Architecture

Workbench Native App

Access to Workbench

Users can access the Posit Workbench Native App through the Snowflake Snowsight UI. The application also has an ingress URL that can be accessed directly.

Application installation

The Posit Workbench Native App launches the Posit Workbench software within your own Snowflake ecosystem.

Install Workbench Native App through the Snowflake Marketplace, then configure it to use the appropriate References and Application Database.

Posit manages both the App Listing and Application Package to allow for regular releases and upgrades.

Native App internals and administration

The Native App is made up of the below elements:

Administer Workbench: A Streamlit app available within Snowsight that provides an interactive user interface for administrators to administer, debug, and backup the Native App.
Workbench Service: Posit Workbench containerized as a fully managed application within Snowpark Container Services (SPCS).
Application Database: An isolated database for internal Workbench controls, configuration, state management, and metadata.

Components and resources

This diagram shows the Native App and its required resources, both provided by the account and created for the Native App. The Native App can access account resources with explicit grants, but Snowflake otherwise prevents the Native App from knowing anything about the account where it runs. The Workbench Native App can access account resources containing the license secret, OAuth integration, and external access integration (egress).

Snowpark Container Services:

The Workbench Service is run with a Snowflake internally hosted Posit Workbench docker image.
The Workbench Service performs a license check for an Advanced Workbench tier license.
The Workbench Service runs on a virtual machine node called a Compute Pool.
User home directory data is backed up and persisted on a block volume that is mounted on the Workbench container.

Snowflake Native App

References:

External Access Integration: Network rules for egress
Workbench License: Stores the workbench license
OAuth Security Integration: Seamless authentication and authorization

Application Database:

services: Schema for workbench service and state
data: Schema for application internal data including snapshots
app: Schema for streamlit app and stored procedures
callback: Schema for streamlit callback references

Legend

Architecture diagrams follow the C4 Model. The nomenclature for the levels of abstraction in the C4 model does not necessarily match up with how the terms are commonly used by developers, especially “Container” and “Component”.