DEVOPSdigest

The Apptainer community announced version 1.1.0 of the popular container system for secure, high-performance computing (HPC). Improvements in the new version provide a smaller attack surface for production deployments while offering features that improve and simplify the user experience.

Apptainer continues the legacy of Singularity with backwards compatibility, stability, added security, performance and reproducibility.

Version 1.1.0 of Apptainer delivers a smaller attack surface with the implementation of a fully rootless container runtime in that Apptainer no longer installs a setuid-root portion by default. Instead, common operations can now be executed with only unprivileged user namespaces. If a user installs from binary packages (EPEL packages coming soon), the setuid portion can be restored by installing the apptainer-suid package. Or, if users install from source, it can be included by compiling with the mconfig –with-suid option.

Improvements shipping as part of this new feature include:

- A squashfuse image driver that enables mounting SIF files without using setuid-root.

- A fuse2fs image driver that enables mounting EXT3 files and EXT3 SIF overlay partitions without using setuid-root.

- A persistent overlay option (--overlay) and --writable-tmpfs without using setuid-root. This requires unprivileged user namespaces and either a new enough kernel (>= 5.11) or the fuse-overlayfs command.

- The ability to change SIF file mounts to use squashfuse_ll instead of squashfuse for improved performance. For even better parallel performance, a patched multithreaded version of squashfuse_ll is included in rpm and debian packaging.

Apptainer 1.1.0 is further enhanced by allowing users greater flexibility to set up containers without using root. The new version extends the --fakeroot option to make it useful when /etc/subuid and /etc/subgid mappings have not been configured on the host. When this is the case, a root-mapped unprivileged user namespace (the equivalent of unshare -r) and/or the fakeroot command from the host will be tried. Together, these emulate the same mappings and are simpler to administer. This feature is especially useful with the --overlay and --writable-tmpfs options and for building containers unprivileged, because they allow installing packages that assume they're running as root.