Architecture

Workbench Native App

Access to Workbench

Users can access the Posit Workbench Native App through the Snowflake Snowsight UI. The application also has an ingress URL that you can access directly.

Application installation

The Posit Workbench Native App launches Posit Workbench within your own Snowflake ecosystem.

Install the Native App through the Snowflake Marketplace, then configure it to use the appropriate References and Application Database.

Posit manages both the App Listing and Application Package to allow for regular releases and upgrades.

Native App internals and administration

The Native App includes the following elements:

Administer Workbench: A Streamlit app available within Snowsight that provides an interactive UI for administrators to administer, debug, and back up the Native App.
Workbench Service: Posit Workbench containerized as a fully managed application within Snowpark Container Services (SPCS).
Application Database: An isolated database for internal Workbench controls, configuration, state management, and metadata.

Components and resources

This diagram shows the Native App and its required resources, both provided by the account and created for the Native App. The Native App can access account resources with explicit grants, but Snowflake otherwise prevents the Native App from knowing anything about the account where it runs. The Workbench Native App can access account resources containing the license secret, OAuth integration, and external access integration (egress).

Snowpark Container Services:

The Workbench Service runs a Snowflake-hosted Workbench container image.
The Workbench Service performs a license check for an Advanced Workbench tier license.
The Workbench Service runs on a virtual machine node called a Compute Pool.
User home directory data persists on a block volume mounted on the Workbench container.
Backups use snapshots of the block volume.

Snowflake Native App:

References:

External Access Integration: Network rules for egress
Workbench License: Stores the workbench license
OAuth Security Integration: authentication and authorization

Application Database:

services: Schema for workbench service and state
data: Schema for application internal data including snapshots
app: Schema for streamlit app and stored procedures
callback: Schema for streamlit callback references

Legend

Architecture diagrams follow the C4 Model. The nomenclature for the levels of abstraction in the C4 model does not necessarily match up with how the terms are commonly used by developers, especially “Container” and “Component”.