Rscript package step.
+RUN mkdir -p $R_LIBS_USER
+
+# Fail fast: building CRAN source packages (e.g. fs → libuv) needs cmake. Without it,
+# the R step runs 30–60+ minutes then dies at verify. See e12d7dc4a8.
+RUN echo "🔎 Pre-flight: R build toolchain (cmake, pkg-config)…" && \
+    test -d "$R_LIBS_USER" || { echo "❌ R_LIBS_USER dir missing: $R_LIBS_USER"; exit 1; } && \
+    command -v cmake >/dev/null 2>&1 || { echo "❌ cmake not in PATH (required for R package fs, needed by rmarkdown/tidyverse)"; exit 1; } && \
+    command -v pkg-config >/dev/null 2>&1 || { echo "❌ pkg-config not in PATH"; exit 1; } && \
+    echo "✅ Pre-flight OK"
+
 # === PHASE 7: R PACKAGE INSTALLATION ===
 RUN echo "🚀 === STARTING R PACKAGE INSTALLATION ===" && \
-    echo "⏰ Estimated time: 2-3 minutes" && \
+    echo "⏰ Cold build: this step compiles many CRAN packages; expect 20–60+ min (cache shortens reruns)" && \
     start_time=$(date +%s) && \
     \
     echo "Running R setup script with the following files:" && \

book/tools/dependencies/install_packages.R

@@ -5,6 +5,15 @@
 # If you need to add a new package, follow the instructions below.
 # ==============================================================
 
+# Docker/CI: R_LIBS_USER is ignored at startup if the path does not exist, so we ensure
+# a single target library and pin CRAN (HTTPS) before any install.
+lib <- Sys.getenv("R_LIBS_USER", unset = NA_character_)
+if (!is.na(lib) && nzchar(lib)) {
+  dir.create(lib, recursive = TRUE, showWarnings = FALSE)
+  .libPaths(c(lib, .libPaths()))
+}
+options(repos = c(CRAN = "https://cloud.r-project.org"))
+
 required_packages <- c(
   "downlit",    # Required for code linking in Quarto
   "ggplot2",    # Visualization package
@@ -24,14 +33,15 @@ required_packages <- c(
 
 install_if_missing <- function(pkg) {
   if (!requireNamespace(pkg, quietly = TRUE)) {
-    install.packages(pkg, repos = "http://cran.rstudio.com")
+    # Ncpus=1: avoid parallel compiles OOM'ing in Docker/Actions runners
+    install.packages(pkg, Ncpus = 1L)
   }
 }
 
 invisible(sapply(required_packages, install_if_missing))
 
 if (!requireNamespace("tinytex", quietly = TRUE)) {
-  install.packages("tinytex", repos = "http://cran.rstudio.com")
+  install.packages("tinytex", Ncpus = 1L)
   tinytex::install_tinytex()
 }