R renv lockfile repository configuration missing

Goal

Ensure that renv::restore() can install all required packages on a production server that has no outbound network access.

Current Behavior

Locally the restore succeeds because renv falls back to the system's CRAN mirror when the lockfile lacks a repos field. On a server without internet, the same restore silently fails with a generic “cannot open URL” message.

Unresolved Decision

The lockfile does not specify a repository, creating uncertainty whether to hard‑code a mirror or rely on dynamic resolution. This can lead to inconsistent package versions and silent failures.

Questions

1. Should the repos entry be added to the renv.lock file to guarantee reproducible restores in offline environments?

2. What environment variables could override the lockfile’s repository setting on a production server, and how can they be controlled?

3. Is there a recommended strategy for maintaining consistent CRAN snapshots between local and production deployments?